CI builds for release use outdated GitHub action.

[jhmgoossens]

The upload-release-asset action used in Linux-ci and Windows-ci is not maintained and proposed to be replaced by softprops/action-gh-release. See the discussion of PR 214 of CoinUtils.

Whenever this replacement is performed, please validate the behaviour for releases, since the old action automatically replaced special characters like / in the name of the uploaded release asset.

[jhmgoossens]

This issue is still open, see also issue #25.

[jhmgoossens]

Regarding the use of GitHub Actions from others, not only the official GitHub Actions, I'm looking at GitHub Actions & Security: Best practices - Forking Action repositories. Pinning to an exact commit SHA of the external Action, or (even better?) forking the Action repository into coin-or should be considered. This will cause some overhead when real updates to the Actions are released.

[tkralphs]

I am happy with pinning to a release. In terms of security, I don't think there is little difference between that and forking, unless you are really managing things at a more detailed level than we are. I am using softprops/action-gh-release@v2.6.1 in some of my other projects currently and it's working fine.