ci: build NoMount metamodule from pinned commit instead of downloading

.github/workflows/main.yml

@@ -499,8 +499,8 @@ jobs:
       - uses: actions/checkout@v7
         if: ${{ inputs.use_nomount }}
 
-      - name: Download NoMount metamodule built at pinned commit
-        id: nomount-metamodule
+      - name: Clone NoMount source at pinned commit
+        id: clone
         if: ${{ inputs.use_nomount }}
         shell: bash
         run: |
@@ -511,51 +511,55 @@ jobs:
             exit 2
           fi
           echo "NoMount commit: ${COMMIT}"
+          git clone https://github.com/maxsteeel/nomount.git nomount_src
+          git -C nomount_src checkout --detach "$COMMIT"
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "Cloned NoMount at ${COMMIT}"
 
-          RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
-            -H "Authorization: Bearer $GH_TOKEN" \
-            "https://api.github.com/repos/maxsteeel/nomount/actions/workflows/build.yml/runs?head_sha=${COMMIT}" \
-            | jq -r '.workflow_runs[0].id // empty')
-          if [[ -z "${RUN_ID}" ]]; then
-            echo "ERROR: no NoMount module build exists for commit ${COMMIT}" >&2
-            exit 1
-          fi
-          echo "NoMount CI run: ${RUN_ID}"
-
-          mkdir -p "${RUNNER_TEMP}/nomount-dl"
-          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
-            -H "Authorization: Bearer $GH_TOKEN" \
-            "https://api.github.com/repos/maxsteeel/nomount/actions/runs/${RUN_ID}/artifacts" \
-            > "${RUNNER_TEMP}/nomount-artifacts.json"
-          # Grab the flashable metamodule artifact (NoMount-*)
-          ART_ID=$(jq -r '.artifacts[] | select(.name | startswith("NoMount-")) | .id' "${RUNNER_TEMP}/nomount-artifacts.json" | head -1)
-          ART_NAME=$(jq -r --arg id "$ART_ID" '.artifacts[] | select(.id == ($id|tonumber)) | .name' "${RUNNER_TEMP}/nomount-artifacts.json")
-          if [[ -z "${ART_ID}" ]]; then
-            echo "ERROR: no NoMount metamodule artifact in run ${RUN_ID}" >&2
-            exit 1
-          fi
-          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
-            -H "Authorization: Bearer $GH_TOKEN" \
-            -o "${RUNNER_TEMP}/nomount-dl/${ART_NAME}.zip" \
-            "https://api.github.com/repos/maxsteeel/nomount/actions/artifacts/${ART_ID}/zip"
-          mkdir -p "${RUNNER_TEMP}/nomount-metamodule"
-          unzip -o -q "${RUNNER_TEMP}/nomount-dl/${ART_NAME}.zip" -d "${RUNNER_TEMP}/nomount-metamodule"
-          ls -la "${RUNNER_TEMP}/nomount-metamodule"
-
-          # Build a stable module_path for the downstream upload/verify steps
+      - name: Setup zig
+        if: ${{ inputs.use_nomount }}
+        uses: jetsung/setup-zig@v0.0.4
+        with:
+          version: master
+
+      - name: Build nm userspace binary
+        if: ${{ inputs.use_nomount }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          # Replicate maxsteeel build.yml: compile nm.c for arm64 + arm via zig cc.
+          cd nomount_src
+          mkdir -p bin
+          zig cc -target aarch64-linux -Oz -mcmodel=tiny -static -nostdlib -ffreestanding -fno-unwind-tables \
+            -fno-ident -Wno-invalid-noreturn -Wl,--entry=_start userspace/src/nm.c -o bin/nm-arm64
+          zig cc -target arm-linux -Oz -static -nostdlib -ffreestanding -fno-unwind-tables -fno-ident -Wno-invalid-noreturn \
+            -ffunction-sections -fdata-sections -Wl,--gc-sections -Wl,--entry=_start userspace/src/nm.c -o bin/nm-arm
+          file bin/nm-*
+          mkdir -p ../module/bin
+          cp -f bin/nm-arm64 bin/nm-arm ../module/bin/
+
+      - name: Package NoMount metamodule
+        id: package
+        if: ${{ inputs.use_nomount }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          COMMIT="${{ steps.clone.outputs.commit }}"
           module_zip="${RUNNER_TEMP}/NoMount-${COMMIT}.zip"
-          ( cd "${RUNNER_TEMP}/nomount-metamodule" && zip -qr "$module_zip" . )
+          # Package the module/ directory (webroot, scripts, module.prop, bin/nm).
+          # LKM .ko files are intentionally skipped: the kernel builds nomount
+          # in-tree (CONFIG_NOMOUNT=y via the nomount action).
+          ( cd nomount_src/module && zip -qr "$module_zip" . )
           sha256sum "$module_zip" > "${module_zip}.sha256"
           echo "module_path=$module_zip" >> "$GITHUB_OUTPUT"
-          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
-          echo "Found module at commit ${COMMIT}: ${ART_NAME}"
+          echo "Package size: $(du -h "$module_zip" | cut -f1)"
 
       - name: Upload NoMount metamodule
         if: ${{ inputs.use_nomount }}
         uses: actions/upload-artifact@v7
         with:
           name: NoMount-Metamodule
-          path: ${{ steps.nomount-metamodule.outputs.module_path }}
+          path: ${{ steps.package.outputs.module_path }}
           if-no-files-found: error
           compression-level: 0