[Fix] Publish to package should not simply based on the main branch (#808)

Author: JQGoh

.github/workflows/python-publish.yml

@@ -3,7 +3,6 @@ name: Upload Python Packages
 on:
   push:
     tags: ['v*']
-    branches: ['main']   # tag must be reachable from main branch
 
 jobs:
   deploy:
@@ -13,6 +12,11 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - name: Ensure tag commit is on main
+        run: |
+          git fetch origin main
+          git merge-base --is-ancestor $GITHUB_SHA origin/main
+
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # 6.2.0
         with: