Sync upstream (387f79be) — needs conflict resolution

[cloud-api-adaptor-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into cohere, but there are conflicts.

Upstream HEAD: 387f79be

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into cohere,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-08-17-387f79be
git merge origin/cohere
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-08-17-387f79be

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

High Risk
Large CI and build-path changes remove Azure/docker/CSI automation and shift all podvm/e2e image sources; missed fork-specific wiring could break releases or e2e until conflicts and CI are verified.

Overview
This PR merges upstream cloud-api-adaptor changes (release 0.22.0) into the fork. The headline shift is PodVM: builds move from podvm-mkosi to podvm/ (mkosi), with Ubuntu as the primary image; Packer-based podvm builder/binaries/image workflows and AWS packer image assets are removed.

CI and release automation are trimmed: deleted workflows include Azure e2e, Azure podvm build/release, docker e2e, CSI wrapper image builds, podvm_builder/binaries/podvm.yaml, and podvm_mkosi_ubuntu. E2E orchestration (e2e_run_all) drops Ubuntu mkosi libvirt matrix jobs and docker tests; AWS and libvirt use mkosi amd64 qcow2 oras images; BYOM builds podvm/BYOM images in-job instead of requiring a prebuilt input. podvm_mkosi gains tee-platform, publishes qcow2 only (no docker OCI side-build), and uses unified oras naming. New podvm_byom_binaries_publish and release wiring for BYOM binaries.

Tooling: root Makefile drops packer-check; hack/packer-check.sh removed; govulncheck adds .govulncheck-ignore.toml and a JSON filter for containerd CRI checkpoint vulns. Dependabot groups CodeQL; many workflows bump checkout v7, setup-go v6.5, docker/build-push actions, allow-unsafe-pr-checkout on PR-target flows, and permission comment cleanup.

Product/docs: docker dropped from default BUILTIN_CLOUD_PROVIDERS in dev builds; README/release docs no longer reference CSI-wrapper or docker provider charts; .gitignore / golangci CSI paths cleaned. CITATION.cff and container base images (Go 1.25.12, Debian slim) updated.

^{Reviewed by Cursor Bugbot for commit 387f79b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 387f79b. Configure here.}

[cursor]

Stale Dependabot module path

Medium Severity

Dependabot still lists src/csi-wrapper under gomod directories, but that module was removed in this sync. Update checks for that ecosystem will fail or warn on a missing path, so Go dependency updates for the remaining modules can be disrupted.

 

^{Reviewed by Cursor Bugbot for commit 387f79b. Configure here.}

[cursor]

Unused BYOM image input

Medium Severity

The podvm_image input is documented as optional with a local-build fallback, but the workflow never reads inputs.podvm_image. It always builds a local image and hardcodes BYOM_PODVM_IMAGE, so a provided image is silently ignored and CI always pays for a full rebuild.

 

^{Reviewed by Cursor Bugbot for commit 387f79b. Configure here.}