Using `branches:` filter unexpectedly prevents tags from being built, too

From Git’s point of view, a tag is a kind of branch. So the branches: only: filter applies to tag names as well:

Note that safelisting also prevents tagged commits from being built. If you consistently tag your builds in the format v1.3 you can safelist them all with regular expressions, for example /^v\d+\.\d+(\.\d+)?(-\S*)?$/

It’ll likely be more convenient to use a compound build condition instead of branches::

if: branch = master OR tag IS present