ci: improve GitHub Actions robustness and flexibility

- Add optional inputs to apply-kernel-branding action
- Enhance KernelSU commit resolution with fallback ref checks
- Make ksu_commit optional in kernelsu action with default to dev
- Add conditional checks in remove-protected-exports to prevent unnecessary modifications

.github/actions/apply-kernel-branding/action.yml

@@ -1,6 +1,16 @@
 name: 'Apply Kernel Branding & Timestamp'
 description: 'Apply Wild kernel branding to kernel version string'
 
+inputs:
+  build_type:
+    required: false
+    type: string
+    default: ""
+  kernel_version:
+    required: false
+    type: string
+    default: ""
+
 runs:
   using: "composite"
   steps:

.github/actions/fetch-commits/action.yml

@@ -50,14 +50,20 @@ runs:
         
         # KernelSU-Next
         if [ -n "${{ inputs.ksu_commit }}" ]; then
-          # Try to resolve input as a ref (branch/tag)
-          resolved_commit=$(get_commit "https://github.com/KernelSU-Next/KernelSU-Next.git" "${{ inputs.ksu_commit }}")
+          input_ref="${{ inputs.ksu_commit }}"
+          resolved_commit="$(get_commit "https://github.com/KernelSU-Next/KernelSU-Next.git" "$input_ref")"
+          if [ -z "$resolved_commit" ]; then
+            resolved_commit="$(get_commit "https://github.com/KernelSU-Next/KernelSU-Next.git" "refs/heads/$input_ref")"
+          fi
+          if [ -z "$resolved_commit" ]; then
+            resolved_commit="$(get_commit "https://github.com/KernelSU-Next/KernelSU-Next.git" "refs/tags/$input_ref")"
+          fi
           
           if [ -n "$resolved_commit" ]; then
             ksu_commit="$resolved_commit"
           else
             # If resolution failed, assume input is a commit SHA
-            ksu_commit="${{ inputs.ksu_commit }}"
+            ksu_commit="$input_ref"
           fi
           echo "Using provided KernelSU-Next commit: $ksu_commit"
         else

.github/actions/kernelsu/action.yml

@@ -2,9 +2,10 @@ name: Setup Wild KSU
 description: Download and configure Wild KSU with version tracking
 inputs:
   ksu_commit:
-    description: "KSU Commit"
-    required: true
+    description: "KernelSU-Next ref/commit (optional, defaults to dev)"
+    required: false
     type: string
+    default: ""
 
 runs:
   using: composite
@@ -13,8 +14,32 @@ runs:
       shell: bash
       working-directory: ${{ github.workspace }}/kernel
       run: |
-        # Clone the repository
+        set -euo pipefail
+
+        TARGET_REF="${{ inputs.ksu_commit }}"
+        if [ -z "$TARGET_REF" ]; then TARGET_REF="dev"; fi
+
         curl -LSs "https://raw.githubusercontent.com/KernelSU-Next/KernelSU-Next/dev/kernel/setup.sh" | bash -s dev
+
+        if [ "$TARGET_REF" != "dev" ]; then
+          cd KernelSU-Next
+          if git rev-parse --is-shallow-repository >/dev/null 2>&1 && git rev-parse --is-shallow-repository | grep -q true; then
+            git fetch --unshallow --tags --prune || true
+          fi
+          git fetch --all --tags --prune
+
+          if git checkout "$TARGET_REF" 2>/dev/null; then
+            :
+          elif git checkout "origin/$TARGET_REF" 2>/dev/null; then
+            :
+          elif git checkout "refs/tags/$TARGET_REF" 2>/dev/null; then
+            :
+          else
+            echo "Error: could not checkout KernelSU-Next ref/commit/tag: $TARGET_REF"
+            exit 1
+          fi
+          cd "$GITHUB_WORKSPACE/kernel"
+        fi
         
         cd KernelSU-Next/kernel
         

.github/actions/remove-protected-exports/action.yml

@@ -22,27 +22,30 @@ runs:
           exit 1
         fi
 
-        BEFORE_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
-        perl -pi -e 's/^\s*"protected_exports_list"\s*:\s*"android\/abi_gki_protected_exports_aarch64",\s*$//;' common/BUILD.bazel
-        AFTER_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
-        if [ "$BEFORE_BUILD_BAZEL_SHA" = "$AFTER_BUILD_BAZEL_SHA" ]; then
-          echo "Error: common/BUILD.bazel was not modified"
-          exit 1
-        fi
         if grep -q '"protected_exports_list"[[:space:]]*:[[:space:]]*"android/abi_gki_protected_exports_aarch64"' common/BUILD.bazel; then
-          echo "Error: protected_exports_list reference still present in common/BUILD.bazel"
-          exit 1
+          BEFORE_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
+          perl -pi -e 's/^\s*"protected_exports_list"\s*:\s*"android\/abi_gki_protected_exports_aarch64",\s*$//;' common/BUILD.bazel
+          AFTER_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
+          if [ "$BEFORE_BUILD_BAZEL_SHA" = "$AFTER_BUILD_BAZEL_SHA" ]; then
+            echo "Error: common/BUILD.bazel was not modified"
+            exit 1
+          fi
+          if grep -q '"protected_exports_list"[[:space:]]*:[[:space:]]*"android/abi_gki_protected_exports_aarch64"' common/BUILD.bazel; then
+            echo "Error: protected_exports_list reference still present in common/BUILD.bazel"
+            exit 1
+          fi
         fi
 
-        BEFORE_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
-        sed -i 's/protected_modules = \[.*\]/protected_modules = []/' common/modules.bzl
-        AFTER_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
-        if [ "$BEFORE_MODULES_BZL_SHA" = "$AFTER_MODULES_BZL_SHA" ]; then
-          echo "Error: common/modules.bzl was not modified"
-          exit 1
+        if grep -q '^protected_modules = ' common/modules.bzl; then
+          BEFORE_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
+          sed -i 's/protected_modules = \[.*\]/protected_modules = []/' common/modules.bzl
+          AFTER_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
+          if [ "$BEFORE_MODULES_BZL_SHA" = "$AFTER_MODULES_BZL_SHA" ]; then
+            echo "Error: common/modules.bzl was not modified"
+            exit 1
+          fi
+          if ! grep -q '^protected_modules = \[\]' common/modules.bzl; then
+            echo "Error: protected_modules was not set to [] in common/modules.bzl"
+            exit 1
+          fi
         fi
-        if ! grep -q '^protected_modules = \[\]' common/modules.bzl; then
-          echo "Error: protected_modules was not set to [] in common/modules.bzl"
-          exit 1
-        fi
-