chore: update pvtr plugin to ossf repo and v0.23.2 IN-986

[gaspergrom]

Summary

Updates the pvtr GitHub repo scanner plugin from the old revanite-io/pvtr-github-repo repo to the new canonical location at ossf/pvtr-github-repo-scanner, and bumps the version to v0.23.2. Also updates the catalog ID and CATALOG_ID constant from the deprecated OSPS_B to osps-baseline-2026-02.

Changes

• Dockerfile.security_best_practices_worker: updated clone URL to ossf/pvtr-github-repo-scanner, updated commit hash to v0.23.2 (c7bd9538)
• example-config.yml: catalog OSPS_B → osps-baseline-2026-02
• activities/index.ts: CATALOG_ID constant 'OSPS_B' → 'osps-baseline-2026-02'

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

https://linuxfoundation.atlassian.net/browse/IN-986

---

Note

Medium Risk
Catalog ID migration and scanner swap affect how OSPS baseline results are stored and matched; suite-scoped lookups reduce wrong-row joins but deploy must run the migration with the worker image update.

Overview
Moves the security best practices worker to the OSSF pvtr-github-repo-scanner plugin at v0.23.2 (new commit, Go 1.26.3 image) and aligns Privateer policy with catalog osps-baseline-2026-02 instead of OSPS_B.

A Flyway migration rewrites existing securityInsightsEvaluationSuites.catalogId values; the worker’s CATALOG_ID and example config match the new id. findSuiteControlEvaluation can filter by securityInsightsEvaluationSuiteId, and persistence now passes suite.id so assessments attach to the correct suite after the catalog rename.

^{Reviewed by Cursor Bugbot for commit c84ee25. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates the security best practices worker to use the canonical OSSF PVTR GitHub repo scanner and the newer OSPS baseline catalog ID.

Changes:

• Bumps the PVTR plugin source repository and pinned commit to v0.23.2.
• Updates the Privateer example config catalog from OSPS_B to osps-baseline-2026-02.
• Updates the worker’s saved evaluation-suite lookup catalog ID accordingly.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
services/apps/security_best_practices_worker/src/activities/index.ts	Updates the catalog ID used when selecting the evaluation suite to persist.
services/apps/security_best_practices_worker/example-config.yml	Updates the configured catalog passed to Privateer/PVTR.
scripts/services/docker/Dockerfile.security_best_practices_worker	Switches plugin clone/build source to the OSSF scanner repo and pinned commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[gaspergrom]

Addressed the duplicate row issue flagged by cursor[bot].

When a repo was previously scanned with the old OSPS_B catalog, control evaluation rows exist in the DB tied to the old suite. After this update, a rescan creates a new suite (different catalogId) and inserts new control evaluations under it. Because findSuiteControlEvaluation queried only by (repo, controlId) with no suite filter, it would find both old and new rows and oneOrNone would throw "Multiple rows were not expected".

Fix: added an optional suiteId parameter to findSuiteControlEvaluation and pass suite.id at the call site, so the query only matches rows from the current scan's suite. Backward compatible — existing callers without the parameter are unaffected.

[epipav]

Looks good. One thing we can do to prevent duplicate evaluations and assessments is to update the existing catalogId to the new value in a migration

  UPDATE "securityInsightsEvaluationSuites"                                                                                                                                                                                                   
  SET "catalogId" = 'osps-baseline-2026-02'                                                                                                                                                                                                   
  WHERE "catalogId" = 'OSPS_B'; 

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[cursor]

Migration hits unique constraint

High Severity

The catalog rename UPDATE can fail when a repo already has a securityInsightsEvaluationSuites row with osps-baseline-2026-02 from a rescan on the new worker, while an older row still has OSPS_B. Renaming the legacy row duplicates (repo, catalogId) and violates the table unique constraint, blocking the migration.

 

^{Reviewed by Cursor Bugbot for commit 125d6c7. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c84ee25. Configure here.}

[cursor]

Save ignores legacy catalog scans

Medium Severity

saveOSPSBaselineInsightsToDB only selects the evaluation suite matching osps-baseline-2026-02. Redis payloads from scans still using OSPS_B leave evaluationSuite undefined, and the next property access throws at runtime.

 

^{Reviewed by Cursor Bugbot for commit c84ee25. Configure here.}