Optional key suffix for the cache-after-prepare cache

New input cache-after-prepare-key-suffix: an optional value that is
appended as-is to the cache key of the image cached after prepare.
Changing it discards that cache and runs prepare again, without
editing prepare itself. Requested in
#167

Usage

  - uses: actions/checkout@v7
  - uses: vmactions/freebsd-vm@v1
    with:
      cache-after-prepare: true
      cache-after-prepare-key-suffix: deps-${{ hashFiles('deps.sh') }}
      prepare: |
        sh deps.sh

• The input is optional and empty by default. Left out, every cache
  key stays the same as in v1.5.8, so existing caches stay valid.
• The prepare script and the sync method are still part of the key;
  the suffix is only added at the end.
• hashFiles() is evaluated on the runner, relative to the workspace,
  so check out first. It returns an empty string when no file
  matches, and the key then no longer follows the file.

Pins

BUILDER_VERSION 2.2.8 (unchanged)
ANYVM_VERSION 0.7.2 (unchanged)

FreeBSD on ubuntu-26.04 runners

The action's test matrix, 10.4, 11.4 and 13.2 - 15.1 across x86_64,
aarch64, riscv64 and powerpc64, now runs on ubuntu-26.04 and
ubuntu-26.04-arm: 313 of 314 jobs pass, and the 9p job is skipped as
before. 12.4, which the matrix leaves out, passes anyvm's own FreeBSD CI
on the same runners.

What failed on 26.04

With v1.5.7 on a 26.04 runner:

• Every aarch64 job, on both runner types, timed out in the firmware.
  The serial log holds only the banner of 26.04's edk2 2025.11, which
  hangs under -cpu max:
  tianocore/edk2#11962

• Every riscv64 job stopped at

  Error: QEMU binary 'qemu-system-riscv64' not found (searched PATH
  and common install locations).

  Since Ubuntu 25.10 the riscv64 emulator ships in a separate
  qemu-system-riscv package, no longer in qemu-system-misc.

• With the emulator installed, 13.2, 13.3, 13.5, 14.0, 14.1, 14.2 and
  14.3 riscv64 still hung after the last PCI device attached, before
  "Timecounters tick", on QEMU 10.2.1.

x86_64 and powerpc64 were not affected.

Fixes

• anyvm 0.7.2 reads the build stamp of the host's aarch64 UEFI image
  and, for 2025.08 and later, boots with Ubuntu 24.04's edk2 2024.02
  build instead, downloaded once and checked against a pinned sha256.
• anyvm 0.7.2 runs 13.2 - 14.3 riscv64 with -cpu rv64,sstc=off on
  QEMU 10.1 and later; 14.4, 14.5 and 15.x keep Sstc.
• The action installs qemu-system-riscv instead of qemu-system-misc
  for riscv64 on Ubuntu releases newer than 24.04.

Each fix engages only on a newer firmware, QEMU or Ubuntu release than
24.04 ships, so jobs on ubuntu-24.04 run as before. Details:
https://github.com/anyvm-org/anyvm/releases/tag/v0.7.2

Pins

BUILDER_VERSION 2.2.8 (unchanged)
ANYVM_VERSION 0.7.1 -> 0.7.2

FreeBSD 10.4 and 11.4, and a fix for "Unsupported OS: freebsd"

New releases

FreeBSD 10.4 and 11.4 on x86_64, from image builder 2.2.8. The action
now offers 15 releases; the default is still 15.1.

• uses: vmactions/freebsd-vm@v1
  with:
  release: "10.4"

The leading-part form works too: release: "10" and release: "11" pick
the newest matching release, so the action now ships 10, 11, 12, 13, 14
and 15.

pkg.FreeBSD.org dropped its FreeBSD 10, 11 and 12 repositories long
ago, so these images take their packages from the preserved SGGS
mirror (https://mirror.sg.gs/freebsd-pkg/), which keeps FreeBSD's
original repository signatures; pkg verifies them against the
fingerprint shipped in the base system. Two things the VM runtime had
to learn to run them: 10.x and 11.x boot via SeaBIOS, since their
images have no EFI system partition, and 10.4 runs on QEMU's qemu64
CPU model, because FreeBSD 10's signal delivery panics when -cpu host
exposes modern XSAVE features.

12.4 x86_64 gains rsync and sshfs

The same mirror reaches 12.4 x86_64: the image now ships rsync and
fusefs-sshfs, so all five sync methods work there instead of nfs, scp
and tar only. 12.4 aarch64 stays base-only; no aarch64 packages exist
for FreeBSD 12.

Fixed: a lost network probe no longer fails as "Unsupported OS"

#163: a job with release: '14.0' failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository
anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release
download URL sent the run down the GitHub REST API. The action never
passed a token, so that request was unauthenticated and shared the
60/hour per-IP limit with every other job on the runner IP; the 403
was retried for three minutes and then reported as an unsupported OS.
Two changes close this:

• New input: token. It defaults to github.token and is handed to the
  VM runtime, so the release lookup is authenticated (1000 requests
  per hour per repository instead of 60 shared). Nothing to change
  in your workflow; set it only if you want a different token.
• anyvm 0.7.1: the release-URL probe retries transient failures and
  only a 404 means the image is absent; a rate-limited 403 or a 429
  stops the retry loop at once and reports the reset time; "the API
  could not be asked" and "this repository does not exist" are
  distinct outcomes, so a connectivity failure is reported as one;
  and the Authorization header no longer follows a cross-host
  redirect.

Pins

BUILDER_VERSION 2.2.7 -> 2.2.8
ANYVM_VERSION 0.6.9 -> 0.7.1

FreeBSD 14.5, and riscv64 can install packages

New releases

FreeBSD 14.5 on x86_64, aarch64, riscv64 and powerpc64. The action now
offers 13 releases; the default is still 15.1.

riscv64 gains rsync and sshfs

pkg.FreeBSD.org publishes no riscv64 packages at all, so the riscv64
images used to ship without rsync or fusefs-sshfs and only nfs, scp and
tar worked there. Image builder 2.2.7 configures the 15.0 and 15.1
riscv64 images for anyvm-org/freebsd-pkg-repo, a signed build of the
ports tree for FreeBSD:15:riscv64, so those two releases now support
all five sync methods:

sync: rsync (the default)
sync: sshfs
sync: nfs
sync: scp
sync: tar

pkg install also works inside the VM on those images. 13.x and 14.x
riscv64 are unchanged and stay on nfs, scp and tar.

Pins

BUILDER_VERSION 2.2.6 -> 2.2.7
ANYVM_VERSION 0.6.5 -> 0.6.9

Fixes from base-vm

• The osname input defaults to lowercase "freebsd".
• rsync keeps its timestamps on this action; the -t workaround added
  for AlmaLinux/Rocky ppc64le does not apply here.
• scp-mode copyback picks the right archive tool per guest.

The runtime moves to anyvm v0.6.5 (from v0.6.4), keeping the whole fleet
on one version. This action's surface is unchanged -- same images, same
sync methods, same defaults. The bump carries one runtime change of
note: on hosts whose nested AMD virtualization corrupts AVX512 XSAVE
state, the CPU-feature mask now drops the whole AVX512 family instead of
only avx512f.

Full Changelog: v1.5.4...v1.5.5

sync: tar

A fourth way to share the workspace, available on every architecture
including riscv64 and powerpc64, where rsync and sshfs do not exist:

The workspace is streamed in as a ustar archive over the ssh connection the
action already opens, and streamed back the same way when the run finishes.
Nothing is installed in the guest and no filesystem support is needed on
either side, unlike sshfs and nfs. Verified before shipping: 300 files plus
a 1 MB binary blob pushed into a 15.1 guest, a file written inside it, the
whole tree pulled back and compared by content hash.

rsync remains the default. Reach for tar when the guest lacks rsync, or when
a mount-based method is more machinery than the job needs.

Under the hood

The image builder moves to freebsd-builder v2.2.6 and the runtime to anyvm
v0.6.4, nine releases on from what v1.5.3 shipped. Most of that is other
guests, but two fixes reach every action:

A failed folder sync used to be a warning. The run continued with the guest
missing the files it was about to use, which surfaced much later as a
confusing error or a job that sat until its timeout. It is now fatal, and
says so.

The workspace push no longer carries the runner's own harness directories
into the guest.

Also

The shell note no longer mentions usesh, which has not been needed for
some time.

Full Changelog: v1.5.3...v1.5.4

support major release:

release: 15

release: 14

release: 13

release: 12

reduce image sizes.

Full Changelog: v1...v1.5.2

The prepare step (installing packages etc.) normally runs on every build. With cache-after-prepare: true, the action shuts the VM down cleanly after prepare has finished, caches the prepared VM image, and boots the VM again before run. Later runs with the same prepare script restore the prepared image, skip prepare entirely, and start directly at run

https://github.com/vmactions/freebsd-vm#10-cache-the-vm-image-after-prepare

Full Changelog: v1...v1.5.1

1. Support all the versions from 12.4 to lastest 15.1
2. Support all the archs: x86, aarch64, riscv64 and powerpc64

Full Changelog: v1...v1.5.0