chore(deps): update vmactions/netbsd-vm action to v1.5.1

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
vmactions/netbsd-vm	action	patch	v1.5.0 → v1.5.1

---

Release Notes

vmactions/netbsd-vm (vmactions/netbsd-vm)

v1.5.1

Compare Source

NetBSD on ubuntu-26.04 runners, and packages on 9.5 again

The action's test matrix now runs on ubuntu-26.04 and ubuntu-26.04-arm:
220 of 221 jobs pass, and the 9p job is skipped as before.

What failed on 26.04

With v1.5.0 on a 26.04 runner:

• aarch64 jobs for 10.0 and 11.0, on both runner types, timed out in
  the firmware. The serial log holds only the banner of 26.04's edk2
  2025.11, which hangs under -cpu max:
  tianocore/edk2#11962

• 9.0 - 9.3 aarch64 got past the firmware and then hung, booting
  through ACPI on QEMU 10.2.1, right after the interrupt controller
  attached. The last console line was

  gicvthree0: ITS [#​1] Collections table @​ 0x49290000/0x10000, ...

• Every riscv64 job stopped at

  Error: QEMU binary 'qemu-system-riscv64' not found (searched PATH
  and common install locations).

  Since Ubuntu 25.10 the riscv64 emulator ships in a separate
  qemu-system-riscv package, no longer in qemu-system-misc.

9.4, 9.5 and 10.1 aarch64 were not affected, nor were x86_64, sparc64
and microvm.

Fixes

• anyvm 0.7.2 reads the build stamp of the host's aarch64 UEFI image
  and, for 2025.08 and later, boots with Ubuntu 24.04's edk2 2024.02
  build instead, downloaded once and checked against a pinned sha256.
• anyvm 0.7.2 boots 9.x aarch64 from the device tree (acpi=off). This
  one applies on every host, and 9.x boots that way on QEMU 8.2.2 as
  well.
• The action installs qemu-system-riscv instead of qemu-system-misc
  for riscv64 on Ubuntu releases newer than 24.04.

The firmware and package fixes engage only on a newer firmware or Ubuntu
release than 24.04 ships; acpi=off is the one change that also reaches
ubuntu-24.04. Details:
https://github.com/anyvm-org/anyvm/releases/tag/v0.7.2

Fixed: packages on 9.5

Between 2026-09-17 and 2026-09-25 cdn.NetBSD.org and ftp.NetBSD.org
dropped every 9.x package tree. It moved to archive.NetBSD.org, whose
package downloads answer HTTP 402 with a bot-check form. No mirror lists
a 9.5 alias or any 9.5 quarterly, so on 9.5 the action had always kept
the image's own PKG_PATH, and its only live entry was ftp.NetBSD.org's
9.0_2026Q1 tree. With that gone, v1.5.0 fails every 9.5 job that
installs a package, on x86_64 and aarch64 alike:

pkg_add: no pkg found for 'curl', sorry.

For a mirror that lists neither a quarterly nor an alias for the running
release, the action now takes the newest quarterly of the release's own
branch, .0_YYYYQn. Quarterlies are built only for a branch's .0
release, and the minor releases' aliases point into those trees. On 9.5
that is the 9.0_2026Q2 tree on ftp.fr.NetBSD.org and ftp.jaist.ac.jp,
plus ftp.allbsd.org's newest 9.0 quarterly when it answers (2026Q2 on
aarch64, 2025Q4 on x86_64). Of the releases this action tests, only 9.5
reaches this fallback; a mirror whose listed alias does not answer is
still dropped, as before.

Fixed: a lost network probe no longer fails as "Unsupported OS"

vmactions/freebsd-vm#163: a job failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository
anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release download
URL sent the run down the GitHub REST API. The action never passed a
token, so that request was unauthenticated and shared the 60/hour per-IP
limit with every other job on the runner IP; the 403 was retried for
three minutes and then reported as an unsupported OS. This action took
the same path. Two changes close it:

• New input: token. It defaults to github.token and is handed to the
  VM runtime, so the release lookup is authenticated (1000 requests
  per hour per repository instead of 60 shared). Nothing to change in
  your workflow; set it only if you want a different token.
• anyvm 0.7.1: the release-URL probe retries transient failures and
  only a 404 means the image is absent; a rate-limited 403 or a 429
  stops the retry loop at once and reports the reset time; "the API
  could not be asked" and "this repository does not exist" are
  distinct outcomes, so a connectivity failure is reported as one; and
  the Authorization header no longer follows a cross-host redirect.

Pins

BUILDER_VERSION 2.2.6 (unchanged)
ANYVM_VERSION 0.6.9 -> 0.7.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.