feat(workflows): implement dependency download and setup actions for kernel build process

.github/actions/setup-bbg/action.yml

@@ -0,0 +1,60 @@
+name: Setup Baseband Guard (BBG)
+description: Download and configure Baseband Guard security module
+inputs:
+  kernel_root:
+    description: 'Path to kernel root directory'
+    required: true
+  defconfig_fragment:
+    description: 'Path to defconfig fragment file'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download Baseband Guard
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}
+      run: |
+        echo "========================================"
+        echo "      Setting up Baseband Guard         "
+        echo "========================================"
+        curl -LSs https://github.com/vc-teahouse/Baseband-guard/raw/main/setup.sh | bash
+        echo "✓ Baseband Guard downloaded"
+    
+    - name: Configure Baseband Guard
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}
+      run: |
+        # Add BBG to defconfig
+        echo "CONFIG_BBG=y" >> "${{ inputs.defconfig_fragment }}"
+        
+        # Modify security Kconfig to include baseband_guard in LSM
+        sed -i '/^config LSM$/,/^help$/{ /^[[:space:]]*default/ { /baseband_guard/! s/selinux/selinux,baseband_guard/ } }' common/security/Kconfig
+        
+        echo "✓ Baseband Guard configured in kernel"
+    
+    - name: Verify BBG Installation
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}
+      run: |
+        if grep -q "baseband_guard" common/security/Kconfig; then
+          echo "✓ SUCCESS: baseband_guard found in common/security/Kconfig"
+          grep -n "baseband_guard" common/security/Kconfig || true
+        else
+          echo "✗ FAILED: baseband_guard not found in common/security/Kconfig"
+          exit 1
+        fi
+    
+    - name: Extract BBG Version
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/Baseband_guard
+      run: |
+        BBG_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
+        BBG_VERSION=$(git rev-list --count HEAD 2>/dev/null)
+        echo "BBG_COMMIT=$BBG_COMMIT" >> $GITHUB_ENV
+        echo "BBG_VERSION=$BBG_VERSION" >> $GITHUB_ENV
+        
+        echo "✓ Baseband Guard Setup Complete"
+        echo "  Version : $BBG_VERSION"
+        echo "  Commit  : $BBG_COMMIT"
+        echo "========================================"

.github/actions/setup-susfs/action.yml

@@ -0,0 +1,179 @@
+name: Setup SUSFS
+description: Clone and apply SUSFS patches with version-specific fixes
+inputs:
+  android_version:
+    description: 'Android version (e.g., android15)'
+    required: true
+  kernel_version:
+    description: 'Kernel version (e.g., 6.6)'
+    required: true
+  os_patch_level:
+    description: 'OS patch level (e.g., 2024-07)'
+    required: true
+  sublevel:
+    description: 'Kernel sublevel'
+    required: true
+  kernel_root:
+    description: 'Path to kernel root directory'
+    required: true
+  kernel_patches:
+    description: 'Path to kernel_patches directory'
+    required: true
+  susfs4ksu:
+    description: 'Path to susfs4ksu directory'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Setup SUSFS Branch
+      shell: bash
+      run: |
+        echo "========================================"
+        echo "        Setting up SUSFS                "
+        echo "========================================"
+        SUSFS_BRANCH="gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}"
+        
+        # Use downloaded SUSFS artifact
+        if [ -d "susfs_cache/$SUSFS_BRANCH" ]; then
+          echo "Using downloaded SUSFS branch: $SUSFS_BRANCH"
+          cp -r "susfs_cache/$SUSFS_BRANCH" susfs4ksu
+        else
+          echo "ERROR: SUSFS branch $SUSFS_BRANCH not found in downloaded artifacts"
+          echo "Available branches:"
+          ls -d susfs_cache/* 2>/dev/null || echo "No branches found"
+          exit 1
+        fi
+        
+        SUSFS_VERSION="2.0.0"
+        echo "SUSFS_VERSION=$SUSFS_VERSION" >> $GITHUB_ENV
+    
+    - name: Apply Base SUSFS Patches
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying SUSFS base patches..."
+        cp "${{ inputs.susfs4ksu }}/kernel_patches/fs/"* "${{ inputs.kernel_root }}/common/fs/"
+        cp "${{ inputs.susfs4ksu }}/kernel_patches/include/linux/"* "${{ inputs.kernel_root }}/common/include/linux/"
+        cp ${{ inputs.susfs4ksu }}/kernel_patches/50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch ./
+        patch -p1 < 50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch || true
+        echo "✓ Base SUSFS patches applied"
+    
+    - name: Apply Android 12 5.10 Fixes
+      if: inputs.android_version == 'android12' && inputs.kernel_version == '5.10'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 12 5.10 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        SUSFS_VERSION=${{ env.SUSFS_VERSION }}
+        
+        if [[ "$SUBLEVEL" -le 209 ]]; then
+          sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
+        fi 
+        if [[ "$SUBLEVEL" -le 117 ]]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a12-5.10/fdinfo.c.patch ./
+          patch -p1 < fdinfo.c.patch
+        fi
+        if [[ "$SUBLEVEL" -le 43 ]]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a12-5.10/base.c.patch ./
+          patch -p1 < base.c.patch
+        fi
+        echo "✓ Android 12 5.10 fixes applied"
+    
+    - name: Apply Android 13 5.10 Fixes
+      if: inputs.android_version == 'android13' && inputs.kernel_version == '5.10'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 13 5.10 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        SUSFS_VERSION=${{ env.SUSFS_VERSION }}
+        
+        if [[ "$SUBLEVEL" -le 107 ]]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.10/fdinfo.c.patch ./
+          patch -p1 < fdinfo.c.patch
+        fi
+        if [[ "$SUBLEVEL" -le 209 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
+          sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
+        fi
+        echo "✓ Android 13 5.10 fixes applied"
+    
+    - name: Apply Android 13 5.15 Fixes
+      if: inputs.android_version == 'android13' && inputs.kernel_version == '5.15'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 13 5.15 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        SUSFS_VERSION=${{ env.SUSFS_VERSION }}
+        
+        if [ "$SUBLEVEL" -le 41 ]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/namespace.c.patch ./
+          patch -p1 < namespace.c.patch
+          
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/fdinfo.c.patch ./
+          patch -p1 < fdinfo.c.patch
+          
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/open.c.patch ./
+          patch -p1 < open.c.patch
+          
+          sed -i 's|is_i_uid_not_allowed(i_uid_into_mnt(i_user_ns(inode), inode).val)))|is_i_uid_not_allowed(inode->i_uid.val)))|g' fs/susfs.c
+        fi
+        if [[ "$SUBLEVEL" -le 148 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
+          sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
+        fi
+        echo "✓ Android 13 5.15 fixes applied"
+    
+    - name: Apply Android 14 5.15 Fixes
+      if: inputs.android_version == 'android14' && inputs.kernel_version == '5.15'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 14 5.15 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        
+        if [[ "$SUBLEVEL" -le 148 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
+          sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
+        fi
+        echo "✓ Android 14 5.15 fixes applied"
+    
+    - name: Apply Android 14 6.1 Fixes
+      if: inputs.android_version == 'android14' && inputs.kernel_version == '6.1'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 14 6.1 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        
+        if [[ "$SUBLEVEL" -le 75 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
+          sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
+        fi
+        echo "✓ Android 14 6.1 fixes applied"
+    
+    - name: Apply Android 15 6.6 Fixes
+      if: inputs.android_version == 'android15' && inputs.kernel_version == '6.6'
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/common
+      run: |
+        echo "Applying Android 15 6.6 specific fixes..."
+        SUBLEVEL=${{ inputs.sublevel }}
+        SUSFS_VERSION=${{ env.SUSFS_VERSION }}
+        
+        if [[ "$SUBLEVEL" -ge 98 ]]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a15-6.6/base.c.patch ./
+          patch -p1 < base.c.patch
+        fi
+        if [[ "$SUBLEVEL" -le 58 ]]; then
+          cp ${{ inputs.kernel_patches }}/wild/susfs_fix_patches/v${SUSFS_VERSION}/a15-6.6/task_mmu.c.patch ./
+          patch -p1 < task_mmu.c.patch
+        fi
+        echo "✓ Android 15 6.6 fixes applied"
+    
+    - name: SUSFS Setup Complete
+      shell: bash
+      run: |
+        echo "✓ SUSFS Setup Complete"
+        echo "  Version: 2.0.0"
+        echo "  Branch: gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}"
+        echo "========================================"

.github/actions/setup-wksu/action.yml

@@ -0,0 +1,48 @@
+name: Setup Wild KSU
+description: Download and configure Wild KSU with version tracking
+inputs:
+  ksu_commit:
+    description: 'KSU commit to use (leave empty for canary)'
+    required: false
+    default: ''
+  kernel_root:
+    description: 'Path to kernel root directory'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Download Wild KSU
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}
+      run: |
+        echo "========================================"
+        echo "        Setting up Wild KSU             "
+        echo "========================================"
+        if [[ -n "${{ inputs.ksu_commit }}" ]]; then
+          echo "Using commit: ${{ inputs.ksu_commit }}"
+          curl -LSs "https://raw.githubusercontent.com/WildKernels/Wild_KSU/stable/kernel/setup.sh" | bash -s "${{ inputs.ksu_commit }}"
+        else
+          echo "Using canary build"
+          curl -LSs "https://raw.githubusercontent.com/WildKernels/Wild_KSU/stable/kernel/setup.sh" | bash -s canary
+        fi
+    
+    - name: Extract KSU Version Info
+      id: ksu-version
+      shell: bash
+      working-directory: ${{ inputs.kernel_root }}/Wild_KSU
+      run: |
+        KSU_GIT_VERSION=$(git rev-list --count HEAD 2>/dev/null)
+        KSU_GIT_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
+        KSU_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
+        KSU_VERSION=$((30000 + KSU_GIT_VERSION))
+        
+        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
+        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
+        echo "KSU_COMMIT=$KSU_COMMIT" >> $GITHUB_ENV
+        
+        echo "✓ Wild KSU Setup Complete"
+        echo "  Tag     : $KSU_GIT_TAG"
+        echo "  Version : $KSU_VERSION"
+        echo "  Commit  : $KSU_COMMIT"
+        echo "========================================"

.github/workflows/build.yml

@@ -32,8 +32,15 @@ on:
         type: boolean
 
 jobs:
+  download-dependencies:
+    uses: ./.github/workflows/cache-dependencies.yml
+    permissions:
+      contents: read
+      actions: write
+
   build-gki:
     name: "${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.android_version }}-${{ inputs.os_patch_level }}-${{ matrix.build_type }}"
+    needs: download-dependencies
     runs-on: ubuntu-latest
     timeout-minutes: 60
     strategy:
@@ -83,6 +90,24 @@ jobs:
         rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
         testing: false
 
+    - name: Download AnyKernel3 Artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: anykernel3
+        path: AnyKernel3
+
+    - name: Download Kernel Patches Artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: kernel-patches
+        path: kernel_patches
+
+    - name: Download Git Repo Tool Artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: git-repo-tool
+        path: git-repo
+
     - name: Setup Build Environment
       run: |
         CONFIG="${{ inputs.android_version }}-${{ inputs.kernel_version }}-${{ inputs.sub_level }}"
@@ -100,16 +125,19 @@ jobs:
         REPO=$GITHUB_WORKSPACE/git-repo/repo
         EOF
         
-        mkdir -p "$GITHUB_WORKSPACE/git-repo"
-        curl -L https://storage.googleapis.com/git-repo-downloads/repo -o "$GITHUB_WORKSPACE/git-repo/repo"
-        chmod 0755 "$GITHUB_WORKSPACE/git-repo/repo"
+        # Ensure repo tool is executable
+        chmod +x "$GITHUB_WORKSPACE/git-repo/repo"
         echo "$GITHUB_WORKSPACE/git-repo" >> "$GITHUB_PATH"
 
-    - name: Clone AnyKernel3 and Other Dependencies
+    - name: Dependency Summary
       run: |
-        ANYKERNEL_BRANCH="gki-2.0"
-        git clone https://github.com/WildKernels/AnyKernel3.git -b "$ANYKERNEL_BRANCH"
-        git clone https://github.com/WildKernels/kernel_patches.git
+        echo "========================================"
+        echo "     Downloaded Dependencies Ready      "
+        echo "========================================"
+        echo "AnyKernel3      : ✓ $(ls -d AnyKernel3 2>/dev/null && echo 'Ready' || echo 'Missing')"
+        echo "Kernel Patches  : ✓ $(ls -d kernel_patches 2>/dev/null && echo 'Ready' || echo 'Missing')"
+        echo "Git Repo Tool   : ✓ $(ls git-repo/repo 2>/dev/null && echo 'Ready' || echo 'Missing')"
+        echo "========================================"
 
     - name: Initialize and Sync Kernel Source
       working-directory: ${{ env.KERNEL_ROOT }}
@@ -174,131 +202,38 @@ jobs:
             sed -i '/#include <trace\/hooks\/blk.h>/a #include <trace\/hooks\/fs.h>' ./fs/namespace.c
         fi
 
-    - name: Add WKSU
+    - name: Setup Wild KSU
       if: contains(inputs.feature_set, 'WKSU')
-      working-directory: ${{ env.KERNEL_ROOT }}
-      run: |
-        if [[ -n "${{ inputs.ksu_commit }}" ]]; then
-          curl -LSs "https://raw.githubusercontent.com/WildKernels/Wild_KSU/stable/kernel/setup.sh" | bash -s "${{ inputs.ksu_commit }}"
-        else
-          curl -LSs "https://raw.githubusercontent.com/WildKernels/Wild_KSU/stable/kernel/setup.sh" | bash -s canary
-        fi
-        cd Wild_KSU
-        KSU_GIT_VERSION=$(git rev-list --count HEAD 2>/dev/null)
-        KSU_GIT_TAG=$(git describe --tags --abbrev=0 2>/dev/null)
-        KSU_VERSION=$((30000 + KSU_GIT_VERSION))
-        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
-        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
-
-    - name: Clone & Apply SUSFS Patches
-      if: contains(inputs.feature_set, 'SUSFS')
-      run: |
-        SUSFS_BRANCH="gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}"
-        git clone https://gitlab.com/simonpunk/susfs4ksu.git -b "$SUSFS_BRANCH"
-
-        SUSFS_VERSION="2.0.0"
-
-        cd "$KERNEL_ROOT/common"
-        cp "$SUSFS4KSU/kernel_patches/fs/"* "$KERNEL_ROOT/common/fs/"
-        cp "$SUSFS4KSU/kernel_patches/include/linux/"* "$KERNEL_ROOT/common/include/linux/"
-        cp $SUSFS4KSU/kernel_patches/50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch ./
-        patch -p1 < 50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch || true
-
-        if [[ "${{ inputs.android_version }}" == "android12" && "${{ inputs.kernel_version }}" == "5.10" ]]; then
-          if [[ "$SUBLEVEL" -le 209 ]]; then
-            sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
-          fi 
-          if [[ "$SUBLEVEL" -le 117 ]]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a12-5.10/fdinfo.c.patch ./
-            patch -p1 < fdinfo.c.patch
-          fi
-          if [[ "$SUBLEVEL" -le 43 ]]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a12-5.10/base.c.patch ./
-            patch -p1 < base.c.patch
-          fi
-        fi
-
-        if [[ "${{ inputs.android_version }}" == "android13" && "${{ inputs.kernel_version }}" == "5.10" ]]; then
-          if [[ "$SUBLEVEL" -le 107 ]]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.10/fdinfo.c.patch ./
-            patch -p1 < fdinfo.c.patch
-          fi
-          if [[ "$SUBLEVEL" -le 209 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
-            sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
-          fi
-        fi
-
-        if [[ "${{ inputs.android_version }}" == "android13" && "${{ inputs.kernel_version }}" == "5.15" ]]; then
-          if [ "$SUBLEVEL" -le 41 ]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/namespace.c.patch ./
-            patch -p1 < namespace.c.patch
-          fi
-          if [ "$SUBLEVEL" -le 41 ]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/fdinfo.c.patch ./
-            patch -p1 < fdinfo.c.patch
-          fi
-          if [ "$SUBLEVEL" -le 41 ]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a13-5.15/open.c.patch ./
-            patch -p1 < open.c.patch
-          fi
-          if [ "$SUBLEVEL" -le 41 ]; then
-            sed -i 's|is_i_uid_not_allowed(i_uid_into_mnt(i_user_ns(inode), inode).val)))|is_i_uid_not_allowed(inode->i_uid.val)))|g' fs/susfs.c
-          fi
-          if [[ "$SUBLEVEL" -le 148 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
-            sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
-          fi
-        fi
-
-        if [[ "${{ inputs.android_version }}" == "android14" && "${{ inputs.kernel_version }}" == "5.15" ]]; then
-          if [[ "$SUBLEVEL" -le 148 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
-            sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
-          fi
-        fi
-
-        if [[ "${{ inputs.android_version }}" == "android14" && "${{ inputs.kernel_version }}" == "6.1" ]]; then
-          #if [[ "$SUBLEVEL" -ge 145 ]]; then
-          #  cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a14-6.1/base.c.patch ./
-          #  patch -p1 < base.c.patch
-          #fi
-          if [[ "$SUBLEVEL" -le 75 && "${{ inputs.os_patch_level }}" != "2024-05" ]]; then
-            sed -i -e 's/goto show_pad;/return 0;/' ./fs/proc/task_mmu.c
-          fi
-        fi
-
-        if [[ "${{ inputs.android_version }}" == "android15" && "${{ inputs.kernel_version }}" == "6.6" ]]; then
-          if [[ "$SUBLEVEL" -ge 98 ]]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a15-6.6/base.c.patch ./
-            patch -p1 < base.c.patch
-          fi
-          if [[ "$SUBLEVEL" -le 58 ]]; then
-            cp $KERNEL_PATCHES/wild/susfs_fix_patches/v${SUSFS_VERSION}/a15-6.6/task_mmu.c.patch ./
-            patch -p1 < task_mmu.c.patch
-          fi
-        fi
+      uses: ./.github/actions/setup-wksu
+      with:
+        ksu_commit: ${{ inputs.ksu_commit }}
+        kernel_root: ${{ env.KERNEL_ROOT }}
 
-        if [[ "${{ inputs.android_version }}" == "android16" && "${{ inputs.kernel_version }}" == "6.12" ]]; then
-          if [[ "$SUBLEVEL" -le 9999 ]]; then
-            echo "Nothing to fix!"
-          fi
-        fi
+    - name: Download SUSFS Cache Artifact
+      if: contains(inputs.feature_set, 'SUSFS')
+      uses: actions/download-artifact@v4
+      with:
+        name: susfs-cache
+        path: susfs_cache
 
-    - name: Add BBG
+    - name: Setup SUSFS
+      if: contains(inputs.feature_set, 'SUSFS')
+      uses: ./.github/actions/setup-susfs
+      with:
+        android_version: ${{ inputs.android_version }}
+        kernel_version: ${{ inputs.kernel_version }}
+        os_patch_level: ${{ inputs.os_patch_level }}
+        sublevel: ${{ env.SUBLEVEL }}
+        kernel_root: ${{ env.KERNEL_ROOT }}
+        kernel_patches: ${{ env.KERNEL_PATCHES }}
+        susfs4ksu: ${{ env.SUSFS4KSU }}
+
+    - name: Setup Baseband Guard
       if: contains(inputs.feature_set, 'BBG')
-      working-directory: ${{ env.KERNEL_ROOT }}
-      run: |
-        curl -LSs https://github.com/vc-teahouse/Baseband-guard/raw/main/setup.sh | bash
-        echo "CONFIG_BBG=y" >> "${{ env.DEFCONFIG_FRAGMENT }}"
-        sed -i '/^config LSM$/,/^help$/{ /^[[:space:]]*default/ { /baseband_guard/! s/selinux/selinux,baseband_guard/ } }' common/security/Kconfig
-        if grep -q "baseband_guard" common/security/Kconfig; then
-          echo "SUCCESS: baseband_guard found in common/security/Kconfig"
-          grep -n "baseband_guard" common/security/Kconfig || true
-        else
-          echo "FAILED: baseband_guard not found in common/security/Kconfig"
-          exit 1
-        fi
-        cd Baseband_guard
-        BBG_COMMIT=$(git rev-parse --short HEAD 2>/dev/null)
-        echo "BBG_COMMIT=$BBG_COMMIT" >> $GITHUB_ENV
+      uses: ./.github/actions/setup-bbg
+      with:
+        kernel_root: ${{ env.KERNEL_ROOT }}
+        defconfig_fragment: ${{ env.DEFCONFIG_FRAGMENT }}
 
     - name: Apply Module Check Bypass
       if: ${{ matrix.build_type == 'Bypass' || matrix.build_type == 'Hakan' }}

.github/workflows/cache-dependencies.yml

@@ -0,0 +1,118 @@
+name: Download Build Dependencies
+permissions:
+  contents: read
+  actions: write
+
+on:
+  workflow_call:
+    outputs:
+      dependencies-ready:
+        description: "Dependencies are downloaded and uploaded"
+        value: ${{ jobs.download-dependencies.outputs.status }}
+
+jobs:
+  download-dependencies:
+    name: Download Dependencies
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    outputs:
+      status: ${{ steps.summary.outputs.status }}
+    
+    steps:
+    - name: Download Summary Start
+      run: |
+        echo "========================================"
+        echo "    Downloading Build Dependencies      "
+        echo "========================================"
+        echo "Started at: $(date)"
+    
+    - name: Clone AnyKernel3
+      run: |
+        git clone https://github.com/WildKernels/AnyKernel3.git -b gki-2.0 --depth=1
+        echo "AnyKernel3 commit: $(cd AnyKernel3 && git rev-parse --short HEAD)"
+    
+    - name: Clone Kernel Patches
+      run: |
+        git clone https://github.com/WildKernels/kernel_patches.git --depth=1
+        echo "Kernel Patches commit: $(cd kernel_patches && git rev-parse --short HEAD)"
+    
+    - name: Clone All SUSFS Branches
+      run: |
+        mkdir -p susfs_cache
+        
+        # List of all SUSFS branches we support
+        BRANCHES=(
+          "gki-android12-5.10"
+          "gki-android13-5.10"
+          "gki-android13-5.15"
+          "gki-android14-5.15"
+          "gki-android14-6.1"
+          "gki-android15-6.6"
+          "gki-android16-6.12"
+        )
+        
+        for BRANCH in "${BRANCHES[@]}"; do
+          echo "Cloning SUSFS branch: $BRANCH"
+          git clone https://gitlab.com/simonpunk/susfs4ksu.git -b "$BRANCH" --depth=1 "susfs_cache/$BRANCH" || {
+            echo "Warning: Failed to clone branch $BRANCH (may not exist yet)"
+            continue
+          }
+          COMMIT=$(cd "susfs_cache/$BRANCH" && git rev-parse --short HEAD 2>/dev/null || echo "N/A")
+          echo "  └─ Commit: $COMMIT"
+        done
+        
+        BRANCH_COUNT=$(ls -d susfs_cache/* 2>/dev/null | wc -l)
+        echo "SUSFS branches downloaded: $BRANCH_COUNT"
+    
+    - name: Download Git Repo Tool
+      run: |
+        mkdir -p git-repo
+        curl -L https://storage.googleapis.com/git-repo-downloads/repo -o git-repo/repo
+        chmod 0755 git-repo/repo
+        echo "Git repo tool downloaded"
+    
+    - name: Upload AnyKernel3 Artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: anykernel3
+        path: AnyKernel3/
+        retention-days: 1
+        compression-level: 6
+    
+    - name: Upload Kernel Patches Artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: kernel-patches
+        path: kernel_patches/
+        retention-days: 1
+        compression-level: 6
+    
+    - name: Upload SUSFS Cache Artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: susfs-cache
+        path: susfs_cache/
+        retention-days: 1
+        compression-level: 6
+    
+    - name: Upload Git Repo Tool Artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: git-repo-tool
+        path: git-repo/
+        retention-days: 1
+        compression-level: 0
+    
+    - name: Download Summary End
+      id: summary
+      run: |
+        echo "========================================"
+        echo "    Dependencies Download Complete      "
+        echo "========================================"
+        echo "AnyKernel3      : ✓ Uploaded as artifact"
+        echo "Kernel Patches  : ✓ Uploaded as artifact"
+        echo "SUSFS Branches  : ✓ Uploaded as artifact"
+        echo "Git Repo Tool   : ✓ Uploaded as artifact"
+        echo "========================================"
+        echo "Completed at: $(date)"
+        echo "status=success" >> $GITHUB_OUTPUT

configs/base_kernel_config.fragment

@@ -0,0 +1,11 @@
+# KernelSU Configuration
+CONFIG_KSU=y
+CONFIG_KSU_SUSFS=y
+
+# KPatch Next Support
+CONFIG_KALLSYMS=y
+CONFIG_KALLSYMS_ALL=y
+
+# Mountify Support
+CONFIG_TMPFS_XATTR=y
+CONFIG_TMPFS_POSIX_ACL=y