Pin action to vX instead of vX.Y.Z to reduce automation noise

.github/workflows/release.yml

@@ -57,7 +57,7 @@ jobs:
       # all previous steps always run in order to exercise them
       - name: Publish distribution to PyPI
         if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@v1.8.6
+        uses: pypa/gh-action-pypi-publish@release/v1
         with:
           password: ${{ secrets.PYPI_PASSWORD }}