Boot NetBSD on QEMU's microvm machine type, and report where setup time goes

.github/workflows/ci.yml

@@ -375,6 +375,94 @@ jobs:
           hostname: ${{ matrix.hostname }}
           work_directory: ${{ matrix.host.work_directory }}
 
+  # A custom image predates the bundle and the credential-less login, so this
+  # boots the last release that shipped qcow2 -- the format and the SSH key
+  # expectations a user's own image is most likely to have been built from.
+  test-custom-netbsd-image:
+    timeout-minutes: 5
+    name: Test a custom NetBSD image from before the bundle
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Start VM
+        uses: ./
+        with:
+          operating_system: netbsd
+          architecture: x86-64
+          version: '11.0'
+          image_url: https://github.com/cross-platform-actions/netbsd-builder/releases/download/v0.7.0/netbsd-11.0-x86-64.qcow2
+
+      - name: Test
+        shell: cpa.sh {0}
+        run: uname -a
+
+  test-microvm-variant:
+    timeout-minutes: 5
+    name: Test the microvm variant
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Start VM
+        uses: ./
+        with:
+          operating_system: netbsd
+          architecture: x86-64
+          version: '11.0'
+          variant: microvm
+
+      # That the VM booted says nothing about which way it booted, and a
+      # silent fall back to the firmware is the failure worth catching. The
+      # MICROVM kernel is only reachable on this path, so its name is enough;
+      # which devices it attaches is QEMU's and NetBSD's business, and is
+      # asserted against the command we build in the unit tests instead.
+      - name: Test
+        shell: cpa.sh {0}
+        run: |
+          set -ex
+          uname -v | grep -q MICROVM
+
+  test-microvm-variant-unsupported:
+    timeout-minutes: 5
+    name: Test the microvm variant on an image without a kernel
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      # NetBSD gained a MICROVM kernel configuration in 11.0, so 10.1's bundle
+      # carries no kernel. Asking for the variant anyway has to fail, rather
+      # than quietly boot through the firmware.
+      - name: Start VM
+        id: start-vm
+        continue-on-error: true
+        uses: ./
+        with:
+          operating_system: netbsd
+          architecture: x86-64
+          version: '10.1'
+          variant: microvm
+
+      - name: Verify the action failed
+        shell: bash
+        run: |
+          [ '${{ steps.start-vm.outcome }}' = 'failure' ] || {
+            echo '::error::expected the action to reject the microvm variant'
+            exit 1
+          }
+
   test-no-env:
     timeout-minutes: 5
     name: Test without environment variables

action.yml

@@ -40,6 +40,14 @@ inputs:
   cpu_count:
     required: false
     description: The number of CPU cores for the virtual machine
+  variant:
+    required: false
+    description: |
+      Which variant of the operating system to run. A variant is a named
+      configuration of the platform, not a set of independent options. Valid
+      values are `default` and, where the platform supports it, `microvm`.
+      Asking for a variant a platform doesn't have is an error.
+    default: default
   image_url:
     required: false
     description: URL for running the action with a custom image.

changelog.md

@@ -4,7 +4,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+
 ## [Unreleased]
+### Changed
+- NetBSD images download around 45% smaller -- 11.0 x86-64 goes from 497 MiB to
+    268 MiB -- which is most of what a NetBSD job spends on setup
+    ([#151](https://github.com/cross-platform-actions/action/issues/151))
+- Every guest becomes usable sooner, by up to 8 seconds, because the action no
+    longer waits on a readiness probe it sent before the guest was listening
+- NetBSD guests are logged into without a credential, so no SSH key is generated
+    and no resources disk is built to carry one. A custom image supplied through
+    `image_url` still gets both, since it may expect them
+
+### Added
+- A `variant` input, selecting a named configuration of a platform. Defaults to
+    `default`, which boots exactly as before, so no existing workflow changes.
+    See [Variants](readme.md#variants-variant)
+- The `microvm` variant for NetBSD on `x86-64`, which reaches a usable guest in
+    roughly half the time. It is opt-in because it changes the hardware the guest
+    sees: the root disk becomes `ld0` rather than `sd0`, there is no PCI bus to
+    inspect, and `uname -v` reports a `MICROVM` kernel. Asking for it where it
+    cannot be booted is an error, not a slow boot
+- Log a breakdown of how long each phase of setting up the VM took, together
+    with how long the VM took to become reachable over SSH
+
+### Security
+- The guest's SSH port is only forwarded to the runner's loopback address. It was
+    previously bound to every interface, making the guest reachable from anything
+    that could reach the runner
 
 ## [1.4.0] - 2026-08-10
 ### Added