github actions: how to check if current push has new tag (is new release)?

You could do this to check if the current push event is for a tag starting with v.

  publish:
    needs: test
    if: startsWith(github.ref, 'refs/tags/v')

As you pointed out though, I don't think you can guarantee that this is a new release. My suggestion would be to use on: release instead of on: push. This will only trigger on a newly tagged release.

See the docs for on: release here: https://docs.github.com/en/actions/reference/events-that-trigger-workflows#release

An alternative way to use a GitHub Release as a trigger (in case if you want to use tags freely and release specific versions only):

on:
  release:
    types: [created]

jobs:
  release-job:
    name: Releasing
    if: github.event_name == 'release' && github.event.action == 'created'