Sync upstream (4b9dcf24) — needs conflict resolution

[cloud-api-adaptor-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into cohere, but there are conflicts.

Upstream HEAD: 4b9dcf24

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into cohere,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-06-29-4b9dcf24
git merge origin/cohere
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-06-29-4b9dcf24

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

High Risk
Dropping the docker provider, Azure e2e/podvm CI, CSI wrapper publish paths, and Packer podvm flows is a major regression risk for anyone still relying on those; e2e and release coverage shifts to mkosi/ubuntu podvm only.

Overview
This sync brings upstream main into the fork and is a large CI and packaging reshuffle rather than a small patch.

Removed capabilities and automation: The docker cloud provider (code, Helm provider, kind/e2e workflow, and dev BUILTIN_CLOUD_PROVIDERS entry) is deleted. Packer-based podvm image builds (AWS packer templates, hack/packer-check.sh, Makefile podvm-* Docker targets) and the CSI wrapper component (workflows, release/publish jobs, docs) are removed. Azure-specific callable workflows for podvm image build, release, and full e2e are deleted entirely.

PodVM build path: CI and dev notes now use src/cloud-api-adaptor/podvm instead of podvm-mkosi, with make podvm-binaries / mkosi image targets. The generic podvm_builder / podvm_binaries / podvm image pipelines are dropped from e2e_run_all and podvm_publish in favor of podvm_mkosi and podvm_mkosi_ubuntu only; Fedora mkosi workflow no longer builds/publishes a docker-provider OCI image.

CI hygiene: Widespread bumps to actions/checkout, Docker build/login/push actions, CodeQL, zizmor, and stale; added concurrency on several workflows; permission blocks get inline comments; build drops the csi-wrapper matrix job; lint drops the Packer check job; PR e2e no longer runs on test_e2e_docker.

Misc: Release/docs/README updated for mkosi-only podvm and without CSI/docker; CITATION.cff bumped to 0.21.1; CAA Dockerfile base images and ca-certificates install updated; govulncheck skips modules with no Go packages.

^{Reviewed by Cursor Bugbot for commit 4b9dcf2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4b9dcf2. Configure here.}

[cursor]

Ubuntu smoketest wrong runner

Medium Severity

The Ubuntu podvm smoke test job now runs on ubuntu-24.04, while the Fedora smoke test in podvm_smoketest.yaml still pins ubuntu-22.04 because libvirt struggles with default OVMF on 24.04. That mismatch can break or flake Ubuntu image smoke tests on the newer runner.

 

^{Reviewed by Cursor Bugbot for commit 4b9dcf2. Configure here.}