It seems that multiple push values are always combined with AND, so the workflow is only excecuted if the push is on branch develop AND it is a tag. So far I havent found a way to make an OR condition, other than executing unconditionally and then checking manually if it should continue or abort.

The if statement could be a job that execute first and the other one depends on it?
But your statement is not true as per docs here: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-your-workflow-only-when-a-push-to-specific-branches-occurs

There is also this option, where we it runs if a PR got merged: https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-your-pull_request_target-workflow-when-a-pull-request-merges

Since we can't just push to the develop branch without a PR, this could also be an option.

I think that would still run on the PR branch so its probably not what we want. I will try running the workflow always on main and develop branches, then checking manually for tags on main.