fix(sbom): fetch last 10 releases for Dakota history#838
Merged
Conversation
processLatestTagStream() now processes :latest plus the 10 most recently pushed commit-SHA image tags. Each tag is a distinct build — getImageCreatedDate() extracts the date and it becomes a separate cache entry (latest-YYYYMMDD). This gives the driver-versions page a rolling 10-release history for Dakotaraptor instead of a single current-state entry. Assisted-by: Claude Sonnet 4.6 via pi
📝 WalkthroughWalkthroughThe change extends Dakota SBOM caching from a single ChangesDakota multi-image SBOM cache keying
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/fetch-github-sbom.js`:
- Around line 357-359: The current cache key uses only dateStr (from
getImageCreatedDate) producing `latest-YYYYMMDD` which lets multiple same-day
image refs overwrite each other; change the cacheKey generation to include a
unique identifier (e.g., append a time component from dateStr, the imageRef, or
the commit SHA) so each imageRef produces a distinct key (update the cacheKey
calculation where dateStr and cacheKey are computed and the other occurrence
around lines 417-419 that assigns releases[cacheKey]). Ensure the key remains
deterministic and safe for map lookups but is unique per image (use a short
imageRef/sha or ISO datetime).
- Around line 341-355: The new multi-ref imageRefs logic is never exercised
because processLatestTagStream() is only invoked when spec.usesLatestTag is true
but Dakota streams use streamPrefix: "latest" instead; update the condition that
triggers processLatestTagStream to also accept specs with streamPrefix ===
"latest" (or set spec.usesLatestTag = true when streamPrefix === 'latest') so
the code that builds imageRefs (the commitTags/latest GHCR refs) runs for those
streams as well; ensure you modify the call site that checks spec.usesLatestTag
(and any related branching) rather than the imageRefs construction itself so
existing behavior is preserved for other streams.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8e5ba1a8-e63d-413c-be73-723f93955987
📒 Files selected for processing (1)
scripts/fetch-github-sbom.js
Comment on lines
+341
to
+355
| // Seed from existing cache — accumulates history across nightly runs. | ||
| const existingReleases = existing?.streams?.[spec.id]?.releases || {}; | ||
| const releases = { ...existingReleases }; | ||
|
|
||
| // Build the list of image refs to process: :latest plus the 10 most recent | ||
| // commit-SHA tags (each is a distinct tagged build pushed to GHCR). | ||
| const allTags = await fetchGhcrTags(spec.org, spec.package); | ||
| const commitTags = allTags | ||
| .filter((t) => /^[0-9a-f]{40}$/.test(t)) | ||
| .slice(-10); // last 10 = most recently pushed | ||
| const imageRefs = [ | ||
| `ghcr.io/${spec.org}/${spec.package}:latest`, | ||
| ...commitTags.map((t) => `ghcr.io/${spec.org}/${spec.package}:${t}`), | ||
| ]; | ||
|
|
There was a problem hiding this comment.
Latest-stream backfill logic is not reachable with current stream specs.
processLatestTagStream() is only called when spec.usesLatestTag is truthy (Line 454), but Dakota specs in this file are configured via streamPrefix: "latest" and don’t set usesLatestTag. That makes the new multi-ref logic effectively dead for Dakota.
💡 Proposed fix
@@
{
id: "dakota-latest",
@@
streamPrefix: "latest",
+ usesLatestTag: true,
keyRepo: "projectbluefin/dakota",
keyless: true,
},
{
id: "dakota-nvidia-latest",
@@
streamPrefix: "latest",
+ usesLatestTag: true,
keyRepo: "projectbluefin/dakota",
keyless: true,
},Also applies to: 454-456
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/fetch-github-sbom.js` around lines 341 - 355, The new multi-ref
imageRefs logic is never exercised because processLatestTagStream() is only
invoked when spec.usesLatestTag is true but Dakota streams use streamPrefix:
"latest" instead; update the condition that triggers processLatestTagStream to
also accept specs with streamPrefix === "latest" (or set spec.usesLatestTag =
true when streamPrefix === 'latest') so the code that builds imageRefs (the
commitTags/latest GHCR refs) runs for those streams as well; ensure you modify
the call site that checks spec.usesLatestTag (and any related branching) rather
than the imageRefs construction itself so existing behavior is preserved for
other streams.
Comment on lines
+357
to
+359
| const dateStr = await getImageCreatedDate(imageRef); | ||
| const cacheKey = dateStr ? `latest-${dateStr}` : null; | ||
| if (!cacheKey) continue; |
There was a problem hiding this comment.
Date-only cache keys can overwrite multiple same-day Dakota builds.
Using latest-YYYYMMDD as the sole key means different refs pushed on the same day collapse into one entry (releases[cacheKey] = ...), so you can lose history even when processing 10 commit-SHA tags.
💡 Proposed fix
- const dateStr = await getImageCreatedDate(imageRef);
- const cacheKey = dateStr ? `latest-${dateStr}` : null;
- if (!cacheKey) continue;
+ const dateStr = await getImageCreatedDate(imageRef);
+ const refTag = imageRef.split(":").pop() || "unknown";
+ let cacheKey = dateStr
+ ? `latest-${dateStr}`
+ : `latest-unknown-${refTag.slice(0, 12)}`;
+ if (releases[cacheKey] && releases[cacheKey].imageRef !== imageRef) {
+ cacheKey = `${cacheKey}-${refTag.slice(0, 12)}`;
+ }Also applies to: 417-419
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/fetch-github-sbom.js` around lines 357 - 359, The current cache key
uses only dateStr (from getImageCreatedDate) producing `latest-YYYYMMDD` which
lets multiple same-day image refs overwrite each other; change the cacheKey
generation to include a unique identifier (e.g., append a time component from
dateStr, the imageRef, or the commit SHA) so each imageRef produces a distinct
key (update the cacheKey calculation where dateStr and cacheKey are computed and
the other occurrence around lines 417-419 that assigns releases[cacheKey]).
Ensure the key remains deterministic and safe for map lookups but is unique per
image (use a short imageRef/sha or ISO datetime).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
processLatestTagStream()only fetched the current:latestimage, so the driver-versions page always showed a single Dakota entry.Dakota stopped using
latest.YYYYMMDDdate tags in February 2026 and switched to 40-char commit-SHA image tags — one per build. The existing code had no way to discover these.Fix
processLatestTagStream()now::latestplus those 10 tags — each viagetImageCreatedDate()→latest-YYYYMMDDcache key → SBOM fetchResult: up to 10 historical Dakota releases in the driver-versions page, refreshed nightly.
Verification
Summary by CodeRabbit