Sync upstream (98b37c7d) — needs conflict resolution

[cloud-api-adaptor-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into cohere, but there are conflicts.

Upstream HEAD: 98b37c7d

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into cohere,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-08-10-98b37c7d
git merge origin/cohere
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-08-10-98b37c7d

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

High Risk
Large CI and release-path changes (removed Azure/docker e2e, podvm directory move, dropped CSI/Packer jobs) can break fork-specific automation and shift which images e2e tests consume until conflicts and local patches are reconciled.

Overview
This brings upstream main (~98b37c7d) into the fork: a large CI and packaging realignment, not a single feature.

PodVM build path — Workflows and docs now build from src/cloud-api-adaptor/podvm instead of podvm-mkosi. Callable podvm_builder / podvm_binaries / podvm / podvm_mkosi_ubuntu workflows are removed; podvm_mkosi.yaml gains tee-platform, concurrency, and new ORAS image naming. Azure-specific podvm image build, release, and full Azure e2e workflows are deleted. Release adds podvm_byom_binaries_publish.yaml and wires BYOM binary publish after podvm images.

E2E matrix — e2e_run_all no longer builds legacy podvm chains or Ubuntu mkosi jobs; AWS and libvirt depend on mkosi amd64/s390x only. Docker e2e and the test_e2e_docker PR label path are removed. BYOM can omit a prebuilt podvm image and builds podvm/BYOM images in-job. build.yaml drops the csi-wrapper job; publish/release no longer push CSI wrapper images.

Tooling & hygiene — govulncheck uses .govulncheck-ignore.toml and hack/govulncheck-filter.py; packer-check is removed from Makefile / lint. Dev CAA builds drop the docker builtin provider. CITATION.cff bumps to 0.22.0. Widespread GitHub Actions version bumps (checkout v7, setup-go v6.5, Docker/CodeQL/zizmor, allow-unsafe-pr-checkout on several workflows).

Docs — README/release docs de-emphasize CSI wrapper and Packer podvm; Azure dev notes point at podvm not podvm-mkosi.

Resolve merge conflicts with cohere carefully: any fork-specific Azure, docker, CSI, or podvm-mkosi automation may be obsolete or need re-homing on the unified podvm Makefile targets.

^{Reviewed by Cursor Bugbot for commit 98b37c7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 98b37c7. Configure here.}

[cursor]

Stale Dependabot CSI path

Medium Severity

dependabot.yml still lists src/csi-wrapper under gomod directories, but this sync removes the CSI wrapper tree and related workflows. Dependabot will keep targeting a path that no longer exists, so updates for that module fail or are skipped while the rest of the cleanup treats CSI as gone.

 

^{Reviewed by Cursor Bugbot for commit 98b37c7. Configure here.}

[cursor]

Wrong BYOM release dependency

Medium Severity

podvm-byom-binaries declares needs: podvm-images with a comment about podvm-binaries-ubuntu images, but podvm_publish now only builds mkosi images and the BYOM workflow builds and pushes its own binaries. A mkosi failure can block an unrelated BYOM binaries release, and the dependency no longer matches what the job requires.

Additional Locations (2)

• .github/workflows/podvm_publish.yaml#L37-L58
• .github/workflows/podvm_byom_binaries_publish.yaml#L94-L118

 

^{Reviewed by Cursor Bugbot for commit 98b37c7. Configure here.}

[cursor]

BYOM publish quay-only login

Medium Severity

The new BYOM binaries publish workflow always logs into quay.io and defaults REGISTRY to quay.io/confidential-containers, while sibling publish workflows select ghcr.io for forks. Calling it with a non-Quay registry input authenticates to the wrong registry, so push can fail or publish to an unintended location.

Additional Locations (1)

• .github/workflows/release.yaml#L49-L60

 

^{Reviewed by Cursor Bugbot for commit 98b37c7. Configure here.}