fix: auto-bump scanner releases after merge

[kantorcodes]

Summary

• derive the next patch version from the latest release tag on pushes to main
• keep tagged releases publishing the explicit tag version unchanged
• preserve the existing PyPI publish and GitHub release flow while removing the need for a manual source version bump before release

Verification

• yq '.' .github/workflows/publish.yml >/dev/null
• derived next version from latest tag: 1.4.1

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• .github/workflows/publish.yml - No issues

The implementation correctly:

• Uses GITHUB_EVENT_NAME to differentiate between tag pushes and branch pushes
• Parses the latest semantic version tag and increments only the PATCH component
• Validates tag format before parsing to prevent malformed version strings
• Falls back to BASE_VERSION (from pyproject.toml) when no tags exist, allowing manual override
• Stamps the computed version into both pyproject.toml and version.py before building

The logic is sound and handles edge cases appropriately.

---

_{Reviewed by minimax-m2.5-20260211 · 191,062 tokens}