fix(sbom): fix tag field on cache hits and new entries

[castrojo]

Cache hits in processLatestTagStream were preserving the old tag: imageRef value. New entries were also storing tag: imageRef.\n\nBoth now store tag: cacheKey (e.g. latest-20260514). Cache hits apply the fix idempotently — no SBOM re-downloads needed.\n\nNext SBOM cache run migrates all existing entries and the nvidia overlay resolves correctly."

Summary by CodeRabbit

Bug Fixes

• Fixed inconsistent storage of version cache identifiers – Latest version cache entries now consistently store version tags in the same format, with proper handling for both newly created and previously cached entries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 716b6303-dd14-4206-8056-63c36553f018

📥 Commits

Reviewing files that changed from the base of the PR and between 032aa50 and 5cdb13a.

📒 Files selected for processing (1)

• scripts/fetch-github-sbom.js

---

📝 Walkthrough

Walkthrough

The script fetch-github-sbom.js now normalizes Dakota :latest release cache entries to store the tag field consistently as cacheKey (e.g., latest-YYYYMMDD) rather than imageRef. This normalization occurs both when updating existing cached entries and when creating new release entries.

Changes

Dakota :latest cache tag normalization

Layer / File(s)	Summary
Tag field normalization to cacheKey scripts/fetch-github-sbom.js	Both the cache hit path (updating existing cached entries idempotently) and the new release entry path now set the tag field to cacheKey instead of imageRef, ensuring consistent representation of Dakota :latest release entries.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• projectbluefin/documentation#795: Both PRs modify scripts/fetch-github-sbom.js's Dakota :latest handling to use the derived cacheKey (latest-YYYYMMDD) consistently for cached/release entries.
• projectbluefin/documentation#802: Adjusts the workflow's cache-miss condition to control when the fallback script runs, directly tied to the same cache-hit/miss execution path that this PR normalizes.
• projectbluefin/documentation#840: Both PRs modify scripts/fetch-github-sbom.js so cached/stream entries store tag as the computed cacheKey instead of imageRef to keep downstream cache lookups consistent.

Poem

🐰 A rabbit hops through cache with care,
Where latest-YYYYMMDD tags now declare,
No more imageRef in the Dakota store—
Consistency reigns, forevermore! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main change: fixing the tag field for both cache hits and new entries in the sbom script.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

⚔️ Resolve merge conflicts

• Resolve merge conflict in branch fix/dakota-sbom-tag-cahce

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}