Refactor folder-collection and api-services to reusable .NET CI/CD workflow

[Veerendrakak]

Summary

• Refactored "folder-collection-cicd.yml" to use the shared reusable workflow template
• Refactored "api-services-cicd.yml" to use the shared reusable workflow template
• Added "_reusable-dotnet-cicd.yml" - shared CI/CD template for all .NET microservices

Test Plan

• CI job passes on push to folder-collection, dev and master branches
• cd-dev deploys folder-collection-service to "9b301c-dev" and pod is running
• cd-dev deploys api-services to "9b301c-dev" and pod is running
• cd-test deploys both services to "9b301c-test" on push to master
• Monitoring pipeline run - verify it passes even if Deployment Report step fails

In general, this issue is fixed by explicitly setting the permissions for the GITHUB_TOKEN in the workflow, either at the top level (applies to all jobs) or per job. For reusable workflows, the caller workflow should still define its own minimal permissions so that it does not rely on repo/org defaults and so that any jobs it defines locally (now or in the future) inherit least-privilege settings.

The best fix here is to add a permissions block at the root of .github/workflows/api-services-cicd.yml, between the on: section and the concurrency: section. As a conservative, minimal starting point that aligns with GitHub’s recommendation and will be accepted by CodeQL, we can set contents: read. This allows the workflow and the reusable workflow it calls to read repository contents (necessary for typical build and CI steps) while preventing write access (e.g., pushing commits, creating releases) unless later explicitly allowed. If this workflow actually needs to perform write operations (for example, updating deployment manifests in the repo), additional specific write scopes (such as contents: write) can be added later, but we will not assume that without seeing such steps.

Concretely, modify .github/workflows/api-services-cicd.yml by inserting:

permissions:
  contents: read

after the push: block (after line 18) and before the existing concurrency: block (line 20). No imports or additional definitions are needed, as this is pure workflow configuration.

To fix the problem, add an explicit permissions block that sets least-privilege GITHUB_TOKEN permissions. The most conservative and generally recommended default is contents: read at the workflow (root) level, which applies to all jobs unless they override it. This documents the intended permission level and prevents the workflow from accidentally inheriting broader write permissions from repository or organization defaults.

In this specific file, the best minimal fix without altering existing functionality is to add a top-level permissions: block after the on: section (before concurrency: and jobs:), with contents: read. If the reusable workflow needs additional scopes (e.g., pull-requests: write), those should ideally be added in that reusable workflow; since we cannot see or modify it here, we will keep the change minimal and safe by only granting read access to repository contents. No extra imports or dependencies are needed; this is purely a YAML configuration change in .github/workflows/folder-collection-cicd.yml.