ci: download NoMount metamodule built at pinned commit instead of compiling

.github/workflows/main.yml

@@ -419,16 +419,62 @@ jobs:
   build-nomount-module:
     needs: resolve-sources
     runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ secrets.MY_GITHUB_TOKEN }}
     steps:
       - uses: actions/checkout@v7
         if: ${{ inputs.use_nomount }}
 
-      - name: Build NoMount metamodule
+      - name: Download NoMount metamodule built at pinned commit
         id: nomount-metamodule
         if: ${{ inputs.use_nomount }}
-        uses: ./.github/actions/nomount-metamodule
-        with:
-          commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          COMMIT="${{ needs.resolve-sources.outputs.nomount_commit }}"
+          if ! [[ "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "NoMount commit must be a full 40-character SHA." >&2
+            exit 2
+          fi
+          echo "NoMount commit: ${COMMIT}"
+
+          RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            "https://api.github.com/repos/maxsteeel/nomount/actions/workflows/build.yml/runs?head_sha=${COMMIT}" \
+            | jq -r '.workflow_runs[0].id // empty')
+          if [[ -z "${RUN_ID}" ]]; then
+            echo "ERROR: no NoMount module build exists for commit ${COMMIT}" >&2
+            exit 1
+          fi
+          echo "NoMount CI run: ${RUN_ID}"
+
+          mkdir -p "${RUNNER_TEMP}/nomount-dl"
+          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            "https://api.github.com/repos/maxsteeel/nomount/actions/runs/${RUN_ID}/artifacts" \
+            > "${RUNNER_TEMP}/nomount-artifacts.json"
+          # Grab the flashable metamodule artifact (NoMount-*)
+          ART_ID=$(jq -r '.artifacts[] | select(.name | startswith("NoMount-")) | .id' "${RUNNER_TEMP}/nomount-artifacts.json" | head -1)
+          ART_NAME=$(jq -r --arg id "$ART_ID" '.artifacts[] | select(.id == ($id|tonumber)) | .name' "${RUNNER_TEMP}/nomount-artifacts.json")
+          if [[ -z "${ART_ID}" ]]; then
+            echo "ERROR: no NoMount metamodule artifact in run ${RUN_ID}" >&2
+            exit 1
+          fi
+          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
+            -H "Authorization: Bearer $GH_TOKEN" \
+            -o "${RUNNER_TEMP}/nomount-dl/${ART_NAME}.zip" \
+            "https://api.github.com/repos/maxsteeel/nomount/actions/artifacts/${ART_ID}/zip"
+          mkdir -p "${RUNNER_TEMP}/nomount-metamodule"
+          unzip -o -q "${RUNNER_TEMP}/nomount-dl/${ART_NAME}.zip" -d "${RUNNER_TEMP}/nomount-metamodule"
+          ls -la "${RUNNER_TEMP}/nomount-metamodule"
+
+          # Build a stable module_path for the downstream upload/verify steps
+          module_zip="${RUNNER_TEMP}/NoMount-${COMMIT}.zip"
+          ( cd "${RUNNER_TEMP}/nomount-metamodule" && zip -qr "$module_zip" . )
+          sha256sum "$module_zip" > "${module_zip}.sha256"
+          echo "module_path=$module_zip" >> "$GITHUB_OUTPUT"
+          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"
+          echo "Found module at commit ${COMMIT}: ${ART_NAME}"
 
       - name: Upload NoMount metamodule
         if: ${{ inputs.use_nomount }}