Skip to content

chore: update pvtr plugin to ossf repo and v0.23.2 IN-986 #4126

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gaspergrom merged 5 commits into from
Jun 4, 2026
Merged

chore: update pvtr plugin to ossf repo and v0.23.2 IN-986 #4126

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
02ba949
chore: update pvtr plugin to ossf repo and v0.23.2 (IN-986)
gaspergrom May 18, 2026
e7b33bf
chore: bump golang image to 1.26.3 for pvtr-github-repo-scanner compa…
gaspergrom May 18, 2026
f5e33c8
fix: scope findSuiteControlEvaluation by suiteId to prevent duplicate…
gaspergrom May 18, 2026
125d6c7
chore: migrate OSPS_B catalogId to osps-baseline-2026-02 (IN-986)
gaspergrom Jun 4, 2026
c84ee25
Merge branch 'main' into chore/IN-986-update-pvtr-repo
gaspergrom Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions backend/src/database/migrations/U1780555634__update-osps-catalog-id.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
UPDATE "securityInsightsEvaluationSuites"
SET "catalogId" = 'OSPS_B'
WHERE "catalogId" = 'osps-baseline-2026-02';
3 changes: 3 additions & 0 deletions backend/src/database/migrations/V1780555634__update-osps-catalog-id.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
UPDATE "securityInsightsEvaluationSuites"
SET "catalogId" = 'osps-baseline-2026-02'
WHERE "catalogId" = 'OSPS_B';

@cursor cursor Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Migration hits unique constraint

High Severity

The catalog rename UPDATE can fail when a repo already has a securityInsightsEvaluationSuites row with osps-baseline-2026-02 from a rescan on the new worker, while an older row still has OSPS_B. Renaming the legacy row duplicates (repo, catalogId) and violates the table unique constraint, blocking the migration.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 125d6c7. Configure here.

12 changes: 6 additions & 6 deletions scripts/services/docker/Dockerfile.security_best_practices_worker
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,14 @@ ARG PLATFORM=Linux_x86_64
RUN wget https://github.com/privateerproj/privateer/releases/download/v${VERSION}/privateer_${PLATFORM}.tar.gz
RUN tar -xzf privateer_${PLATFORM}.tar.gz

FROM golang:1.24.4-alpine3.21 AS plugin
FROM golang:1.26.3-alpine3.23 AS plugin
RUN apk add --no-cache make git
WORKDIR /plugin
ARG PVTR_COMMIT=88d79df63e6140c593cf15366ed63992e1fbed63
# To run the latest version of the plugin, we need to use the latest commit of the pvtr-github-repo repository.
# Currently using the version https://github.com/revanite-io/pvtr-github-repo/commit/88d79df63e6140c593cf15366ed63992e1fbed63
RUN git clone https://github.com/revanite-io/pvtr-github-repo.git && cd pvtr-github-repo && git checkout ${PVTR_COMMIT}
RUN cd pvtr-github-repo && make binary && cp github-repo ../github-repo
ARG PVTR_COMMIT=c7bd9538d64f7eaab94a05c9b5fd05458a387b1c
# To run the latest version of the plugin, we need to use the latest commit of the pvtr-github-repo-scanner repository.
# Currently using v0.23.2: https://github.com/ossf/pvtr-github-repo-scanner/commit/c7bd9538d64f7eaab94a05c9b5fd05458a387b1c
RUN git clone https://github.com/ossf/pvtr-github-repo-scanner.git && cd pvtr-github-repo-scanner && git checkout ${PVTR_COMMIT}
RUN cd pvtr-github-repo-scanner && make binary && cp github-repo ../github-repo

FROM node:20-alpine as builder

Expand Down
2 changes: 1 addition & 1 deletion services/apps/security_best_practices_worker/example-config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ services:

policy:
catalogs:
- OSPS_B
- osps-baseline-2026-02
applicability:
- Maturity Level 1

Expand Down
3 changes: 2 additions & 1 deletion services/apps/security_best_practices_worker/src/activities/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ export async function saveOSPSBaselineInsightsToDB(
key: string,
repo: ISecurityInsightsObsoleteRepo,
): Promise<void> {
const CATALOG_ID = 'OSPS_B'
const CATALOG_ID = 'osps-baseline-2026-02'
Comment thread
cursor[bot] marked this conversation as resolved.

@cursor cursor Bot Jun 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Save ignores legacy catalog scans

Medium Severity

saveOSPSBaselineInsightsToDB only selects the evaluation suite matching osps-baseline-2026-02. Redis payloads from scans still using OSPS_B leave evaluationSuite undefined, and the next property access throws at runtime.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit c84ee25. Configure here.

const redisCache = new RedisCache(`osps-baseline-insights`, svc.redis, svc.log)
const result = await redisCache.get(key)
const parsedResult: ISecurityInsightsPrivateerResult = JSON.parse(result)
Expand Down Expand Up @@ -131,6 +131,7 @@ export async function saveOSPSBaselineInsightsToDB(
qx,
repo.repoUrl,
evaluation['control-id'],
suite.id,
)
for (const assessment of evaluation.assessments) {
await addControlEvaluationAssessment(qx, {
Expand Down
3 changes: 3 additions & 0 deletions services/libs/data-access-layer/src/security_insights/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,16 +102,19 @@ export async function findSuiteControlEvaluation(
qx: QueryExecutor,
repo: string,
controlId: string,
suiteId?: string,
): Promise<ISecurityInsightsEvaluations | null> {
return await qx.selectOneOrNone(
`
select *
from "securityInsightsEvaluations"
where "repo" = $(repo) and "controlId" = $(controlId)
${suiteId ? 'and "securityInsightsEvaluationSuiteId" = $(suiteId)' : ''}
`,
{
repo,
controlId,
suiteId,
},
)
}
Expand Down
Loading