ci: add verified/latest commit mode toggle to root variants

.github/workflows/prepare.yml

@@ -47,7 +47,7 @@ on:
         type: boolean
         default: true
       os_patch_level:
-        description: "Optional filter: patch date (YYYY-MM), kernel sublevel, latest, or all"
+        description: "Optional filter: patch date (YYYY-MM), kernel sublevel, lts (LTS branch), or all"
         required: false
         type: string
         default: ""
@@ -116,8 +116,6 @@ jobs:
           SELECTED_PATCH_LEVEL="${{ inputs.os_patch_level }}"
           if [ "$SELECTED_PATCH_LEVEL" = "all" ]; then
             SELECTED_PATCH_LEVEL=""
-          elif [ "$SELECTED_PATCH_LEVEL" = "latest" ]; then
-            SELECTED_PATCH_LEVEL=$(jq -r '[.include[] | select(.date != "lts") | .date] | last // empty' "${{ inputs.config_file }}")
           fi
           if [ -n "$SELECTED_PATCH_LEVEL" ]; then
             FULL_FINAL="$FINAL"

.github/workflows/root-variants.yml

@@ -17,10 +17,18 @@ on:
           - android16-6.12
         default: android14-6.1
       os_patch_level:
-        description: "Patch date (YYYY-MM), kernel sublevel, latest, or all"
+        description: "Patch date (YYYY-MM), kernel sublevel, lts (builds the LTS branch), or all"
         required: true
         type: string
-        default: latest
+        default: lts
+      commit_mode:
+        description: "verified = audited pinned SHAs, latest = branch tips at run time"
+        required: false
+        type: choice
+        options:
+          - verified
+          - latest
+        default: verified
 
 permissions:
   contents: read
@@ -33,12 +41,18 @@ jobs:
       config_file: ${{ steps.pins.outputs.config_file }}
       susfs_commit: ${{ steps.pins.outputs.susfs_commit }}
       nomount_commit: ${{ steps.pins.outputs.nomount_commit }}
+      classic_commit: ${{ steps.pins.outputs.classic_commit }}
+      next_commit: ${{ steps.pins.outputs.next_commit }}
+      resukisu_commit: ${{ steps.pins.outputs.resukisu_commit }}
     steps:
       - id: pins
         shell: bash
         run: |
           set -euo pipefail
           nomount_commit="c52936b229c25a4b0e41b6627f7d3bc5eaaaf2b5"
+          classic_commit="da9abf498a77d438989fea0f5f4e348b9a540c07"
+          next_commit="234f6e040fcbca18b16d2398e1aa225712ec99ad"
+          resukisu_commit="3ef06b0fcb0960dc9563256fe26a58e892663387"
           case "${{ inputs.kernel_build_version }}" in
             android12-5.10) susfs_commit="3c14ad549f826b1f53878ec8c12253efebeed75a" ;;
             android13-5.10) susfs_commit="f81aaf10e9560282052bb61dd931315c2ca3e617" ;;
@@ -49,9 +63,20 @@ jobs:
             android16-6.12) susfs_commit="f37930f374ef88de990d6abea0c67d0ea28c1edc" ;;
             *) echo "Unsupported GKI target." >&2; exit 2 ;;
           esac
+          if [ "${{ inputs.commit_mode }}" = "latest" ]; then
+            echo "Resolving latest branch tips..."
+            susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
+            nomount_commit="$(git ls-remote https://github.com/maxsteeel/nomount.git refs/heads/dev | cut -f1)"
+            classic_commit="$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | cut -f1)"
+            next_commit="$(git ls-remote https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev | cut -f1)"
+            resukisu_commit="$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | cut -f1)"
+          fi
           echo "config_file=.github/config/${{ inputs.kernel_build_version }}.json" >> "$GITHUB_OUTPUT"
           echo "susfs_commit=$susfs_commit" >> "$GITHUB_OUTPUT"
           echo "nomount_commit=$nomount_commit" >> "$GITHUB_OUTPUT"
+          echo "classic_commit=$classic_commit" >> "$GITHUB_OUTPUT"
+          echo "next_commit=$next_commit" >> "$GITHUB_OUTPUT"
+          echo "resukisu_commit=$resukisu_commit" >> "$GITHUB_OUTPUT"
 
   build-nomount-module:
     needs: resolve-pins
@@ -79,13 +104,13 @@ jobs:
       matrix:
         include:
           - flavor: classic
-            commit: da9abf498a77d438989fea0f5f4e348b9a540c07
+            commit: ${{ needs.resolve-pins.outputs.classic_commit }}
             variant: Classic-KernelSU
           - flavor: next
-            commit: 234f6e040fcbca18b16d2398e1aa225712ec99ad
+            commit: ${{ needs.resolve-pins.outputs.next_commit }}
             variant: KernelSU-Next
           - flavor: resukisu
-            commit: 3ef06b0fcb0960dc9563256fe26a58e892663387
+            commit: ${{ needs.resolve-pins.outputs.resukisu_commit }}
             variant: ReSukiSU
     uses: ./.github/workflows/prepare.yml
     with: