chore: update pvtr plugin to ossf repo and v0.23.2 IN-986

[gaspergrom]

Summary

Updates the pvtr GitHub repo scanner plugin from the old revanite-io/pvtr-github-repo repo to the new canonical location at ossf/pvtr-github-repo-scanner, and bumps the version to v0.23.2. Also updates the catalog ID and CATALOG_ID constant from the deprecated OSPS_B to osps-baseline-2026-02.

Changes

• Dockerfile.security_best_practices_worker: updated clone URL to ossf/pvtr-github-repo-scanner, updated commit hash to v0.23.2 (c7bd9538)
• example-config.yml: catalog OSPS_B → osps-baseline-2026-02
• activities/index.ts: CATALOG_ID constant 'OSPS_B' → 'osps-baseline-2026-02'

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

https://linuxfoundation.atlassian.net/browse/IN-986

---

Note

Medium Risk
Moderate risk: changes the container build inputs (Go/Alpine base and external plugin repo/commit) and tightens DB lookup scoping for control evaluations, which could affect ingestion if catalog IDs or suite associations don’t match existing data.

Overview
Updates the security_best_practices_worker container to build the pvtr GitHub repo scanner from the canonical ossf/pvtr-github-repo-scanner repo at v0.23.2, and bumps the plugin build image to golang:1.26.3-alpine3.23.

Migrates the OSPS baseline catalog identifier from OSPS_B to osps-baseline-2026-02 in both the worker config and DB ingestion, and updates findSuiteControlEvaluation to optionally filter by securityInsightsEvaluationSuiteId (now passed from the worker) to avoid cross-suite collisions.

^{Reviewed by Cursor Bugbot for commit f5e33c8. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Updates the security best practices worker to use the canonical OSSF PVTR GitHub repo scanner and the newer OSPS baseline catalog ID.

Changes:

• Bumps the PVTR plugin source repository and pinned commit to v0.23.2.
• Updates the Privateer example config catalog from OSPS_B to osps-baseline-2026-02.
• Updates the worker’s saved evaluation-suite lookup catalog ID accordingly.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
services/apps/security_best_practices_worker/src/activities/index.ts	Updates the catalog ID used when selecting the evaluation suite to persist.
services/apps/security_best_practices_worker/example-config.yml	Updates the configured catalog passed to Privateer/PVTR.
scripts/services/docker/Dockerfile.security_best_practices_worker	Switches plugin clone/build source to the OSSF scanner repo and pinned commit.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 02ba949. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[gaspergrom]

Addressed the duplicate row issue flagged by cursor[bot].

When a repo was previously scanned with the old OSPS_B catalog, control evaluation rows exist in the DB tied to the old suite. After this update, a rescan creates a new suite (different catalogId) and inserts new control evaluations under it. Because findSuiteControlEvaluation queried only by (repo, controlId) with no suite filter, it would find both old and new rows and oneOrNone would throw "Multiple rows were not expected".

Fix: added an optional suiteId parameter to findSuiteControlEvaluation and pass suite.id at the call site, so the query only matches rows from the current scan's suite. Backward compatible — existing callers without the parameter are unaffected.

[epipav]

Looks good. One thing we can do to prevent duplicate evaluations and assessments is to update the existing catalogId to the new value in a migration

  UPDATE "securityInsightsEvaluationSuites"                                                                                                                                                                                                   
  SET "catalogId" = 'osps-baseline-2026-02'                                                                                                                                                                                                   
  WHERE "catalogId" = 'OSPS_B';