diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 713aa92b..1934841e 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -51,6 +51,11 @@ jobs:
   publish:
     name: "Publish"
     needs: [test-mac, test-lnx, test-win]
+    # we run the action from this branch whenever we can (when it runs in our repo's context)
+    if: >
+      always() &&
+      github.event.sender.login != 'dependabot[bot]' &&
+      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     uses: "./.github/workflows/publish.yml"
     permissions:
       checks: write
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b5e593ad..5272369c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,11 +6,6 @@ on:
 jobs:
   publish-dockerfile:
     name: Publish Test Results (Dockerfile)
-    # we run the action from this branch whenever we can (when it runs in our repo's context)
-    if: >
-      always() &&
-      github.event.sender.login != 'dependabot[bot]' &&
-      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     runs-on: ubuntu-latest
     permissions:
       checks: write
@@ -50,11 +45,6 @@ jobs:
 
   publish-docker-image:
     name: Publish Test Results (Docker Image)
-    # we run the action from this branch whenever we can (when it runs in our repo's context)
-    if: >
-      always() &&
-      github.event.sender.login != 'dependabot[bot]' &&
-      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     runs-on: ubuntu-latest
     permissions:
       checks: write
@@ -217,11 +207,6 @@ jobs:
 
   publish-composite:
     name: Publish Test Results (${{ matrix.os-label }} python ${{ matrix.python }})
-    # we run the action from this branch whenever we can (when it runs in our repo's context)
-    if: >
-      always() &&
-      github.event.sender.login != 'dependabot[bot]' &&
-      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     runs-on: ${{ matrix.os }}
     permissions:
       checks: write
@@ -297,12 +282,6 @@ jobs:
 
   publish-test-files:
     name: Publish Test Files
-    # does not really depend on 'tests' but can be executed together with other publish tasks just for good taste
-    # we run the action from this branch whenever we can (when it runs in our repo's context)
-    if: >
-      always() &&
-      github.event.sender.login != 'dependabot[bot]' &&
-      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     runs-on: ubuntu-latest
     permissions:
       checks: write
@@ -349,12 +328,6 @@ jobs:
 
   publish-test-file:
     name: Publish Test File
-    # does not really depend on 'tests' but can be executed together with other publish tasks just for good taste
-    # we run the action from this branch whenever we can (when it runs in our repo's context)
-    if: >
-      always() &&
-      github.event.sender.login != 'dependabot[bot]' &&
-      ( github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository )
     runs-on: ubuntu-latest
     permissions:
       checks: write