chore(deps): update vmactions/openbsd-vm action to v1.4.8

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
vmactions/openbsd-vm	action	patch	v1.4.7 → v1.4.8

---

Release Notes

vmactions/openbsd-vm (vmactions/openbsd-vm)

v1.4.8

Compare Source

OpenBSD on ubuntu-26.04 runners

The action's test matrix now runs on ubuntu-26.04 and ubuntu-26.04-arm:
113 of 114 jobs pass, and the 9p job is skipped as before.

What failed on 26.04

With v1.4.7 on a 26.04 runner:

• Every riscv64 job stopped at

  Error: QEMU binary 'qemu-system-riscv64' not found (searched PATH
  and common install locations).

  Since Ubuntu 25.10 the riscv64 emulator ships in a separate
  qemu-system-riscv package, no longer in qemu-system-misc.

x86_64, aarch64 and sparc64 were not affected.

Fixes

• The action installs qemu-system-riscv instead of qemu-system-misc
  for riscv64 on Ubuntu releases newer than 24.04.

The package fix engages only on Ubuntu releases newer than 24.04, so
jobs on ubuntu-24.04 run as before. The rest of anyvm 0.7.2's 26.04
work:
https://github.com/anyvm-org/anyvm/releases/tag/v0.7.2

Fixed: a lost network probe no longer fails as "Unsupported OS"

vmactions/freebsd-vm#163: a job failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository
anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release download
URL sent the run down the GitHub REST API. The action never passed a
token, so that request was unauthenticated and shared the 60/hour per-IP
limit with every other job on the runner IP; the 403 was retried for
three minutes and then reported as an unsupported OS. This action took
the same path. Two changes close it:

• New input: token. It defaults to github.token and is handed to the
  VM runtime, so the release lookup is authenticated (1000 requests
  per hour per repository instead of 60 shared). Nothing to change in
  your workflow; set it only if you want a different token.
• anyvm 0.7.1: the release-URL probe retries transient failures and
  only a 404 means the image is absent; a rate-limited 403 or a 429
  stops the retry loop at once and reports the reset time; "the API
  could not be asked" and "this repository does not exist" are
  distinct outcomes, so a connectivity failure is reported as one; and
  the Authorization header no longer follows a cross-host redirect.

Also

• anyvm 0.6.8: image downloads survive a CDN outage. Retries now back
  off over about a minute instead of five tries two seconds apart,
  which a half-minute GitHub 504 burst on 2026-08-31 outlasted. A 404
  still stops at once.
• anyvm 0.6.8: a guest key that failed to download now fails the run
  at once, instead of booting a VM nobody can log in to and timing out
  thirteen minutes later.
• anyvm 0.6.8: QEMU no longer prints a driftfix warning on every
  launch of an aarch64, riscv64 or sparc64 guest.

Pins

BUILDER_VERSION 0.9.9, 1.1.2, 1.1.4 and 2.1.0 by release (unchanged)
ANYVM_VERSION 0.6.5 -> 0.7.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.