Sync upstream (335edee3) — needs conflict resolution

[cloud-api-adaptor-upstream-sync]

Upstream sync — manual merge needed

Upstream has new commits to merge into cohere, but there are conflicts.

Upstream HEAD: 335edee3

How to resolve

The sync branch already contains the upstream commits (it points at
origin/main). To make it mergeable into cohere,
merge cohere into the sync branch and resolve conflicts there:

git fetch origin
git checkout sync/upstream-2026-08-31-335edee3
git merge origin/cohere
# Git will show conflicts — resolve them in your IDE, then:
git add -A && git commit
git push origin sync/upstream-2026-08-31-335edee3

Your IDE will show the native merge conflict UI with accept-theirs /
accept-ours / accept-both options for each conflict. Once the push
succeeds, the PR will become mergeable.

Review checklist

• Resolve all conflicts
• Verify CI passes
• Check if any upstream changes obsolete our patches

---

Note

Medium Risk
Large CI and release-path changes can break e2e coverage or image publishing; Azure e2e and secret wiring are security-sensitive though Azure is restricted from untrusted PR runs.

Overview
This upstream sync restructures CI and PodVM build paths around a single src/cloud-api-adaptor/podvm tree (replacing podvm-mkosi in workflows and devcontainer docs) and narrows the e2e matrix to mkosi-based images.

E2E orchestration (e2e_run_all.yaml) drops the old Packer chain (podvm_builder / podvm_binaries / podvm), Ubuntu mkosi publish jobs, and the docker provider e2e workflow. It adds Alibaba Cloud e2e (label-gated, OIDC), wires Azure through a new callable e2e_azure.yaml (publish gallery image via src/cloud-api-adaptor/azure, provision AKS, run tests) limited to schedule/workflow_dispatch (not PR labels), and points AWS/libvirt/BYOM at mkosi qcow2 artifacts. BYOM e2e now builds podvm/BYOM images in-job when no prebuilt image is supplied.

Removed workflows include standalone Azure e2e/podvm release pipelines (azure-e2e-test, azure-podvm-image-build, azure-podvm-release), CSI wrapper image publish, duplicate Ubuntu smoketest, and csi-wrapper from build.yaml / release / push-on-main. Release adds podvm_byom_binaries_publish and bumps CITATION.cff to v0.22.0.

Cross-cutting updates: GitHub Actions pin bumps (checkout v7, setup-go v6.5, Docker/CodeQL/etc.), allow-unsafe-pr-checkout on several callable builds, Dependabot CodeQL grouping, govulncheck ignore list for containerd CRI findings, removal of packer-check from the root Makefile/lint job, and doc/README edits de-emphasizing CSI wrapper.

^{Reviewed by Cursor Bugbot for commit 335edee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 5 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}

[cursor]

Azure e2e omits CAA image

High Severity

azure.properties never sets CAA_IMAGE, but the Azure provisioner only reads that image from the properties map. The job-level env var is ignored, so e2e deploys the default chart image instead of the CI-built adaptor and does not test the code under test.

 

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}

[cursor]

Azure image built from wrong ref

Medium Severity

podvm_mkosi_azure passes git_ref: ${{ github.sha }} instead of inputs.git_ref, unlike every other image job. A workflow_dispatch with a custom ref builds the Azure podvm from the caller SHA, so Azure e2e can run against the wrong commit.

 

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}

[cursor]

Azure image job always runs

Medium Severity

podvm_mkosi_azure has no if guard, while the Azure e2e job only runs on schedule or workflow_dispatch. Labeled PR e2e therefore always builds an unused Azure mkosi image, wasting a long runner and publishing a ci-pr* tag that is never consumed.

 

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}

[cursor]

Alibaba credentials expire mid-test

Medium Severity

The Alibaba OIDC session is set to 3600 seconds while TEST_E2E_TIMEOUT is 90m, and cluster setup runs before tests. Credentials can expire before teardown, leaving cloud resources behind even though TEST_TEARDOWN is enabled.

Additional Locations (1)

• .github/workflows/e2e_alibabacloud.yaml#L206-L208

 

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}

[cursor]

Dependabot targets removed module

Low Severity

Dependabot still lists src/csi-wrapper after that module was removed from the tree and from CI, docs, and lint. Update checks for that directory will fail or be skipped on every Dependabot run.

 

^{Reviewed by Cursor Bugbot for commit 335edee. Configure here.}