use a publish token that has workflow perm

.github/workflows/deploy.yml

@@ -18,6 +18,7 @@ jobs:
       - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.inputs.rev }}
+          token: ${{ secrets.PUBLISH_TOKEN }}
       - run: |
           JOB_NAME=$(echo $JOB_NAME | sed 's|:|/|g')
           git fetch --all --tags