Summary

Closes #743. Two real fixes plus a regression test that prevents the class of bug going forward.

Motivation / Context

Inspection of recipes/components/*/manifests/*.yaml (driven by the BOM tool from #747) flagged a handful of image references as "untagged" — risk of silent :latest drift in production. Investigation showed only one was a real bug; the rest were a BOM-tool false positive against a CRD pattern.

Fixes: #743
Refs: #739

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality) — BOM tool extension, regression test

Component(s) Affected

• Recipe data (recipes/components/gke-nccl-tcpxo/manifests/)
• Core libraries (pkg/bom)
• Test (recipes/manifest_images_test.go)

Implementation Notes

1. Real fix: gke-nccl-tcpxo init container. Was image: \"ubuntu\" with no tag — resolved to :latest from Docker Hub. Now pinned to ubuntu:24.04@sha256:c4a8... for byte-level reproducibility.

2. BOM tool: handle CRD-style triplets. NicClusterPolicy (network-operator) and Skyhook Package (nodewright-customizations) declare the deployed image as three sibling fields:

ofedDriver:
  repository: nvcr.io/nvidia/mellanox
  image: doca-driver
  version: doca3.2.0-25.10-1.2.8.0-2

The operator combines them at reconcile time. The previous BOM extractor only saw image: doca-driver and flagged it as untagged. walkForImages now collects sibling scalars up front and emits a fully-qualified ref (nvcr.io/nvidia/mellanox/doca-driver:doca3.2.0-25.10-1.2.8.0-2). The new logic:

• If image is already fully qualified (contains / or has its own tag), it's used as-is.
• Otherwise repository is prepended when present, and version is appended as a tag when image doesn't already carry one.

3. Regression test. TestComponentManifestImagesAreFullyQualified walks every components/*/manifests/*.yaml via the embedded recipes.FS and asserts every extracted image has a :tag or @digest. Currently verifies 13 image refs across the registry. This is the lint rule the issue asked for, but in test form so it runs as part of make qualify.

Image set unchanged in production. The versions for the previously "untagged" refs were already pinned in adjacent version: fields; this PR just makes the BOM reflect them correctly. The only deployed-byte change is the ubuntu init container, which now uses 24.04 LTS at a specific digest.

Testing

unset GITLAB_TOKEN && make qualify
# Codebase qualification completed

make bom after the change shows fully-qualified refs everywhere:

### gke-nccl-tcpxo
- ubuntu:24.04@sha256:c4a8d5503dfb...

### network-operator
- nvcr.io/nvidia/mellanox/doca-driver:doca3.2.0-25.10-1.2.8.0-2
- nvcr.io/nvidia/mellanox/k8s-rdma-shared-dev-plugin:network-operator-v26.1.0
- nvcr.io/nvidia/doca/doca_telemetry:1.22.5-doca3.1.0-host

### nodewright-customizations
- ghcr.io/nvidia/nodewright-packages/nvidia-setup:0.2.2
- ghcr.io/nvidia/nodewright-packages/nvidia-tuned:0.3.0
- ghcr.io/nvidia/skyhook-packages/nvidia-tuning-gke:0.1.1
- ghcr.io/nvidia/skyhook-packages/shellscript:1.1.1

pkg/bom coverage held at 87.7%.

Risk Assessment

• Low — One real YAML pin (init container, doesn't affect main workload images), one BOM-tool extractor improvement that never lowers the set of detected images, one new test. Easy to revert if a regression surfaces.

Rollout notes: the new TestComponentManifestImagesAreFullyQualified test will gate future PRs that introduce bare image: foo references in component manifests.

Checklist

• Tests pass locally (make test with -race)
• Linter passes (make lint)
• I did not skip/disable tests to make CI green
• I added/updated tests for new functionality
• I updated docs if user-facing behavior changed (n/a — internal extractor behavior)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)