fix(main): always resolve SUSFS at latest and drop SUSFS pins

SUSFS is now always resolved at latest (all 7 branch tips) so it stays
API-matched to the always-latest KernelSU-Next tree, preventing mismatches
like undeclared susfs_is_current_proc_no_su. Remove the now-unused
PIN_SUSFS table, the SUSFS entries from the update-promotion script, and
the SUSFS env/gates in the update job. NoMount/KernelSU/ReSukiSU pins and
SUSFS_commit outputs consumed downstream are unchanged.

.github/scripts/update_verified_pins.py

@@ -22,13 +22,8 @@ PINS = [
     ("PIN_NOMOUNT", "NOMOUNT_SHA", "APPROVE_NOMOUNT"),
     ("PIN_KERNELSU", "KERNELSU_SHA", "APPROVE_KERNELSU"),
     ("PIN_RESUKISU", "RESUKISU_SHA", "APPROVE_RESUKISU"),
-    ("PIN_SUSFS[susfs_commit_android12_5_10]", "SUSFS_ANDROID12_5_10_SHA", "APPROVE_SUSFS_ANDROID12_5_10"),
-    ("PIN_SUSFS[susfs_commit_android13_5_10]", "SUSFS_ANDROID13_5_10_SHA", "APPROVE_SUSFS_ANDROID13_5_10"),
-    ("PIN_SUSFS[susfs_commit_android13_5_15]", "SUSFS_ANDROID13_5_15_SHA", "APPROVE_SUSFS_ANDROID13_5_15"),
-    ("PIN_SUSFS[susfs_commit_android14_5_15]", "SUSFS_ANDROID14_5_15_SHA", "APPROVE_SUSFS_ANDROID14_5_15"),
-    ("PIN_SUSFS[susfs_commit_android14_6_1]", "SUSFS_ANDROID14_6_1_SHA", "APPROVE_SUSFS_ANDROID14_6_1"),
-    ("PIN_SUSFS[susfs_commit_android15_6_6]", "SUSFS_ANDROID15_6_6_SHA", "APPROVE_SUSFS_ANDROID15_6_6"),
-    ("PIN_SUSFS[susfs_commit_android16_6_12]", "SUSFS_ANDROID16_6_12_SHA", "APPROVE_SUSFS_ANDROID16_6_12"),
+    # SUSFS is intentionally excluded: it is always resolved at latest so it
+    # stays API-matched to the always-latest KernelSU-Next tree.
 ]
 
 SHA_RE = re.compile(r"^[0-9a-f]{40}$")
@@ -44,14 +39,8 @@ def read_pins():
         text = fh.read()
     pins = {}
     for var, _, _ in PINS:
-        if var.startswith("PIN_SUSFS["):
-            key = var[len("PIN_SUSFS["):-1]
-            # match:  [susfs_commit_android12_5_10]="<sha>"
-            m = re.search(r"\[%s\]=\"([0-9a-f]{40})\"" % re.escape(key), text)
-            pins[key] = m.group(1) if m else None
-        else:
-            m = re.search(r"%s=\"([0-9a-f]{40})\"" % re.escape(var), text)
-            pins[var] = m.group(1) if m else None
+        m = re.search(r"%s=\"([0-9a-f]{40})\"" % re.escape(var), text)
+        pins[var] = m.group(1) if m else None
     return pins
 
 
@@ -66,13 +55,12 @@ def build_changes():
         if not approved(approve_env):
             print(f"  skip {var}: not approved to promote (disabled or a build failed)", file=sys.stderr)
             continue
-        key = var[len("PIN_SUSFS["):-1] if var.startswith("PIN_SUSFS[") else var
-        old_sha = read_pins().get(key)
+        old_sha = read_pins().get(var)
         if old_sha == new_sha:
-            print(f"  unchanged {key} ({new_sha[:8]})")
+            print(f"  unchanged {var} ({new_sha[:8]})")
             continue
-        promoted[key] = new_sha
-        changes.append((key, old_sha, new_sha))
+        promoted[var] = new_sha
+        changes.append((var, old_sha, new_sha))
     return changes, promoted
 
 
@@ -98,10 +86,8 @@ def apply_pins(promoted):
     with open(MAIN, "r", encoding="utf-8") as fh:
         text = fh.read()
     for key, sha in promoted.items():
-        pattern = re.compile(r"\[%s\]=\"([0-9a-f]{40})\"" % re.escape(key) if not key.startswith("PIN_")
-                            else r"%s=\"([0-9a-f]{40})\"" % re.escape(key))
-        text, n = pattern.subn(lambda m: (f"[{key}]=\"{sha}\"" if not key.startswith("PIN_")
-                                          else f"{key}=\"{sha}\""), text, count=1)
+        pattern = re.compile(r"%s=\"([0-9a-f]{40})\"" % re.escape(key))
+        text, n = pattern.subn(lambda m: f"{key}=\"{sha}\"", text, count=1)
         if n == 0:
             print(f"  ERROR: could not locate pin for {key}", file=sys.stderr)
             return False

.github/workflows/main.yml

@@ -191,18 +191,11 @@ jobs:
           }
 
           # Audited pins (from root-variants.yml). Used only when commit_mode=verified.
+          # SUSFS is intentionally NOT pinned here: it is always resolved at latest
+          # so it stays API-matched to the always-latest KernelSU-Next tree.
           PIN_NOMOUNT="c52936b229c25a4b0e41b6627f7d3bc5eaaaf2b5"
           PIN_KERNELSU="da9abf498a77d438989fea0f5f4e348b9a540c07"
           PIN_RESUKISU="3ef06b0fcb0960dc9563256fe26a58e892663387"
-          declare -A PIN_SUSFS=(
-            [susfs_commit_android12_5_10]="3c14ad549f826b1f53878ec8c12253efebeed75a"
-            [susfs_commit_android13_5_10]="f81aaf10e9560282052bb61dd931315c2ca3e617"
-            [susfs_commit_android13_5_15]="ccb1918684b27644d17a6c842f57b60ae5966025"
-            [susfs_commit_android14_5_15]="0463ac089308014e8c22cc6a4558e0d6d2a53e08"
-            [susfs_commit_android14_6_1]="e287d59066380bf6de4396532d4a42edf4408701"
-            [susfs_commit_android15_6_6]="be7b7ef49a1e1b189c3abf00eacaa7ebdb4168c1"
-            [susfs_commit_android16_6_12]="f37930f374ef88de990d6abea0c67d0ea28c1edc"
-          )
 
           pick() { # pinned repo ref  -> pinned when verified, else latest
             local pinned="$1" repo="$2" ref="$3"
@@ -272,11 +265,9 @@ jobs:
           esac
           echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"
 
-          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu)
-          # For KernelSU-Next builds (root_flavor 'KernelSU-Next' or 'All'), always
-          # resolve SUSFS at latest so it stays API-matched to the always-latest
-          # KernelSU-Next tree. Pinned SUSFS only for pure KernelSU/ReSukiSU builds.
-          include_next="${{ inputs.root_flavor == 'KernelSU-Next' || inputs.root_flavor == 'All' }}"
+          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu).
+          # Always resolve SUSFS at latest so it stays API-matched to the
+          # always-latest KernelSU-Next tree.
           declare -A SUSFS_BRANCHES=(
             [susfs_commit_android12_5_10]="gki-android12-5.10"
             [susfs_commit_android13_5_10]="gki-android13-5.10"
@@ -287,11 +278,7 @@ jobs:
             [susfs_commit_android16_6_12]="gki-android16-6.12"
           )
           for key in "${!SUSFS_BRANCHES[@]}"; do
-            if [ "$include_next" = "true" ]; then
-              emit "$key" "$(resolve_sha https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
-            else
-              emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
-            fi
+            emit "$key" "$(resolve_sha https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
           done
 
           # Tracked build helpers (resolved automatically, before the run)
@@ -814,23 +801,9 @@ jobs:
         NOMOUNT_SHA: ${{ needs.resolve-sources.outputs.nomount_commit }}
         KERNELSU_SHA: ${{ needs.resolve-sources.outputs.ksu_commit }}
         RESUKISU_SHA: ${{ needs.resolve-sources.outputs.resukisu_commit }}
-        SUSFS_ANDROID12_5_10_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
-        SUSFS_ANDROID13_5_10_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
-        SUSFS_ANDROID13_5_15_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
-        SUSFS_ANDROID14_5_15_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
-        SUSFS_ANDROID14_6_1_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
-        SUSFS_ANDROID15_6_6_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
-        SUSFS_ANDROID16_6_12_SHA: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
         APPROVE_NOMOUNT: ${{ inputs.use_nomount }}
         APPROVE_KERNELSU: ${{ (inputs.root_flavor == 'KernelSU' || inputs.root_flavor == 'All') }}
         APPROVE_RESUKISU: ${{ (inputs.root_flavor == 'ReSukiSU' || inputs.root_flavor == 'All') }}
-        APPROVE_SUSFS_ANDROID12_5_10: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android12-5.10') }}
-        APPROVE_SUSFS_ANDROID13_5_10: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.10') }}
-        APPROVE_SUSFS_ANDROID13_5_15: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.15') }}
-        APPROVE_SUSFS_ANDROID14_5_15: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-5.15') }}
-        APPROVE_SUSFS_ANDROID14_6_1: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-6.1') }}
-        APPROVE_SUSFS_ANDROID15_6_6: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android15-6.6') }}
-        APPROVE_SUSFS_ANDROID16_6_12: ${{ inputs.use_susfs && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android16-6.12') }}
 
     - name: Commit promoted pins
       if: ${{ always() && steps.promote.conclusion == 'success' }}