Add artifactory

[kuanfandevops]

No description provided.

Generally, the issue is fixed by adding an explicit permissions block either at the workflow root (to apply to all jobs without their own block) or on specific jobs, granting only the minimal read/write scopes necessary. For jobs that do not interact with the repository via the API, permissions: contents: read is usually sufficient; for jobs that create commits, push branches, or otherwise need to write via GITHUB_TOKEN, appropriate write scopes (such as contents: write) are added.

For this workflow, the simplest and safest fix without changing any existing behavior is:

• Add a root-level permissions section that sets contents: read as the default for all jobs.
• Override permissions on the deploy job to grant contents: write because it runs git commit/push commands that (if they use GITHUB_TOKEN at any point) require write access to repository contents. The push-to-artifactory job is a reusable workflow invocation; since we cannot see its internals, the conservative step is to let it inherit the root default (contents: read), which is sufficient for typical image-tag reading and logging. If that reusable workflow needs more, it should define its own permissions.

Concretely:

• In .github/workflows/dev-ci.yaml, add a new permissions: block after the on: block at the top of the file:

permissions:
  contents: read

• In the same file, under the deploy: job definition (line 137 onward), add a permissions: block:

deploy:
  name: Deploy CTHUB on Dev
  runs-on: ubuntu-latest
  timeout-minutes: 60
  needs: [set-version, set-pre-release, build]
  permissions:
    contents: write

No additional imports or dependencies are required; this is a pure YAML configuration change.