ci(managers): build ksud before manager like upstream (split jobs + jniLibs)

Upstream Next/pershoot: build-lkm -> build-ksuinit -> build-ksud -> build-manager
needs ksud and copies to app/src/main/jniLibs/{arm64,x86_64}/libksud.so
before ./gradlew. Mirror that order:

- new job build-ksud-from-source (matrix 4 flavors, full tags clone,
  cargo-ndk aarch64+x86_64) uploads ksud-{flavor}-*
- build-from-source now needs build-ksud-from-source and
  downloads + copies to jniLibs for next/next-susfs only,
  matching .github/workflows/build-manager*.yml
Keeps manager build exactly stock beside your key.

.github/workflows/managers.yml

@@ -402,11 +402,157 @@ jobs:
           path: manager_apks/
           if-no-files-found: warn
 
+  # ── path B: build from source — mirror upstream workflow order ──
+  # Upstream: build-lkm -> build-ksuinit -> build-ksud (matrix) -> build-manager (needs ksud, copies to jniLibs)
+  # We mirror that order so manager embeds ksud correctly. No extra gradle.properties edits beside your key.
+  build-ksud-from-source:
+    if: ${{ inputs.build_from_source }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - flavor: next
+            repo: https://github.com/KernelSU-Next/KernelSU-Next.git
+            ref: dev
+          - flavor: next-susfs
+            repo: https://github.com/pershoot/KernelSU-Next.git
+            ref: dev-susfs
+          - flavor: kernelsu
+            repo: https://github.com/tiann/KernelSU.git
+            ref: main
+          - flavor: resukisu
+            repo: https://github.com/ReSukiSU/ReSukiSU.git
+            ref: main
+    steps:
+      - name: Gate on root_flavor filter
+        id: gate
+        shell: bash
+        env:
+          ROOT_FLAVOR: ${{ inputs.root_flavor }}
+        run: |
+          WANT="${{ inputs.root_flavor }}"
+          WANT="${WANT:-All}"
+          FLAVOR="${{ matrix.flavor }}"
+          case "$WANT" in
+            All) echo "run=true" >> "$GITHUB_OUTPUT" ;;
+            KernelSU-Next) [[ "$FLAVOR" == "next" ]] && echo "run=true" >> "$GITHUB_OUTPUT" || echo "run=false" >> "$GITHUB_OUTPUT" ;;
+            KernelSU-Next-SUSFS) [[ "$FLAVOR" == "next-susfs" ]] && echo "run=true" >> "$GITHUB_OUTPUT" || echo "run=false" >> "$GITHUB_OUTPUT" ;;
+            KernelSU) [[ "$FLAVOR" == "kernelsu" ]] && echo "run=true" >> "$GITHUB_OUTPUT" || echo "run=false" >> "$GITHUB_OUTPUT" ;;
+            ReSukiSU) [[ "$FLAVOR" == "resukisu" ]] && echo "run=true" >> "$GITHUB_OUTPUT" || echo "run=false" >> "$GITHUB_OUTPUT" ;;
+            *) echo "run=false" >> "$GITHUB_OUTPUT" ;;
+          esac
+
+      - name: Resolve commit for this flavor
+        if: steps.gate.outputs.run == 'true'
+        id: commit
+        shell: bash
+        env:
+          KSU_NEXT_COMMIT: ${{ inputs.kernelsu_next_commit }}
+          KSU_NEXT_SUSFS_COMMIT: ${{ inputs.kernelsu_next_susfs_commit }}
+          KSU_COMMIT: ${{ inputs.kernelsu_commit }}
+          RESUKISU_COMMIT: ${{ inputs.resukisu_commit }}
+        run: |
+          set -euo pipefail
+          flavor="${{ matrix.flavor }}"
+          case "$flavor" in
+            next) pin="$KSU_NEXT_COMMIT" ;;
+            next-susfs) pin="$KSU_NEXT_SUSFS_COMMIT" ;;
+            kernelsu) pin="$KSU_COMMIT" ;;
+            resukisu) pin="$RESUKISU_COMMIT" ;;
+          esac
+          if [[ -n "${pin:-}" ]]; then
+            echo "sha=$pin" >> "$GITHUB_OUTPUT"
+          else
+            sha=$(git ls-remote "${{ matrix.repo }}" "refs/heads/${{ matrix.ref }}" | awk '{print $1; exit}')
+            echo "sha=$sha" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Clone ${{ matrix.flavor }} at pinned commit
+        if: steps.gate.outputs.run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          sha="${{ steps.commit.outputs.sha }}"
+          repo="${{ matrix.repo }}"
+          flavor="${{ matrix.flavor }}"
+          dir="/tmp/$flavor-src"
+          rm -rf "$dir"
+          git clone --no-checkout "$repo" "$dir"
+          git -C "$dir" fetch --prune --tags --force origin "+refs/heads/*:refs/remotes/origin/*" "+refs/tags/*:refs/tags/*" 2>&1 | tail -5 || true
+          git -C "$dir" checkout --detach "$sha"
+          actual=$(git -C "$dir" rev-parse HEAD)
+          if [[ "$actual" != "$sha" ]]; then echo "mismatch $sha vs $actual" >&2; exit 1; fi
+          echo "Cloned $flavor at $actual"
+          echo "SRC_DIR=$dir" >> "$GITHUB_ENV"
+
+      - name: Setup Rust
+        if: steps.gate.outputs.run == 'true'
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-linux-android,x86_64-linux-android
+
+      - name: Setup Android NDK
+        if: steps.gate.outputs.run == 'true'
+        uses: android-actions/setup-android@v3
+
+      - name: Build ksud (aarch64 + x86_64)
+        if: steps.gate.outputs.run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          dir="$SRC_DIR"
+          cd "$dir"
+          # Upstream uses cross + LKM packing; for manager we just need ksud binary per arch.
+          # Try userspace/ksud/Cargo.toml else Cargo.toml
+          export ANDROID_NDK_HOME="${ANDROID_NDK_HOME:-$ANDROID_NDK_ROOT}"
+          export ANDROID_NDK_ROOT="${ANDROID_NDK_ROOT:-$ANDROID_NDK_HOME}"
+          echo "NDK: $ANDROID_NDK_HOME"
+          ls -d "$ANDROID_NDK_HOME/toolchains/llvm/prebuilt/linux-x86_64" 2>/dev/null | head -1 || true
+          cargo install cargo-ndk --locked 2>&1 | tail -5 || true
+          build_one() {
+            local target="$1"
+            echo "== cargo ndk $target =="
+            if [ -f userspace/ksud/Cargo.toml ]; then
+              cargo ndk -t "$target" -o "/tmp/ksud-$target" build --release --manifest-path userspace/ksud/Cargo.toml 2>&1 | tail -40 || return 1
+            elif [ -f Cargo.toml ]; then
+              cargo ndk -t "$target" -o "/tmp/ksud-$target" build --release 2>&1 | tail -40 || return 1
+            else
+              echo "No Cargo.toml found" >&2; return 1
+            fi
+            ls -lh "/tmp/ksud-$target" 2>&1 | head -20 || true
+          }
+          mkdir -p /tmp/ksud-aarch64-linux-android /tmp/ksud-x86_64-linux-android
+          build_one aarch64-linux-android || echo "aarch64 ksud build failed — will still try manager without it"
+          build_one x86_64-linux-android || true
+          mkdir -p "/tmp/ksud-out-${{ matrix.flavor }}/aarch64-linux-android/release" "/tmp/ksud-out-${{ matrix.flavor }}/x86_64-linux-android/release"
+          for f in /tmp/ksud-aarch64-linux-android/* /tmp/ksud-aarch64-linux-android/release/* target/*/release/ksud userspace/ksud/target/*/release/ksud; do [ -f "$f" ] && cp -f "$f" "/tmp/ksud-out-${{ matrix.flavor }}/aarch64-linux-android/release/ksud" && break || true; done
+          for f in /tmp/ksud-x86_64-linux-android/* /tmp/ksud-x86_64-linux-android/release/* target/*/release/ksud userspace/ksud/target/*/release/ksud; do [ -f "$f" ] && cp -f "$f" "/tmp/ksud-out-${{ matrix.flavor }}/x86_64-linux-android/release/ksud" && break || true; done
+          ls -lhR /tmp/ksud-out-${{ matrix.flavor }} 2>&1 | head -50 || true
+
+      - name: Upload ksud (${{ matrix.flavor }} aarch64)
+        if: steps.gate.outputs.run == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: ksud-${{ matrix.flavor }}-aarch64-linux-android
+          path: /tmp/ksud-out-${{ matrix.flavor }}/aarch64-linux-android/release/ksud
+          if-no-files-found: warn
+
+      - name: Upload ksud (${{ matrix.flavor }} x86_64)
+        if: steps.gate.outputs.run == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: ksud-${{ matrix.flavor }}-x86_64-linux-android
+          path: /tmp/ksud-out-${{ matrix.flavor }}/x86_64-linux-android/release/ksud
+          if-no-files-found: warn
+
   # ── path B: build from source — mirror upstream exactly (clone + stock build reqs + key only) ──
   # Each flavor mirrors its upstream build-manager workflow 1:1. No extra gradle.properties edits,
   # no cargo LKM hacks — just checkout, write key (yours), setup Java/Gradle/SDK, spoof/randomizer if upstream does it, then ./gradlew.
   build-from-source:
-    if: ${{ inputs.build_from_source }}
+    needs: build-ksud-from-source
+    if: ${{ always() && inputs.build_from_source }}
     runs-on: ubuntu-latest
     timeout-minutes: 90
     strategy:
@@ -520,6 +666,45 @@ jobs:
         uses: android-actions/setup-android@v3
         # ReSukiSU/Next use v3/v4 — v3 is the common baseline
 
+      - name: Download ksud aarch64 (Next/pershoot, like upstream)
+        if: steps.gate.outputs.run == 'true' && (matrix.flavor == 'next' || matrix.flavor == 'next-susfs')
+        uses: actions/download-artifact@v7
+        with:
+          name: ksud-${{ matrix.flavor }}-aarch64-linux-android
+          path: /tmp/ksud-dl
+
+      - name: Download ksud x86_64 (Next/pershoot, like upstream)
+        if: steps.gate.outputs.run == 'true' && (matrix.flavor == 'next' || matrix.flavor == 'next-susfs')
+        uses: actions/download-artifact@v7
+        with:
+          name: ksud-${{ matrix.flavor }}-x86_64-linux-android
+          path: /tmp/ksud-dl
+
+      - name: Copy ksud to jniLibs (like upstream build-manager)
+        if: steps.gate.outputs.run == 'true' && (matrix.flavor == 'next' || matrix.flavor == 'next-susfs')
+        shell: bash
+        run: |
+          set -euo pipefail
+          dir="/tmp/${{ matrix.flavor }}-src/manager"
+          mkdir -p "$dir/app/src/main/jniLibs/arm64-v8a" "$dir/app/src/main/jniLibs/x86_64"
+          if [ -f /tmp/ksud-dl/ksud ]; then
+            echo "Single ksud artifact"
+            cp -f /tmp/ksud-dl/ksud "$dir/app/src/main/jniLibs/arm64-v8a/libksud.so" || true
+            cp -f /tmp/ksud-dl/ksud "$dir/app/src/main/jniLibs/x86_64/libksud.so" || true
+          fi
+          # flavor-specific layout from our upload
+          if [ -f /tmp/ksud-dl/aarch64-linux-android/release/ksud ]; then
+            cp -f /tmp/ksud-dl/aarch64-linux-android/release/ksud "$dir/app/src/main/jniLibs/arm64-v8a/libksud.so"
+          elif ls /tmp/ksud-dl/**/ksud 2>/dev/null | head -1; then
+            f=$(find /tmp/ksud-dl -name ksud | head -1)
+            echo "Found ksud at $f"
+            cp -f "$f" "$dir/app/src/main/jniLibs/arm64-v8a/libksud.so" || true
+          fi
+          if [ -f /tmp/ksud-dl/x86_64-linux-android/release/ksud ]; then
+            cp -f /tmp/ksud-dl/x86_64-linux-android/release/ksud "$dir/app/src/main/jniLibs/x86_64/libksud.so"
+          fi
+          ls -lh "$dir/app/src/main/jniLibs"/*/* 2>&1 | head -20 || echo "no jniLibs"
+
       - name: Spoof Package ID (Next only, like upstream build-manager-ci)
         if: steps.gate.outputs.run == 'true' && (matrix.flavor == 'next' || matrix.flavor == 'next-susfs')
         shell: bash