ci: upgrade GH actions to Node24-ready versions and tag-based release flow

.github/workflows/ci-cd.yml

@@ -4,6 +4,7 @@ name: CI/CD Pipeline
 on:
   push:
     branches: [ main, develop ]
+    tags: [ 'v*' ]
   pull_request:
     branches: [ main ]
 
@@ -17,10 +18,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.12'
     
@@ -55,10 +56,10 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: '3.11'
     
@@ -113,7 +114,7 @@ jobs:
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     
     - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
@@ -133,23 +134,21 @@ jobs:
     name: Create Release
     runs-on: ubuntu-latest
     needs: [test-ubuntu, security-scan]
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
     permissions:
       contents: write
     
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         fetch-depth: 0
     
-    - name: Get latest tag
+    - name: Get current tag
       id: get_tag
       run: |
-        # Get the latest tag, default to v1.0.0 if none exist
-        latest_tag=$(git describe --tags --abbrev=0 2>/dev/null || echo "v2.5.0")
-        echo "latest_tag=$latest_tag" >> $GITHUB_OUTPUT
-        echo "Found latest tag: $latest_tag"
+        echo "latest_tag=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+        echo "Using tag: ${GITHUB_REF_NAME}"
     
     - name: Generate changelog
       run: |