chore: update pvtr plugin to v0.24.0+2fixes

scripts/services/docker/Dockerfile.security_best_practices_worker

@@ -1,4 +1,4 @@
-ARG PVTR_VERSION=v0.23.2
+ARG PVTR_VERSION=v0.24.0
 
 FROM alpine:3.21 AS core
 RUN apk add --no-cache wget tar unzip
@@ -10,13 +10,13 @@ ARG PLATFORM=Linux_x86_64
 RUN wget https://github.com/privateerproj/privateer/releases/download/v${VERSION}/privateer_${PLATFORM}.tar.gz
 RUN tar -xzf privateer_${PLATFORM}.tar.gz
 
-FROM golang:1.26.3-alpine3.23 AS plugin
+FROM golang:1.26.4-alpine3.22 AS plugin
 RUN apk add --no-cache make git
 WORKDIR /plugin
-ARG PVTR_COMMIT=c7bd9538d64f7eaab94a05c9b5fd05458a387b1c
+ARG PVTR_COMMIT=c1095c95a1b399ec63e4f4e2b7880b0ef55e604f
 ARG PVTR_VERSION
 # To run the latest version of the plugin, we need to use the latest commit of the pvtr-github-repo-scanner repository.
-# Currently using v0.23.2: https://github.com/ossf/pvtr-github-repo-scanner/commit/c7bd9538d64f7eaab94a05c9b5fd05458a387b1c
+# Currently using v0.24.0+2fixes: https://github.com/ossf/pvtr-github-repo-scanner/commit/c1095c95a1b399ec63e4f4e2b7880b0ef55e604f
 RUN git clone https://github.com/ossf/pvtr-github-repo-scanner.git && cd pvtr-github-repo-scanner && git checkout ${PVTR_COMMIT}
 RUN cd pvtr-github-repo-scanner && make binary && cp github-repo ../github-repo
 

services/apps/security_best_practices_worker/example-config.yml

@@ -12,6 +12,6 @@ services:
         - Maturity Level 1
 
     vars:
-      owner: $REPO_OWNER
-      repo: $REPO_NAME
-      token: $GITHUB_TOKEN
+      owner: "$REPO_OWNER"
+      repo: "$REPO_NAME"
+      token: "$GITHUB_TOKEN"

services/apps/security_best_practices_worker/src/activities/index.ts

@@ -44,8 +44,15 @@ export async function getOSPSBaselineInsights(repoUrl: string, token: string): P
 
     const combinedOutput = `${stdout}\n${stderr}`
 
+    if (combinedOutput.includes('401 Unauthorized')) {
+      svc.log.warn('Detected 401 error in privateer output - token invalid or expired!')
+      throw ApplicationFailure.create({
+        message: 'GitHub token invalid or expired',
+        type: 'Token403Error',
+      })
+    }
     if (combinedOutput.includes('403')) {
-      svc.log.warn('Detected 403 error in privateer output!')
+      svc.log.warn('Detected 403 error in privateer output - token rate-limited!')
       throw ApplicationFailure.create({
         message: 'GitHub token rate-limited',
         type: 'Token403Error',
@@ -54,10 +61,17 @@ export async function getOSPSBaselineInsights(repoUrl: string, token: string): P
   } catch (err) {
     svc.log.error(`Privateer run failed: ${err.message}`)
 
-    // check for 403 in captured output if available
+    // check for auth errors in captured output if available
     const output = `${err.stdout || ''}\n${err.stderr || ''}`
+    if (output.includes('401 Unauthorized')) {
+      svc.log.warn('Detected 401 error in failed privateer output - token invalid or expired!')
+      throw ApplicationFailure.create({
+        message: 'GitHub token invalid or expired',
+        type: 'Token403Error',
+      })
+    }
     if (output.includes('403')) {
-      svc.log.warn('Detected 403 error in failed privateer output!')
+      svc.log.warn('Detected 403 error in failed privateer output - token rate-limited!')
       throw ApplicationFailure.create({
         message: 'GitHub token rate-limited',
         type: 'Token403Error',