[darshpatel1052]

PR title: fix: read triage metrics from metadata paths

Overview

The triage page still requests CVE conversion metrics from their old locations, so it cannot display metrics stored under metadata/. Update the NVD and CVE5 metrics paths for both test and production buckets.

Closes #6211

Details

• Read NVD metrics from metadata/nvd/metrics/<CVE-ID>.metrics.json.
• Read CVE5 metrics from metadata/cve5/metrics/<CVE-ID>.metrics.json.
• Keep the existing test and production bucket selection and non-metrics record paths.
• Preserve missing-object handling without adding a legacy-path fallback, as confirmed in the issue discussion.
• Add HTTP-backed storage regression tests covering all ten GCS sources, successful and missing reads, and lowercase CVE ID normalization.

No breaking changes or new dependencies.

AI assistance: OpenAI Codex assisted with implementation, tests, verification, and this description. The exact model variant and reasoning effort are not available in this session.

Testing

Run from go/ unless noted otherwise:

• Before the fix: go test ./internal/gcs -run TestTriageStore_GetFile_GCS -count=1 -v failed on the four metrics sources because they requested the old object paths; all six non-metrics sources passed.
• After the fix: go test ./internal/gcs ./internal/website -count=1 passed, including all 20 new storage read cases and the existing triage HTTP endpoint tests.
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.14.0 run ./internal/gcs passed with zero issues.
• go build -o /tmp/osv-6211-website ./cmd/website passed.
• Go formatting and git diff --check passed.

Storage reads were verified using a local HTTP test server and the real GCS client. Live test/production bucket access and the full monorepo test suite were not exercised.

[G-Rath]

Please read our contributing guide before opening pull requests

[G-Rath]

Whoops apologies, this is assigned to you! (That's what I get for reading my notifications backwards 🙃)

[darshpatel1052]

Whoops apologies, this is assigned to you! (That's what I get for reading my notifications backwards 🙃)

Haha, totally understandable!