update deployment procedure

[mbrousset-ledger]

• add .pre-commit-config.yaml and actionlint.yaml for local workflow enforcement
• replace npm deployment wf with reusable wf

[ledger-wiz-cspm-secret-detection]

Wiz Scan Summary

Scanner	Findings
Sensitive Data	-
Secrets	-
IaC Misconfigurations	7
SAST Findings	-
Software Management Findings	-
Total	7

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

To fix the problem, add an explicit permissions block to the get_tag job (or at the workflow root) that restricts the GITHUB_TOKEN to the least privilege required. Since get_tag only reads environment variables and writes to $GITHUB_OUTPUT, it does not need any token permissions at all; we can safely set permissions: {} for that job, which disables all default permissions. This aligns with how the other jobs in the same workflow already declare explicit permissions, but tailored to this job’s needs.

Concretely, in .github/workflows/docker-image-publish.yml, under the get_tag job (below runs-on: ubuntu-latest is a clear place), insert a permissions: {} block with proper indentation. No additional imports or methods are needed; this is a pure configuration change in the workflow YAML. No existing functionality changes, because get_tag never used GITHUB_TOKEN in the first place.