if: startsWith(github.ref, 'refs/tags')

Would be nice to have something to check the tag is a version number format - we don't currently use tags for anything else, but I'm just thinking of safeguards. It would be easy for someone to forget this existed and just use a tag for something else.

Also just noticed differences between test and real publishing sections. I think the intention is that as soon as a commit with a new version is done, that will be published to test site. We can then test? Then only when we approve, merge and tag, does it go on real one. Is that correct? Does this (and skip_existing) mean if a PR with a new version is rejected due to a problem and a new PR is made, the new PR won't be put on test site? (Does that matter?) Can all this be (intention, procedure, what/how we test) be written up somewhere?

This is the same as what we do (https://ocp-software-handbook.readthedocs.io/en/latest/python/packages.html#release-process). Every single push (on: push) gets published to TestPyPI. This ensures that the publication process isn't broken. Until you change the version number skip_existing will trigger. However, it's a bit of a misnomer as it still uploads to PyPI, it just doesn't replace the uploaded artifacts (e.g. ocdskit-1.1.3-py3-none-any.whl) and warns instead of erroring.