Sync upstream (97b44d1b) — needs conflict resolution

[cloud-api-adaptor-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into cohere, but there are conflicts.

Upstream HEAD: 97b44d1b

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into cohere,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-08-03-97b44d1b
git merge origin/cohere
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-08-03-97b44d1b

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

High Risk
Large CI and PodVM pipeline deletion/reorg plus removal of Azure/docker e2e and CSI image publish paths may break fork-specific automation or release steps until conflicts and downstream cohere config are reconciled.

Overview
This sync merges upstream 97b44d1 and reshapes CI, PodVM builds, and release docs around a single podvm/ mkosi tree (replacing podvm-mkosi paths in workflows and dev notes).

CI and PodVM: Several callable workflows are removed (Azure e2e, Azure PodVM image build/release, e2e_docker, csi_wrapper_images, podvm_builder / podvm_binaries / podvm, podvm_mkosi_ubuntu, duplicate Ubuntu smoketest). e2e_run_all no longer builds legacy builder/binaries/ubuntu mkosi jobs or docker e2e; AWS and libvirt use mkosi amd64 qcow2 artifacts; BYOM builds PodVM/BYOM images in e2e_byom instead of consuming a prebuilt podvm_image. podvm_mkosi builds from src/cloud-api-adaptor/podvm, publishes podvm-generic-ubuntu, and drops docker OCI outputs. podvm_publish / release add podvm_byom_binaries_publish; publish_images_on_push and release stop publishing CSI wrapper images. build.yaml drops the csi-wrapper job; lint drops packer check.

Tooling: GitHub Actions are bumped broadly (checkout v7, setup-go v6.5, docker actions, CodeQL, zizmor, stale, etc.). allow-unsafe-pr-checkout appears on several PR-target workflows. govulncheck can filter findings via .govulncheck-ignore.toml and hack/govulncheck-filter.py. Root Makefile check no longer runs packer-check.

Product defaults: BUILTIN_CLOUD_PROVIDERS dev build drops docker; AWS packer-based image Makefile/Dockerfiles under aws/image are deleted. cloud-api-adaptor/Dockerfile updates Go/Debian bases and adds ca-certificates. release-helper updates src/cloud-providers/Makefile image tag and drops docker provider from chart tag updates.

Docs/metadata: Release process and architecture/README edits reflect removed CSI/docker paths; CITATION.cff bumps to 0.22.0.

^{Reviewed by Cursor Bugbot for commit 97b44d1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 97b44d1. Configure here.}

[cursor]

BYOM images never loaded locally

High Severity

The new BYOM e2e path sets up a Buildx container builder, then runs image-container and image-byom-e2e-container, which call docker buildx build -t ... with neither --load nor a push. Those tags never land in the host Docker daemon, but the BYOM provisioner later does docker run on BYOM_PODVM_IMAGE, so the test cannot find the image it just built.

Additional Locations (1)

• src/cloud-api-adaptor/podvm/Makefile#L174-L202

 

^{Reviewed by Cursor Bugbot for commit 97b44d1. Configure here.}

[cursor]

Stale Dependabot csi-wrapper path

Medium Severity

dependabot.yml still lists src/csi-wrapper under the gomod ecosystem, but that module was removed in this sync. Dependabot will keep trying to update a path that no longer exists and can error or create noisy failed update runs.

 

^{Reviewed by Cursor Bugbot for commit 97b44d1. Configure here.}