fx: for code scanning alert no. 1: Workflow does not contain permissions

[janishorsts]

Potential fix for https://github.com/EarthBuild/dind/security/code-scanning/1

Add an explicit permissions block to the workflow so GITHUB_TOKEN is constrained regardless of repository/org defaults.

Best fix here: define workflow-level permissions right after the trigger section (on:), before jobs::

• contents: read is sufficient for checking out repository contents.
• No additional GitHub write scopes are needed for this workflow, since Docker Hub update uses DOCKERHUB_TOKEN, not GitHub write APIs.

File to change:

• .github/workflows/dockerhub-description.yml

Region to change:

• Insert permissions: block between the existing on: block and jobs: block.

No imports/dependencies/methods are needed (YAML config only).

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

➖ Are we earthbuild yet?

No change in "earthly" occurrences

📈 Overall Progress

Branch	Total Count
main	25
This PR	25
Difference	+0

---

Keep up the great work migrating from Earthly to Earthbuild! 🚀

💡 Tips for finding more occurrences

Run locally to see detailed breakdown:

./.github/scripts/count-earthly.sh

Note that the goal is not to reach 0.
There is anticipated to be at least some occurences of earthly in the source code due to backwards compatibility with config files and language constructs.