ci: publish X.Y.Z only from a signed annotated tag
All checks were successful
ci / build (pull_request) Successful in 10s