CCM-18981: Replace deprecated create-release action

[jamesthompson26-nhs]

Description

• Replaced deprecated actions/create-release and actions/upload-release-asset with softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 (v2) in .github/workflows/stage-5-publish.yaml

publish job:

• Added permissions: contents: write (required by the new action)
• Removed actions/create-release and 7 individual actions/upload-release-asset steps
• Replaced with a single softprops/action-gh-release step that creates the release and uploads all assets via the files: input
• Zip steps are unchanged and continue to run before the release step

publish-oas-specs job:

• Replaced actions/upload-release-asset with softprops/action-gh-release using tag_name: to find the existing release and append the OAS zip — no longer depends on needs.publish.outputs.upload_url

Context

actions/create-release and actions/upload-release-asset are deprecated and unmaintained. softprops/action-gh-release is the community-standard replacement and supports both release creation and asset upload in a single step. The action is pinned to a SHA for supply-chain security.

Type of changes

• Refactoring (non-breaking change)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would change existing functionality)
• Bug fix (non-breaking change which fixes an issue)

Checklist

• I am familiar with the contributing guidelines
• I have followed the code style of the project
• I have added tests to cover my changes
• I have updated the documentation accordingly
• This PR is a result of pair or mob programming

DT3-Specific Checklist

• If I have added a new resource (SQS, Lambda, Gateway, DDB table, etc), I have created the appropriate alarms

---

Sensitive Information Declaration

• I confirm that neither PII/PID nor sensitive data are included in this PR and the codebase changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud