The paths and paths-ignore filters on a push trigger are evaluated against the diff of the pushed commits. A tag push has no such diff in the sense the filter expects, so GitHub does not apply path filtering to tags at all and the workflow runs unconditionally.
The usual surprise is a workflow filtered to paths: ['services/api/**'] that also has tags: ['v*'] in its trigger, intended to publish only when the API changed. Every release tag runs it, including tags cut for unrelated services in a monorepo.
The same class of exception applies to branches and tags filters, which are mutually exclusive with branches-ignore and tags-ignore in the same event block, and to the fact that a push of more than a certain number of commits, or a force push, can produce a diff the filter evaluates differently than expected. If tag-triggered publishing must be conditional on paths, compute the condition inside the job with an explicit git diff against the previous tag and gate the publishing steps with if:.