fix(sbom): add Bluefin LTS NVIDIA stream and retire dx/gdx package queries

[mrbobbytables]

Fixes #1078

Changes

• Added the bluefin-lts-nvidia stream spec to RAW_STREAM_SPECS in scripts/fetch-github-sbom.js, querying the active bluefin-lts package with the stable stream prefix and releases repo projectbluefin/bluefin-lts.
• Removed the 8 retired bluefin-dx-* and bluefin-gdx-* stream specs from scripts/fetch-github-sbom.js to avoid GHCR 404 package query errors.
• Added bluefin-lts-nvidia: "stable" mapping in SBOM_STREAM_PREFIX in scripts/fetch-github-driver-versions.js.
• Added unit tests in scripts/fetch-github-sbom.test.js confirming bluefin-lts-nvidia exists in STREAM_SPECS and retired dx/gdx streams are absent.

— hive: backend=copilot model=gemini-3.8-flash

🐝 Hive Agent: contributor | SHA: 494a7a51

[hanthor]

Removing bluefin-gdx-lts leaves a dangling nvidiaSbomFallbackStreamId

This PR deletes 8 stream specs from scripts/fetch-github-sbom.js, but three live consumers on main still name the deleted ids. The PR touches none of them.

Confirmed by enumerating the ids before and after the change:

$ git checkout -B trial origin/main && git merge --no-commit --no-ff pr1212
$ git diff origin/main -- scripts/fetch-github-sbom.js | grep -E "^[+-].*id:"
-    id: "bluefin-dx-stable",
-    id: "bluefin-dx-latest",
-    id: "bluefin-dx-lts",
-    id: "bluefin-dx-lts-hwe-testing",
-    id: "bluefin-dx-lts-hwe-testing-50",
-    id: "bluefin-dx-lts-testing-50",
-    id: "bluefin-gdx-lts",
+    id: "bluefin-lts-nvidia",
-    id: "bluefin-gdx-latest",

Still-live references to the removed ids (grep over scripts/ and src/, excluding *.test.* and fetch-github-sbom.js itself):

scripts/fetch-github-images.js:71:    nvidiaSbomFallbackStreamId: "bluefin-gdx-lts",
scripts/fetch-github-driver-versions.js:408:  const gdxLts = buildNvidiaMapFromSbomStream(sbomCache, "bluefin-gdx-lts");
src/components/FirehoseFeed.tsx:241:      getSbomCache()?.streams?.["bluefin-dx-lts"]?.releases?.[cacheKey]
src/components/FirehoseFeed.tsx:244:      getSbomCache()?.streams?.["bluefin-gdx-lts"]?.releases?.[cacheKey]

1. scripts/fetch-github-images.js:71 — blocking

projectbluefin-bluefin-lts carries nvidiaSbomFallbackStreamId: "bluefin-gdx-lts". Once this PR lands, that fallback points at a stream that no longer exists. It is now dead, and it is also a live breakage for #1233, which adds a drift gate asserting exactly this invariant. Merging this PR and then #1233 red-lines main:

$ git checkout -B trial origin/main
$ git merge --no-commit --no-ff pr1233 && git commit -m tmp && git merge --no-commit --no-ff pr1212
$ node --test scripts/sbom-stream-ids.test.js
not ok 3 - every PRODUCT_SPECS nvidiaSbomFallbackStreamId is a declared SBOM stream
  error: 'product projectbluefin-bluefin-lts names nvidiaSbomFallbackStreamId "bluefin-gdx-lts", which is not in STREAM_SPECS'
  name: 'AssertionError'
# tests 6
# pass 5
# fail 1

Since this PR adds the real bluefin-lts-nvidia stream, the fallback has served its purpose — please drop nvidiaSbomFallbackStreamId from that spec in the same PR.

2. src/components/FirehoseFeed.tsx:241,244 — please confirm intent

Those reads are guarded by optional chaining and if (dxAllPkgs), so nothing throws — the dx/gdx package chips on LTS release entries just silently render empty once the streams stop being fetched. That is a plausible reading of "retire dx/gdx package queries", but the PR body does not say the site loses those chips. Please state it explicitly, or remove the now-dead DX_CHIP_MAP enrichment block.

3. scripts/fetch-github-driver-versions.js:408 — non-blocking

buildLtsNvidiaByTagFromSbom already tries bluefin-lts-nvidia first and falls through on an empty map, so this degrades cleanly. It is dead code after this PR, worth deleting alongside the bluefin-dx-*/bluefin-gdx-* entries left in SBOM_STREAM_PREFIX (lines 61-65), which this PR adds to rather than prunes.

What does pass

Merged into current main, the suite is green — no regression from the code that is here:

$ npm run test:coverage   # origin/main + pr1212
ℹ tests 926
ℹ pass 926
ℹ fail 0

Baseline on unmodified main is tests 925 / pass 925 / fail 0, so the 1 net new test is the only delta. The gap is what is not changed, which no gate in this repo currently catches — that is the point of #1233.

---

Generated by Claude Code