[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles

[juliannguyen4]

TODO

• DEV stage
• How to download artifacts at specific commits in dev
• TEST stage
• Artifacts should not be overwritten in JFrog...
• Cleanup: delete all tags created by testing these changes
• [ ]

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.53%. Comparing base (30a8114) to head (8f06652).
⚠️ Report is 7 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #826   +/-   ##
=======================================
  Coverage   83.53%   83.53%           
=======================================
  Files          99       99           
  Lines       14392    14392           
=======================================
  Hits        12022    12022           
  Misses       2370     2370           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

To fix the problem, explicitly declare a permissions: block that grants only the minimal required GITHUB_TOKEN permissions. Since this workflow promotes a JFrog release bundle via OIDC and does not interact with GitHub issues, PRs, or repository contents, the safest assumption is that it needs only read access to repository contents (if anything). A common minimal baseline is contents: read, which is equivalent to the read-only default for repository contents and avoids unnecessary write scopes.

The single best fix with no functional change is to add a permissions block at the job level for promote-release-bundle-to-dev. This makes the job self-contained and documents its needs without affecting other jobs that might be added later. Insert:

permissions:
  contents: read

under runs-on: ubuntu-24.04 (same indentation as runs-on). No imports or additional methods are needed; this is purely a YAML configuration change in .github/workflows/promote-release-bundle.yml.

---