jobs.<job>.if doesn't have access to env context

I've lost count how many times I've stumbled on this limitation and spun
my wheels. See actions/runner#1189

.github/workflows/ci.yml

@@ -56,7 +56,7 @@ jobs:
   publish:
     name: Publish NuGet Package
     needs: build
-    if: ${{ env.CREATE_PACKAGE }}
+    if: startsWith(github.ref, 'refs/tags/')
     runs-on: ubuntu-latest
     steps:
       - name: Download NuGet package