.github: bump vmactions/dragonflybsd-vm from 1.3.3 to 1.3.4

[dependabot]

Bumps vmactions/dragonflybsd-vm from 1.3.3 to 1.3.4.

Release notes

Sourced from vmactions/dragonflybsd-vm's releases.

v1.3.4

DragonFly BSD on ubuntu-26.04 runners

The action is now tested on ubuntu-26.04 runners: its test matrix has moved there from 24.04, and 25 of 27 jobs pass; the 9p and sshfs jobs are skipped as before. The runtime moves to anyvm 0.7.2, the release that brings Ubuntu 26.04 host support: https://github.com/anyvm-org/anyvm/releases/tag/v0.7.2

Fixed: a lost network probe no longer fails as "Unsupported OS"

vmactions/freebsd-vm#163: a job failed after three minutes with

Error: Unsupported OS: freebsd. Builder repository anyvm-org/freebsd-builder not found.

although the image exists. A single failed probe of the release download URL sent the run down the GitHub REST API. The action never passed a token, so that request was unauthenticated and shared the 60/hour per-IP limit with every other job on the runner IP; the 403 was retried for three minutes and then reported as an unsupported OS. This action took the same path. Two changes close it:

• New input: token. It defaults to github.token and is handed to the VM runtime, so the release lookup is authenticated (1000 requests per hour per repository instead of 60 shared). Nothing to change in your workflow; set it only if you want a different token.
• anyvm 0.7.1: the release-URL probe retries transient failures and only a 404 means the image is absent; a rate-limited 403 or a 429 stops the retry loop at once and reports the reset time; "the API could not be asked" and "this repository does not exist" are distinct outcomes, so a connectivity failure is reported as one; and the Authorization header no longer follows a cross-host redirect.

Also

• anyvm 0.6.8: image downloads survive a CDN outage. Retries now back off over about a minute instead of five tries two seconds apart, which a half-minute GitHub 504 burst on 2026-08-31 outlasted. A 404 still stops at once.
• anyvm 0.6.8: a guest key that failed to download now fails the run at once, instead of booting a VM nobody can log in to and timing out thirteen minutes later.

Pins

BUILDER_VERSION 2.0.7 (unchanged)

... (truncated)

Commits

• 4ab776f Update vmactions/dragonflybsd-vm from base-vm
• a94bf10 Generated from base-vm
• 2fb6fa8 Bump versions from upstream releases
• 34162b0 Update vmactions/dragonflybsd-vm from base-vm
• 92f3cc8 Generated from base-vm
• 27f1629 Update vmactions/dragonflybsd-vm from base-vm
• 762439d Generated from base-vm
• 7299f22 Bump versions from upstream releases
• aa391b4 Update vmactions/dragonflybsd-vm from base-vm
• 088266d Generated from base-vm
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)