fix: resolve SUSFS per root variant (latest for KernelSU-Next, pinned otherwise)

A single shared SUSFS commit was resolved per-kernel and used by every
root variant, so 'All' forced SUSFS latest for kernelsu/resukisu too.
Move SUSFS resolution into build.yml, where each variant knows its own
root_flavor: KernelSU-Next (next) resolves the latest susfs4ksu branch
tip; kernelsu and resukisu keep the verified pinned SUSFS (from
PIN_SUSFS / the root-variants case table). main.yml and root-variants.yml
now always emit the pinned SUSFS SHA; build.yml overrides to latest only
for the next variant. KernelSU-Next root is unaffected (always latest).

.github/workflows/build.yml

@@ -197,11 +197,29 @@ jobs:
       with:
         mode: verify
 
+    - name: Resolve SUSFS commit
+      id: susfs-cm
+      shell: bash
+      run: |
+        set -euo pipefail
+        # KernelSU-Next (next) always uses the latest susfs4ksu gki branch tip so
+        # SUSFS stays API-matched to the always-latest KernelSU-Next tree. All
+        # other roots (kernelsu, resukisu) use the pinned verified SUSFS commit.
+        if [ "${{ inputs.root_flavor }}" = "next" ]; then
+          BRANCH="gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}"
+          SUSFS_COMMIT="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/${BRANCH}" | cut -f1)"
+          echo "KernelSU-Next: resolving SUSFS at latest on ${BRANCH} -> ${SUSFS_COMMIT}"
+        else
+          SUSFS_COMMIT="${{ inputs.susfs_commit }}"
+          echo "Using pinned SUSFS commit: ${SUSFS_COMMIT}"
+        fi
+        echo "commit=${SUSFS_COMMIT}" >> "$GITHUB_OUTPUT"
+
     - name: SUSFS
       if: contains(inputs.feature_set, 'SUSFS') || inputs.feature_set == 'All'
       uses: ./.github/actions/susfs
       with:
-        susfs_commit: ${{ inputs.susfs_commit }}
+        susfs_commit: ${{ steps.susfs-cm.outputs.commit }}
         version: ${{ inputs.version }}
         android_version: ${{ inputs.android_version }}
         kernel_version: ${{ inputs.kernel_version }}

.github/workflows/main.yml

@@ -273,12 +273,8 @@ jobs:
           echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"
 
           # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu).
-          # KernelSU-Next builds — including 'All' (which always contains a
-          # KernelSU-Next variant) — take SUSFS at latest so it stays API-matched
-          # to the always-latest KernelSU-Next tree. Pure KernelSU / ReSukiSU
-          # builds pin SUSFS (verified SHA, latest otherwise). KernelSU-Next root
-          # itself is always latest regardless of flavor.
-          susfs_latest="${{ inputs.root_flavor == 'KernelSU-Next' || inputs.root_flavor == 'All' }}"
+          # Always emit the verified pinned SHA here; build.yml overrides to the
+          # latest branch tip per-variant when the root flavor is KernelSU-Next.
           declare -A SUSFS_BRANCHES=(
             [susfs_commit_android12_5_10]="gki-android12-5.10"
             [susfs_commit_android13_5_10]="gki-android13-5.10"
@@ -289,11 +285,7 @@ jobs:
             [susfs_commit_android16_6_12]="gki-android16-6.12"
           )
           for key in "${!SUSFS_BRANCHES[@]}"; do
-            if [ "$susfs_latest" = "true" ]; then
-              emit "$key" "$(resolve_sha https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
-            else
-              emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
-            fi
+            emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
           done
 
           # Tracked build helpers (resolved automatically, before the run)

.github/workflows/root-variants.yml

@@ -49,19 +49,30 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          # Verified pins. KernelSU-Next (next) and SUSFS are intentionally NOT
-          # pinned: they always resolve at latest so SUSFS stays API-matched to
-          # the always-latest KernelSU-Next tree.
+          # Verified pins. KernelSU-Next (next) is intentionally NOT pinned: it
+          # always resolves at latest. SUSFS below uses the verified pinned SHA per
+          # GKI target; build.yml overrides SUSFS to latest ONLY for the next
+          # (KernelSU-Next) variant, keeping kernelsu/resukisu stuck on the pin.
           nomount_commit="c52936b229c25a4b0e41b6627f7d3bc5eaaaf2b5"
           ksu_commit="da9abf498a77d438989fea0f5f4e348b9a540c07"
           resukisu_commit="3ef06b0fcb0960dc9563256fe26a58e892663387"
-          susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
+          case "${{ inputs.kernel_build_version }}" in
+            android12-5.10) susfs_commit="3c14ad549f826b1f53878ec8c12253efebeed75a" ;;
+            android13-5.10) susfs_commit="f81aaf10e9560282052bb61dd931315c2ca3e617" ;;
+            android13-5.15) susfs_commit="ccb1918684b27644d17a6c842f57b60ae5966025" ;;
+            android14-5.15) susfs_commit="0463ac089308014e8c22cc6a4558e0d6d2a53e08" ;;
+            android14-6.1) susfs_commit="e287d59066380bf6de4396532d4a42edf4408701" ;;
+            android15-6.6) susfs_commit="be7b7ef49a1e1b189c3abf00eacaa7ebdb4168c1" ;;
+            android16-6.12) susfs_commit="f37930f374ef88de990d6abea0c67d0ea28c1edc" ;;
+            *) echo "Unsupported GKI target." >&2; exit 2 ;;
+          esac
           next_commit="$(git ls-remote https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev | cut -f1)"
           if [ "${{ inputs.commit_mode }}" = "latest" ]; then
             echo "Resolving latest branch tips..."
             nomount_commit="$(git ls-remote https://github.com/maxsteeel/nomount.git refs/heads/dev | cut -f1)"
             ksu_commit="$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | cut -f1)"
             resukisu_commit="$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | cut -f1)"
+            susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
           fi
           echo "config_file=.github/config/${{ inputs.kernel_build_version }}.json" >> "$GITHUB_OUTPUT"
           echo "susfs_commit=$susfs_commit" >> "$GITHUB_OUTPUT"