Potential fix for code scanning alert no. 2: Workflow does not contain permissions

[Lawrence Lucas Large (LukeLarge)]

Potential fix for https://github.com/LukeLarge/opentonapi/security/code-scanning/2

To fix the problem, explicitly add a permissions block in the workflow file to restrict the default GITHUB_TOKEN permissions for the affected job. In this case, the job only needs to read repository contents (e.g., for checkout), so we should set permissions: contents: read either at the workflow root or specifically under the job. Since only one job (push_to_registry) is present, it makes sense to add the permissions field directly inside the job definition for clarity. You should add the following block to the job:

permissions:
  contents: read

This should be inserted below the job name (name: Push Docker image to Docker Hub) and above runs-on: for correct syntax and convention.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull request overview

This PR addresses a GitHub code scanning security alert by explicitly restricting the default GITHUB_TOKEN permissions in the Docker image publishing workflow. The change follows security best practices by implementing the principle of least privilege.

Key Changes:

• Added explicit permissions: contents: read to the push_to_registry job to limit GITHUB_TOKEN access to only what's necessary for checking out repository code

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.