fix(sbom): store cacheKey as tag so nvidia overlay matches correctly

[castrojo]

buildStreamFromSbom looks up nvidia versions with nvidiaByTag?.[entry.tag || cacheKey].\n\nWe were storing tag: imageRef (e.g. ghcr.io/projectbluefin/dakota:latest) — a truthy value that is never a key in the nvidia map. The fallback to cacheKey never ran, so nvidia was always null.\n\nFix: store tag: cacheKey (e.g. latest-20260514). The buildNvidiaMapFromSbomStream stores entries keyed by cacheKey, so nvidiaByTag['latest-20260514'] correctly returns 595.71.05."

Summary by CodeRabbit

• Bug Fixes
  • Fixed cache lookup logic to ensure consistent tag identification across system components, improving reliability of data retrieval processes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe75c2b0-b30c-40ea-b2a5-07ad84b56a03

📥 Commits

Reviewing files that changed from the base of the PR and between da1a29f and 016d8f7.

📒 Files selected for processing (1)

• scripts/fetch-github-sbom.js

---

📝 Walkthrough

Walkthrough

This PR updates scripts/fetch-github-sbom.js to align how release tags are stored in the SBOM cache. In processLatestTagStream(), the tag field now records the computed cacheKey (e.g., latest-YYYYMMDD) instead of the full image reference, enabling downstream cache lookup logic to match by cache key.

Changes

SBOM Cache Key Alignment

Layer / File(s)	Summary
Release tag field storage update scripts/fetch-github-sbom.js	The tag field in the release entry stored at releases[cacheKey] now records the computed cacheKey (latest-YYYYMMDD) instead of the full imageRef, aligning cache lookup to match by cache key.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• projectbluefin/documentation#839: Routes Dakota streams through processLatestTagStream() via usesLatestTag: true, directly complementing this PR's tag/cacheKey storage behavior.
• projectbluefin/documentation#795: Also modifies processLatestTagStream() to use derived latest-YYYYMMDD cache key instead of raw image reference for release entry keying.
• projectbluefin/documentation#808: Affects SBOM tag/keying behavior; this PR's stored tag value directly impacts downstream dakotaNvidiaByTag version lookup wiring.

Poem

🐰 A tag reborn, from name to key,
Latest-timestamps set it free,
Cache now speaks in perfect rhyme,
Aligned at last, in space and time! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: storing cacheKey as tag to fix NVIDIA overlay matching. It directly aligns with the PR's primary objective of fixing the SBOM tag lookup logic.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}