CI: Bump the github-actions group with 5 updates

[dependabot]

Bumps the github-actions group with 5 updates:

Package	From	To
cross-platform-actions/action	1.5.0	1.6.0
github/codeql-action/init	4.37.9	4.38.0
github/codeql-action/analyze	4.37.9	4.38.0
vmactions/solaris-vm	1.3.9	1.4.0
signpath/github-action-submit-signing-request	2.3	3.0

Updates cross-platform-actions/action from 1.5.0 to 1.6.0

Release notes

Sourced from cross-platform-actions/action's releases.

Cross Platform Action 1.6.0

Added

• Add support for FreeBSD 14.5 (#168)
• Add support for NetBSD 9.5

Fixed

• DragonFly BSD guests no longer occasionally start a job without working connectivity (#164). The image configured its interface with dhclient, which daemonizes before the DHCP exchange finishes, so the boot never waited for the network and the first step could run while the guest still had no route off its own subnet. The image now configures the interface statically, from the lease user mode networking hands out identically on every boot

Changelog

Sourced from cross-platform-actions/action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[Unreleased]

[1.6.0] - 2026-09-12

Added

• Add support for FreeBSD 14.5 (#168)
• Add support for NetBSD 9.5

Fixed

• DragonFly BSD guests no longer occasionally start a job without working connectivity (#164). The image configured its interface with dhclient, which daemonizes before the DHCP exchange finishes, so the boot never waited for the network and the first step could run while the guest still had no route off its own subnet. The image now configures the interface statically, from the lease user mode networking hands out identically on every boot

[1.5.0] - 2026-08-28

Changed

• NetBSD images download around 45% smaller -- 11.0 x86-64 goes from 497 MiB to 268 MiB -- which is most of what a NetBSD job spends on setup (#151)
• Every guest becomes usable sooner, by up to 8 seconds, because the action no longer waits on a readiness probe it sent before the guest was listening
• NetBSD guests are logged into without a credential, so no SSH key is generated and no resources disk is built to carry one. A custom image supplied through image_url still gets both, since it may expect them

Added

• Add support for Haiku R1/beta6 (#165)
• A variant input, selecting a named configuration of a platform. Defaults to default, which boots exactly as before, so no existing workflow changes. See Variants
• The microvm variant for NetBSD on x86-64, which reaches a usable guest in roughly half the time. It is opt-in because it changes the hardware the guest sees: the root disk becomes ld0 rather than sd0, there is no PCI bus to inspect, and uname -v reports a MICROVM kernel. Asking for it where it cannot be booted is an error, not a slow boot
• Log a breakdown of how long each phase of setting up the VM took, together with how long the VM took to become reachable over SSH

Fixed

• 5-level paging (LA57) is no longer exposed to the guests on x86-64

... (truncated)

Commits

• e0b9770 Release 1.6.0
• 5337ef5 Add missing CI matrix entries for FreeBSD 13.5 and 14.4
• 7226d12 Add support for FreeBSD 14.5
• 6362c50 Add support for NetBSD 9.5
• 25da832 Update the DragonFly BSD image to v0.0.2
• See full diff in compare view

Updates github/codeql-action/init from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/init's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/init's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates github/codeql-action/analyze from 4.37.9 to 4.38.0

Release notes

Sourced from github/codeql-action/analyze's releases.

v4.38.0

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

Changelog

Sourced from github/codeql-action/analyze's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

4.38.1 - 18 Sept 2026

• The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. #4146

4.38.0 - 09 Sept 2026

• On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. #4124
• The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native linux-arm64 CodeQL bundle when available. #4072
• Update default CodeQL bundle version to 2.27.0. #4129

4.37.9 - 26 Aug 2026

• Update default CodeQL bundle version to 2.26.4. #4106

4.37.8 - 21 Aug 2026

No user facing changes.

4.37.7 - 13 Aug 2026

• Update default CodeQL bundle version to 2.26.3. #4085

4.37.6 - 04 Aug 2026

• Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to .github/codeql-config.yml to align it with the suggested path that is used elsewhere. #4070

4.37.5 - 03 Aug 2026

• Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the init Action instead of falling back to downloading the bundle before extracting it. #4061

4.37.4 - 29 Jul 2026

• This version of the CodeQL Action adds support for the tools input for the codeql-action/init step to be specified using a github-codeql-tools repository property. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to toolcache to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for tools in the workflow definition always takes precedence unless the value of the repository property starts with !. #4037
• Update default CodeQL bundle version to 2.26.2. #4051

4.37.3 - 22 Jul 2026

No user facing changes.

4.37.2 - 21 Jul 2026

• The new address format for the config-file input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the remote= prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. #4023

... (truncated)

Commits

• b96794f Merge pull request #4131 from github/update-v4.38.0-7e08580a9
• 02d5093 Update changelog for v4.38.0
• 7e08580 Merge pull request #4130 from github/henrymercer/workflow-runner-sizing
• bfcc52b Run slow macOS checks on larger runners
• 8c251e7 Merge pull request #4129 from github/update-bundle/codeql-bundle-v2.27.0
• 0b7ca40 Add changelog note
• 40484b3 Update default bundle to codeql-bundle-v2.27.0
• 977e6ce Merge pull request #4124 from github/henrymercer/toolcache-bundle-cleanup
• 40a6b38 Address toolcache cleanup review feedback
• deece8f Apply suggestion from @​henrymercer
• Additional commits viewable in compare view

Updates vmactions/solaris-vm from 1.3.9 to 1.4.0

Release notes

Sourced from vmactions/solaris-vm's releases.

v1.4.0

Boot with 2 GB of memory

A job with mem: 2048 could time out at "Starting VM" while the same job vmactions/solaris-vm#63 crashing: its console showed svc.startd: Couldn't fork ... Cannot allocate memory and /tmp: File system full, swap space limit exceeded, and sshd was killed before it ever listened. The cause was in the image, not the runner: svc:/application/man-index rebuilt the man page index with catman on every boot of the snapshot image, peaking at 564 MB for about 50 seconds, on top of a kernel that already takes close to 1 GB at 2 GB. Whether sshd came up first was a race, which is why the failure looked host-dependent.

solaris-builder v2.0.8 ships images with man-index and the other services a CI guest never uses disabled: sstore, the Solaris Web UI (five httpd), the hal/dbus/rmvolmgr removable-media stack, fault notification, the extra virtual terminals, smb, InfiniBand, FCoE, iSCSI, sendmail-client and the compliance guide generator. rad, fmd, auditd and the nfs/autofs pieces stay.

Measured on one host with mem: 2048 and the production CPU flags, ::memstat about a minute after boot:

image	boot-to-ssh	Kernel	User/Anon	Free	daemons RSS
v2.0.7 (as shipped)	timeout	-	-	-	587 MB
v2.0.7, man-index/webui off	26 s	1.45 GB	354 MB	13 MB	~480 MB
v2.0.8	33 s	1.31 GB	252 MB	203 MB	317 MB

The daemons RSS column is the summed resident size of every process after boot; the v2.0.7 figure was taken at 4 GB since that image never reached ssh at 2 GB. 2 GB now boots, but with about 200 MB to spare; give a real build 4 GB or more.

Under the hood

The runtime moves to anyvm v0.6.9 (from v0.6.5). Nothing in that range touches this guest's launch.

Full Changelog: vmactions/solaris-vm@v1.3.9...v1.4.0

Commits

• a11f407 Update vmactions/solaris-vm from base-vm
• 0ff57b2 Generated from base-vm
• 3c90528 Update version to v1.3.9
• 52b1df2 remove
• be40c6b Update vmactions/solaris-vm from base-vm
• 5dce673 Generated from base-vm
• 1add24f Bump versions from upstream releases
• 7a1e636 Update version to v1.3.9
• 0c0b01b Update vmactions/solaris-vm from base-vm
• bb43872 Generated from base-vm
• Additional commits viewable in compare view

Updates signpath/github-action-submit-signing-request from 2.3 to 3.0

Commits

• f6d0478 Build from - 7336bb524a08c99aa48ba5065b00095eb2b0e09e. Original commit messag...
• ef0ce19 Build from - 8ff04a5c1f8d21d18e1eb1fc41b698b425a83654. Original commit messag...
• a790881 Build from - 9c89d7e4aa8c240d6deba49c8e4f52910fd41288. Original commit messag...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions