How is the logic when combining conditonals for push to restrict paths and tags or branches?

In my specific case I want to limit a workflow to only a specific list of paths, but I want to ensure it always runs on a tag. Interestingly if I only do something like this:

on:
  push:
    paths:
    - 'src/**'

The behavior is:

• If a commit contains change paths in src/** the workflow runs, if it does not contain any changes in src/** it does not run. This is as expected

• If I tag a commit that does not contain changes to src/** the workflow also runs on pushing this tag. This is kind of unexpected, but actually exactly what I want.

Is my observation correct? Can I rely on the workflow being run on every tag push?

And what happens if I define both paths and tags, e.g:

on:
  push:
    paths:
    - 'src/**'
tags:

- 'release-*'

The expecation would be that this runs on any push that changes src/** and also on an tag release-* independent of the paths in the changed commit. Is this correct? If not, how could I achieve this behavior?