Path filters not respected for tag pushes in workflow triggers #3932

Bug Report

Description

Path filters in workflow triggers are not being respected when tags are pushed, causing workflows to run even when the specified paths haven't been modified.

Expected Behavior

A workflow with path filters should only run when the specified files are modified, regardless of whether it's a branch push or tag push.

Actual Behavior

Workflows with path filters run on tag pushes even when none of the specified paths have been modified.

Reproduction Steps

1. Create a workflow with path filters:

on:
  push:
    paths:
      - "specific-file.txt"
      - ".github/workflows/workflow.yaml"

2. Make a commit that doesn't modify any of the specified paths
3. Create and push a tag for that commit
4. Observe that the workflow runs despite no matching files being changed

Evidence

• Workflow configuration shows path filters
• Commit only modified unrelated files (e.g., pkg/config/config_utils.go)
• GitHub API shows workflow triggered by push event with tag as head_branch
• Expected: Workflow should not run
• Actual: Workflow runs

Workaround

Adding tags-ignore: "**" to the push trigger prevents the issue:

on:
  push:
    tags-ignore:
      - "**"
    paths:
      - "specific-file.txt"

Environment

• GitHub Actions (hosted runners)
• All workflow trigger types affected
• Reproducible across different repositories

Impact

This causes unnecessary workflow runs, wasting CI/CD resources and potentially causing confusion about when workflows should execute.

Start by reproducing the issue with the workflow YAML and tag-push steps described in the report, then trace how tag push events apply path filters. Done means a tag push runs the workflow only when a configured path changed, while unrelated changes do not trigger it; add or update coverage for this behavior if the repository's test setup supports it.