BUILD-10765 Important: Update SonarSource/gh-action_release to v6

[SonarTech]

Important: Update GitHub Actions to compliant versions.

• .github/workflows/release.yml: release c52861bb0e5dd564187f3fd74e048f20aef0f761 → v6

See: https://discuss.sonarsource.com/t/action-required-update-your-github-actions-cache-release-and-releasability-before-31-04-2026/23899

[hashicorp-vault-sonar-prod]

BUILD-10765

[sonar-review-alpha]

Summary

This PR updates the SonarSource/gh-action_release dependency in the release workflow from a pinned commit hash (6.5.0) to the semantic version tag v6. The change affects both the test PyPI release job and the production PyPI release job in .github/workflows/release.yml. This is a compliance update with an April 31, 2026 deadline per SonarSource's requirement notice.

What reviewers should know

What changed: Two workflow job references (release-to-testpypi and release-to-pypi) now use @v6 instead of the pinned commit hash, allowing the action to receive minor updates and patches within the v6 major version.

For reviewers: Verify that both release jobs will function correctly with v6 of the action. The workflow configuration (permissions, inputs) remains identical — only the action reference was updated. No behavioral changes are expected, but confirm any v6 release notes if available.

Note: The deadline mentioned in the referenced forum post (April 31) appears to be a typo and likely means April 30 or May 1, 2026.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

LGTM! ✅

Clean, minimal change — nothing to flag. The move from a pinned commit hash to @v6 is intentional and required by SonarSource's own compliance policy, so the trade-off (mutable tag vs. immutable SHA) is accepted by design.

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed for 'Python Scanner'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[guillaume-dequenne]

LGTM. Thanks for handling this!

As discussed, sticking with pinned hash could give us a bit more control over the exact version being run, but on the other hand, the v-branch approach would have made the fix not be required in the first place, so it makes sense to make the switch.