ci: bump softprops/action-gh-release to v2

[mvanhorn]

Overview

Bumps softprops/action-gh-release from v1 to v2 in the release workflow. v1 runs on Node.js 20; v2 runs on Node.js 24.

Related Issues

Fixes #724

Change Details

softprops/action-gh-release@v1 was the last remaining Node.js 20-era GitHub Action in .github/workflows/release.yml. The rest of #724 is already addressed: every actions/checkout is on @v6 and azure/setup-helm has been removed from the workflow tree. Bumping this single action to @v2 clears the final Node.js 20 deprecation warning. The name, generate_release_notes, and files inputs already in use are all supported unchanged in v2, so no other changes are needed.

Test Results

No functional change to the release output. Verified by grep that softprops/action-gh-release now resolves only to @v2 and that no other @v1 JavaScript action remains in .github/workflows/.

Change Type

• Other (CI maintenance: GitHub Actions version bump)

Self-Checklist

• I have run a code style check and addressed any warnings/errors.
• I have added appropriate comments to my code (not applicable: workflow version bump).
• I have updated the documentation (not applicable).
• I have written appropriate unit tests (not applicable: CI workflow change).

[Zephyrcf]

Hi @mvanhorn, Can you fix the remaining deprecation warnings? In this way we can close /issues/724.

[Zephyrcf]

Hi @mvanhorn, Any updates on the PR yet?

[mvanhorn]

Nothing outstanding on my side — the branch is still mergeable against main and all the e2e jobs (cgroups v1/v2, k8s, optimizer) are green. It's a single version bump of softprops/action-gh-release to v2, so it just needs a maintainer to merge it whenever convenient. Happy to rebase if it goes stale.

[mvanhorn]

The Security scan failure here isn't from this PR. govulncheck reports 7 findings, all in pkg/** Go code -- pkg/remote/remotes/docker/resolver.go, pkg/auth/kubesecret.go, pkg/stargz/resolver.go, pkg/utils/transport/pool.go, pkg/encryption/encryption.go, pkg/system/system.go and pkg/utils/retry/retry.go. This PR touches one file, .github/workflows/release.yml, and bumps an action version; it adds no Go code and no dependencies.

They look like stdlib/toolchain advisories that landed after the last green run, so main should reproduce them. Every other job on this PR passes. Happy to open a separate PR for the dependency bumps if that's useful, but they seemed out of scope here.