chore: remove ABI verification and root-variants (redundant with main)

- Delete root-variants.yml (single-target canary now covered by main matrix)
- Remove preserve_abi toggle from main/prepare/build and all wiring
- Remove Capture source + Verify final abi-kmi steps and Remove Protected Exports
- Delete .github/actions/abi-kmi-safeguards (no longer used)

.github/actions/abi-kmi-safeguards/action.yml

@@ -1,57 +0,0 @@
-name: Verify ABI/KMI safeguards
-description: Capture or verify hashes of source ABI/KMI protection files
-inputs:
-  mode:
-    description: 'capture or verify'
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Capture or verify protected files
-      shell: bash
-      run: |
-        set -euo pipefail
-
-        root="${{ github.workspace }}/kernel"
-        manifest="${{ github.workspace }}/.abi-kmi-safeguards.sha256"
-        snapshot="$(mktemp)"
-        while IFS= read -r -d '' path; do
-          sha256sum "$path"
-        done < <(
-          find "$root" -type f \( \
-            -path '*/android/abi_gki_*' -o \
-            -path '*/build/abi/*' -o \
-            -path '*/gki/*/abi.stg' -o \
-            -path '*/gki/*/symbols/*' -o \
-            -path '*/modules.bzl' -o \
-            -path '*/BUILD.bazel' \
-          \) -print0 | sort -z
-        ) > "$snapshot"
-
-        if [ ! -s "$snapshot" ]; then
-          echo "No ABI/KMI protection files were found; refusing an unguarded build." >&2
-          exit 1
-        fi
-
-        case "${{ inputs.mode }}" in
-          capture)
-            mv "$snapshot" "$manifest"
-            ;;
-          verify)
-            if [ ! -f "$manifest" ]; then
-              echo "ABI/KMI safeguard manifest is missing." >&2
-              exit 1
-            fi
-            if ! cmp -s "$manifest" "$snapshot"; then
-              echo "ABI/KMI protection files changed during integration." >&2
-              diff -u "$manifest" "$snapshot" >&2 || true
-              exit 1
-            fi
-            rm -f "$snapshot"
-            ;;
-          *)
-            echo "Unsupported safeguard mode: ${{ inputs.mode }}" >&2
-            exit 2
-            ;;
-        esac

.github/workflows/build.yml

@@ -63,10 +63,6 @@ on:
         required: false
         type: string
         default: Wild
-      preserve_abi:
-        required: false
-        type: boolean
-        default: false
       build_bypass:
         required: false
         type: boolean
@@ -125,12 +121,6 @@ jobs:
         kernel_version: ${{ inputs.kernel_version }}
         os_patch_level: ${{ inputs.os_patch_level }}
 
-    - name: Capture source ABI/KMI safeguards
-      if: ${{ inputs.preserve_abi }}
-      uses: ./.github/actions/abi-kmi-safeguards
-      with:
-        mode: capture
-
     - name: Set Build Timestamp from Kernel Commit
       shell: bash
       run: |
@@ -323,16 +313,6 @@ jobs:
         sublevel: ${{ steps.extract.outputs.sublevel }}
         brand_name: ${{ inputs.brand_name }}
 
-    - name: Remove Protected Exports
-      if: ${{ !inputs.preserve_abi }}
-      uses: ./.github/actions/remove-protected-exports
-
-    - name: Verify final ABI/KMI safeguards (pristine vs post-patch, before build)
-      if: ${{ inputs.preserve_abi }}
-      uses: ./.github/actions/abi-kmi-safeguards
-      with:
-        mode: verify
-
     - name: Clean Kernel Flags
       uses: ./.github/actions/clean-kernel-flags
 

.github/workflows/main.yml

@@ -95,10 +95,6 @@ on:
         description: "Performance"
         type: boolean
         default: false
-      preserve_abi:
-        description: "Preserve ABI/KMI (capture/verify; uncheck to strip protected exports)"
-        type: boolean
-        default: true
 
 jobs:
   prepare-ccache:
@@ -617,7 +613,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -646,7 +641,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -675,7 +669,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -704,7 +697,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -733,7 +725,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -762,7 +753,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 
@@ -791,7 +781,6 @@ jobs:
       anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
       droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       os_patch_level: ${{ inputs.os_patch_level }}
     secrets: inherit
 

.github/workflows/prepare.yml

@@ -56,11 +56,6 @@ on:
         required: false
         type: string
         default: Wild
-      preserve_abi:
-        description: "Keep ABI/KMI protection files intact and verify their hashes"
-        required: false
-        type: boolean
-        default: false
       build_bypass:
         description: "Produce the legacy bypass image"
         required: false
@@ -179,6 +174,5 @@ jobs:
       anykernel3_commit: ${{ inputs.anykernel3_commit }}
       droidspaces_commit: ${{ inputs.droidspaces_commit }}
       brand_name: ${{ inputs.brand_name }}
-      preserve_abi: ${{ inputs.preserve_abi }}
       build_bypass: ${{ inputs.build_bypass }}
     secrets: inherit

.github/workflows/root-variants.yml

@@ -1,130 +0,0 @@
-name: Build-verified only GKI root variants
-
-on:
-  workflow_dispatch:
-    inputs:
-      kernel_build_version:
-        description: "Supported GKI target"
-        required: true
-        type: choice
-        options:
-          - android12-5.10
-          - android13-5.10
-          - android13-5.15
-          - android14-5.15
-          - android14-6.1
-          - android15-6.6
-          - android16-6.12
-        default: android14-6.1
-      os_patch_level:
-        description: "Patch date (YYYY-MM), kernel sublevel, lts (builds the LTS branch), or all"
-        required: true
-        type: string
-        default: lts
-      commit_mode:
-        description: "verified = audited pinned SHAs, latest = branch tips at run time"
-        required: false
-        type: choice
-        options:
-          - verified
-          - latest
-        default: verified
-
-permissions:
-  contents: read
-  actions: write
-
-jobs:
-  resolve-pins:
-    runs-on: ubuntu-latest
-    outputs:
-      config_file: ${{ steps.pins.outputs.config_file }}
-      susfs_commit: ${{ steps.pins.outputs.susfs_commit }}
-      nomount_commit: ${{ steps.pins.outputs.nomount_commit }}
-      ksu_commit: ${{ steps.pins.outputs.ksu_commit }}
-      next_commit: ${{ steps.pins.outputs.next_commit }}
-      resukisu_commit: ${{ steps.pins.outputs.resukisu_commit }}
-    steps:
-      - id: pins
-        shell: bash
-        run: |
-          set -euo pipefail
-          # Verified pins. KernelSU-Next (next) is intentionally NOT pinned: it
-          # always resolves at latest. SUSFS below uses the verified pinned SHA per
-          # GKI target; build.yml overrides SUSFS to latest ONLY for the next
-          # (KernelSU-Next) variant, keeping kernelsu/resukisu stuck on the pin.
-          nomount_commit="26417ca5fb4021c4fd0c886e6ee8662d3f7b117a"
-          ksu_commit="abc3fdcf5b6ec9e0add131e600d55853a0fffbf2"
-          resukisu_commit="03b60f260cce36f23efbd26c9c334edfdc9ce7eb"
-          case "${{ inputs.kernel_build_version }}" in
-            android12-5.10) susfs_commit="44d9fed948b6d21c25ace142081418690f568dd3" ;;
-            android13-5.10) susfs_commit="83ffa9f7a9039e233af3d47aeeb838278b23ef8c" ;;
-            android13-5.15) susfs_commit="9623bd64ccb195dc538af70133ad3374f30de795" ;;
-            android14-5.15) susfs_commit="fcfdf108e3003fe97a95bf6ed238eb13a93b4aba" ;;
-            android14-6.1) susfs_commit="0ff932799d898366d57b3b5984d85cdbcfcfad0a" ;;
-            android15-6.6) susfs_commit="7767a4614146d44f7a81a18b6e687dd8316fc959" ;;
-            android16-6.12) susfs_commit="78a1f10a21df7271329fe5a733a3cb43c9c6c230" ;;
-            *) echo "Unsupported GKI target." >&2; exit 2 ;;
-          esac
-          next_commit="$(git ls-remote https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev | cut -f1)"
-          if [ "${{ inputs.commit_mode }}" = "latest" ]; then
-            echo "Resolving latest branch tips..."
-            nomount_commit="$(git ls-remote https://github.com/maxsteeel/nomount.git refs/heads/dev | cut -f1)"
-            ksu_commit="$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | cut -f1)"
-            resukisu_commit="$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | cut -f1)"
-            susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
-          fi
-          echo "config_file=.github/config/${{ inputs.kernel_build_version }}.json" >> "$GITHUB_OUTPUT"
-          echo "susfs_commit=$susfs_commit" >> "$GITHUB_OUTPUT"
-          echo "nomount_commit=$nomount_commit" >> "$GITHUB_OUTPUT"
-          echo "ksu_commit=$ksu_commit" >> "$GITHUB_OUTPUT"
-          echo "next_commit=$next_commit" >> "$GITHUB_OUTPUT"
-          echo "resukisu_commit=$resukisu_commit" >> "$GITHUB_OUTPUT"
-
-  build-nomount-module:
-    needs: resolve-pins
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Build NoMount metamodule
-        id: nomount-metamodule
-        uses: ./.github/actions/nomount-metamodule
-        with:
-          commit: ${{ needs.resolve-pins.outputs.nomount_commit }}
-
-      - name: Upload NoMount metamodule
-        uses: actions/upload-artifact@v7
-        with:
-          name: NoMount-Metamodule
-          path: ${{ steps.nomount-metamodule.outputs.module_dir }}
-          if-no-files-found: error
-
-  build:
-    needs: [resolve-pins, build-nomount-module]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - flavor: kernelsu
-            commit: ${{ needs.resolve-pins.outputs.ksu_commit }}
-            variant: KernelSU
-          - flavor: next
-            commit: ${{ needs.resolve-pins.outputs.next_commit }}
-            variant: KernelSU-Next
-          - flavor: resukisu
-            commit: ${{ needs.resolve-pins.outputs.resukisu_commit }}
-            variant: ReSukiSU
-    uses: ./.github/workflows/prepare.yml
-    with:
-      config_file: ${{ needs.resolve-pins.outputs.config_file }}
-      feature_set: SUSFS+NTSync+Ptrace+Unicode+BPF
-      susfs_commit: ${{ needs.resolve-pins.outputs.susfs_commit }}
-      root_flavor: ${{ matrix.flavor }}
-      root_commit: ${{ matrix.commit }}
-      nomount_commit: ${{ needs.resolve-pins.outputs.nomount_commit }}
-      preserve_abi: true
-      build_bypass: false
-      os_patch_level: ${{ inputs.os_patch_level }}
-      variant: ${{ matrix.variant }}
-    secrets: inherit