Harden Repository Configuration - sol2uml

[stepsecurity-app]

StepSecurity has identified repository-level hardening opportunities in TLMSLLC/sol2uml based on your organization's Policy-Driven PR configuration.

Dependabot configuration should cover the configured package ecosystems

• Status: Failed
• Severity: Medium
• Description: This check fails if the repository has no .github/dependabot.yml or it does not cover the package ecosystems configured by the organization.
• Resolution: Add or update .github/dependabot.yml to include version updates for the configured package ecosystems.
• Details: no .github/dependabot.yml found; configured package ecosystems are not covered

Suggested changes

Create or update .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "*"
    directory: "/"
    schedule:
      interval: "daily"

Pre-commit configuration should include the configured hooks

• Status: Failed
• Severity: Low
• Description: This check fails if the repository has no .pre-commit-config.yaml or it is missing hooks the organization has configured. Pre-commit hooks enforce code quality and detect security issues before commit.
• Resolution: Add or update .pre-commit-config.yaml to include the configured hooks.
• Details: no .pre-commit-config.yaml found; configured pre-commit hooks are not set up

Suggested changes

Create or update .pre-commit-config.yaml:

repos:
- repo: https://github.com/gitleaks/gitleaks
  rev: v8.30.1
  hooks:
  - id: gitleaks
- repo: https://github.com/pre-commit/pre-commit-hooks
  rev: v6.0.0
  hooks:
  - id: end-of-file-fixer
  - id: trailing-whitespace

Enabling Pull Requests mode for these controls lets StepSecurity remediate them automatically via a pull request.