build(deps): bump cross-platform-actions/action from 1.4.0 to 1.5.0

[dependabot]

Bumps cross-platform-actions/action from 1.4.0 to 1.5.0.

Release notes

Sourced from cross-platform-actions/action's releases.

Cross Platform Action 1.5.0

Changed

• NetBSD images download around 45% smaller -- 11.0 x86-64 goes from 497 MiB to 268 MiB -- which is most of what a NetBSD job spends on setup (#151)
• Every guest becomes usable sooner, by up to 8 seconds, because the action no longer waits on a readiness probe it sent before the guest was listening
• NetBSD guests are logged into without a credential, so no SSH key is generated and no resources disk is built to carry one. A custom image supplied through image_url still gets both, since it may expect them

Added

• Add support for Haiku R1/beta6 (#165)
• A variant input, selecting a named configuration of a platform. Defaults to default, which boots exactly as before, so no existing workflow changes. See Variants
• The microvm variant for NetBSD on x86-64, which reaches a usable guest in roughly half the time. It is opt-in because it changes the hardware the guest sees: the root disk becomes ld0 rather than sd0, there is no PCI bus to inspect, and uname -v reports a MICROVM kernel. Asking for it where it cannot be booted is an error, not a slow boot
• Log a breakdown of how long each phase of setting up the VM took, together with how long the VM took to become reachable over SSH

Fixed

• 5-level paging (LA57) is no longer exposed to the guests on x86-64 (#158). FreeBSD 13.0 enables 5-level paging whenever the CPU reports it and panics in the trampoline that switches to it, so every job that landed on an Intel runner from Ice Lake onwards failed to boot
• STIBP always-on mode is no longer exposed to the guests on x86-64 (#158). Some of the AMD runners report it without the STIBP and IBRS bits that normally come with it, which made DragonFly BSD write IA32_SPEC_CTRL and take a general protection fault while booting

Security

• The guest's SSH port is only forwarded to the runner's loopback address. It was previously bound to every interface, making the guest reachable from anything that could reach the runner

Changelog

Sourced from cross-platform-actions/action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.5.0] - 2026-08-28

Changed

• NetBSD images download around 45% smaller -- 11.0 x86-64 goes from 497 MiB to 268 MiB -- which is most of what a NetBSD job spends on setup (#151)
• Every guest becomes usable sooner, by up to 8 seconds, because the action no longer waits on a readiness probe it sent before the guest was listening
• NetBSD guests are logged into without a credential, so no SSH key is generated and no resources disk is built to carry one. A custom image supplied through image_url still gets both, since it may expect them

Added

• Add support for Haiku R1/beta6 (#165)
• A variant input, selecting a named configuration of a platform. Defaults to default, which boots exactly as before, so no existing workflow changes. See Variants
• The microvm variant for NetBSD on x86-64, which reaches a usable guest in roughly half the time. It is opt-in because it changes the hardware the guest sees: the root disk becomes ld0 rather than sd0, there is no PCI bus to inspect, and uname -v reports a MICROVM kernel. Asking for it where it cannot be booted is an error, not a slow boot
• Log a breakdown of how long each phase of setting up the VM took, together with how long the VM took to become reachable over SSH

Fixed

• 5-level paging (LA57) is no longer exposed to the guests on x86-64 (#158). FreeBSD 13.0 enables 5-level paging whenever the CPU reports it and panics in the trampoline that switches to it, so every job that landed on an Intel runner from Ice Lake onwards failed to boot
• STIBP always-on mode is no longer exposed to the guests on x86-64 (#158). Some of the AMD runners report it without the STIBP and IBRS bits that normally come with it, which made DragonFly BSD write IA32_SPEC_CTRL and take a general protection fault while booting

Security

• The guest's SSH port is only forwarded to the runner's loopback address. It was previously bound to every interface, making the guest reachable from anything that could reach the runner

... (truncated)

Commits

• faa0c61 Release 1.5.0
• b77f084 Add support for Haiku R1/beta6
• 0633e66 Don't expose 5-level paging or STIBP always-on mode to the guests
• 1f9f9c4 Merge pull request #162 from cross-platform-actions/claude/netbsd-11-microvm-...
• e631103 Point NetBSD at the release that publishes bundles
• 3a86b11 Tell the microvm guest its TSC is invariant
• 21a2790 Bump the bundled QEMU resources to v2.0.0
• 591c34e Download NetBSD images as a bundle and boot the kernel directly
• 7668283 Add a variant input for picking a configuration of a platform
• 2e33c21 Bound a readiness probe well below the command timeout
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)