Harden Repository Configuration - bicycle

[stepsecurity-app]

StepSecurity has identified repository-level hardening opportunities in TLMSLLC/bicycle based on your organization's Policy-Driven PR configuration.

Docker images should be pinned to digests

• Status: Failed
• Severity: Medium
• Description: This check fails if a Dockerfile in the repository pulls a base image by mutable tag. Docker tags are mutable, so use digests in place of tags when pulling images.
• Resolution: Pin the base images in the flagged Dockerfiles to immutable digests (image@sha256:...).
• Details: Dockerfiles pull images by mutable tag instead of digest: Dockerfile

Suggested changes

Pin the following base images to immutable digests (image@sha256:...):

• Dockerfile
  • FROM docker.io/library/golang:1.22.1-bullseye
  • FROM docker.io/library/ubuntu:20.04
  • FROM docker.io/library/ubuntu:20.04

Dependabot configuration should cover the configured package ecosystems

• Status: Failed
• Severity: Medium
• Description: This check fails if the repository has no .github/dependabot.yml or it does not cover the package ecosystems configured by the organization.
• Resolution: Add or update .github/dependabot.yml to include version updates for the configured package ecosystems.
• Details: no .github/dependabot.yml found; configured package ecosystems are not covered

Suggested changes

Create or update .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "*"
    directory: "/"
    schedule:
      interval: "daily"

Pre-commit configuration should include the configured hooks

• Status: Failed
• Severity: Low
• Description: This check fails if the repository has no .pre-commit-config.yaml or it is missing hooks the organization has configured. Pre-commit hooks enforce code quality and detect security issues before commit.
• Resolution: Add or update .pre-commit-config.yaml to include the configured hooks.
• Details: no .pre-commit-config.yaml found; configured pre-commit hooks are not set up

Suggested changes

Create or update .pre-commit-config.yaml:

repos:
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.30.1
  hooks:
  - id: gitleaks
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v6.0.0
  hooks:
  - id: end-of-file-fixer
  - id: trailing-whitespace

Enabling Pull Requests mode for these controls lets StepSecurity remediate them automatically via a pull request.