From 9f8e4d980b5d2785a6589244dbeee728bc2cf173 Mon Sep 17 00:00:00 2001
From: Sebastian Palencsar <hello@linuxcommand.dev>
Date: Tue, 5 May 2026 06:09:13 +0200
Subject: [PATCH] ci: upgrade GH actions to Node24-ready versions and tag-based
 release flow

---
 .github/workflows/ci-cd.yml | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index c23cc7e..0777a75 100755
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -4,6 +4,7 @@ name: CI/CD Pipeline
 on:
   push:
     branches: [ main, develop ]
+    tags: [ 'v*' ]
   pull_request:
     branches: [ main ]
 
@@ -17,10 +18,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.12'
     
@@ -55,10 +56,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.11'
     
@@ -113,7 +114,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
@@ -133,23 +134,21 @@ jobs:
     name: Create Release
     runs-on: ubuntu-latest
     needs: [test-ubuntu, security-scan]
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
     permissions:
       contents: write
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
     
-    - name: Get latest tag
+    - name: Get current tag
       id: get_tag
       run: |
-        # Get the latest tag, default to v1.0.0 if none exist
-        latest_tag=$(git describe --tags --abbrev=0 2>/dev/null || echo "v2.5.0")
-        echo "latest_tag=$latest_tag" >> $GITHUB_OUTPUT
-        echo "Found latest tag: $latest_tag"
+        echo "latest_tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+        echo "Using tag: ${GITHUB_REF_NAME}"
     
     - name: Generate changelog
       run: |