fix: normalize OCI reference in store lookups to match Pull() key

ociSource.Read() was using the raw reference string to look up artifacts
in the content store, while remote.Pull() stores them under a normalized
key (e.g. 'agentcatalog/review-pr:latest'). This caused cache misses
when using fully qualified references like
'index.docker.io/agentcatalog/review-pr:latest'.

Extract NormalizeReference() from remote.Pull() and use it in
ociSource.Read() so equivalent references resolve to the same store key.

Assisted-By: docker-agent

Author: dgageot

pkg/config/sources.go

@@ -121,16 +121,24 @@ func (a ociSource) Read(ctx context.Context) ([]byte, error) {
 		return nil, fmt.Errorf("failed to create content store: %w", err)
 	}
 
+	// Normalize the reference so that equivalent forms (e.g.
+	// "agentcatalog/review-pr" and "index.docker.io/agentcatalog/review-pr:latest")
+	// resolve to the same store key that remote.Pull uses.
+	storeKey, err := remote.NormalizeReference(a.reference)
+	if err != nil {
+		return nil, fmt.Errorf("normalizing OCI reference %s: %w", a.reference, err)
+	}
+
 	tryLoad := func() ([]byte, error) {
-		af, err := store.GetArtifact(a.reference)
+		af, err := store.GetArtifact(storeKey)
 		if err != nil {
 			return nil, err
 		}
 		return []byte(af), nil
 	}
 
-	// Check if we have any local metadata (same as before)
-	_, metaErr := store.GetArtifactMetadata(a.reference)
+	// Check if we have any local metadata
+	_, metaErr := store.GetArtifactMetadata(storeKey)
 	hasLocal := metaErr == nil
 
 	// Always try normal pull first (preserves pull-interval behavior)

pkg/remote/pull.go

@@ -10,6 +10,18 @@ import (
 	"github.com/docker/docker-agent/pkg/content"
 )
 
+// NormalizeReference parses an OCI reference and returns the normalized
+// store key that Pull uses to store artifacts. This ensures that equivalent
+// references (e.g. "agentcatalog/review-pr" and
+// "index.docker.io/agentcatalog/review-pr:latest") map to the same key.
+func NormalizeReference(registryRef string) (string, error) {
+	ref, err := name.ParseReference(registryRef)
+	if err != nil {
+		return "", fmt.Errorf("parsing registry reference %s: %w", registryRef, err)
+	}
+	return ref.Context().RepositoryStr() + separator(ref) + ref.Identifier(), nil
+}
+
 // Pull pulls an artifact from a registry and stores it in the content store
 func Pull(ctx context.Context, registryRef string, force bool, opts ...crane.Option) (string, error) {
 	opts = append(opts, crane.WithContext(ctx))

pkg/remote/pull_test.go

@@ -72,6 +72,58 @@ func TestPullIntegration(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestNormalizeReference(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		ref      string
+		expected string
+	}{
+		{
+			name:     "short reference gets normalized",
+			ref:      "agentcatalog/review-pr",
+			expected: "agentcatalog/review-pr:latest",
+		},
+		{
+			name:     "fully qualified reference gets normalized to same key",
+			ref:      "index.docker.io/agentcatalog/review-pr:latest",
+			expected: "agentcatalog/review-pr:latest",
+		},
+		{
+			name:     "tagged reference preserves tag",
+			ref:      "agentcatalog/review-pr:v1",
+			expected: "agentcatalog/review-pr:v1",
+		},
+		{
+			name:     "digest reference preserves digest",
+			ref:      "agentcatalog/review-pr@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+			expected: "agentcatalog/review-pr@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+		},
+		{
+			name:     "non-docker-hub registry",
+			ref:      "ghcr.io/myorg/agent:v2",
+			expected: "myorg/agent:v2",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			result, err := NormalizeReference(tt.ref)
+			require.NoError(t, err)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestNormalizeReference_InvalidReference(t *testing.T) {
+	t.Parallel()
+
+	_, err := NormalizeReference(":::invalid")
+	require.Error(t, err)
+}
+
 func TestSeparator(t *testing.T) {
 	t.Parallel()