.github/actions/nomount/action.yml

@@ -57,6 +57,15 @@ runs:
             --output "$setup_script"
           test -s "$setup_script"
           chmod 0755 "$setup_script"
+          # Pre-clone at the exact SHA: upstream rewinds dev often, so a
+          # fresh clone may no longer contain the pinned tree ("unable to
+          # read tree"). Fetching by SHA works even for orphaned commits;
+          # setup.sh then reuses the clone and its checkout succeeds.
+          if [ ! -d "$KERNEL_DIR/NoMount" ]; then
+            git clone --no-checkout https://github.com/maxsteeel/nomount.git "$KERNEL_DIR/NoMount"
+          fi
+          git -C "$KERNEL_DIR/NoMount" fetch --depth=1 origin "$requested_commit"
+          git -C "$KERNEL_DIR/NoMount" checkout --detach --quiet "$requested_commit"
           (
             cd "$KERNEL_DIR"
             "$setup_script" "$requested_commit"

.github/workflows/build.yml

@@ -749,41 +749,32 @@ jobs:
             status: $status
           }' > "$metadata_file"
 
+        jq -e '
+          .status == "Build-verified only" and
+          (.root.manager | length > 0) and
+          (.root.version | length > 0) and
+          (.susfs_revision | test("^[0-9a-f]{40}$")) and
+          (.kernel_source_commit | test("^[0-9a-f]{40}$")) and
+          (.artifact_url | startswith("https://")) and
+          (.sha256 | test("^sha256:[0-9a-f]{64}$")) and
+          .catalog.availability == "eligible-with-provenance-and-checksums" and
+          .catalog.device_compatibility == "not-validated" and
+          .catalog.flashability == "not-guaranteed" and
+          .catalog.boot == "not-guaranteed"
+        ' "$metadata_file" > /dev/null
         if [ "$NOMOUNT_ENABLED" = "true" ]; then
           jq -e '
-            .status == "Build-verified only" and
-            (.root.manager | length > 0) and
-            (.root.version | length > 0) and
-            (.susfs_revision | test("^[0-9a-f]{40}$")) and
             (.nomount_commit | test("^[0-9a-f]{40}$")) and
-            (.kernel_source_commit | test("^[0-9a-f]{40}$")) and
-            (.artifact_url | startswith("https://")) and
-            (.sha256 | test("^sha256:[0-9a-f]{64}$")) and
             (.nomount_metamodule.commit == .nomount_commit) and
             (.nomount_metamodule.artifact_url | startswith("https://")) and
-            (.nomount_metamodule.sha256 | test("^sha256:[0-9a-f]{64}$")) and
-            .catalog.availability == "eligible-with-provenance-and-checksums" and
-            .catalog.device_compatibility == "not-validated" and
-            .catalog.flashability == "not-guaranteed" and
-            .catalog.boot == "not-guaranteed"
+            (.nomount_metamodule.sha256 | test("^sha256:[0-9a-f]{64}$"))
           ' "$metadata_file" > /dev/null
         else
           jq -e '
-            .status == "Build-verified only" and
-            (.root.manager | length > 0) and
-            (.root.version | length > 0) and
-            (.susfs_revision | test("^[0-9a-f]{40}$")) and
             (.nomount_commit == "N/A") and
-            (.kernel_source_commit | test("^[0-9a-f]{40}$")) and
-            (.artifact_url | startswith("https://")) and
-            (.sha256 | test("^sha256:[0-9a-f]{64}$")) and
             (.nomount_metamodule.commit == "N/A") and
             (.nomount_metamodule.artifact_url == "N/A") and
-            (.nomount_metamodule.sha256 == "N/A") and
-            .catalog.availability == "eligible-with-provenance-and-checksums" and
-            .catalog.device_compatibility == "not-validated" and
-            .catalog.flashability == "not-guaranteed" and
-            .catalog.boot == "not-guaranteed"
+            (.nomount_metamodule.sha256 == "N/A")
           ' "$metadata_file" > /dev/null
         fi
 

.github/workflows/main.yml

@@ -176,7 +176,7 @@ jobs:
           }
 
           # Audited pins (from root-variants.yml). Used only when commit_mode=verified.
-          PIN_NOMOUNT="09f3c41f068977d96ff8e552327428a307f8d286"
+          PIN_NOMOUNT="d0f57d5c37ff02aae2299daded57919153240cb3"
           PIN_KERNELSU="3c1240625655978f319a98398031100b80e9da7c"
           PIN_RESUKISU="3c1882886dbbb54f4aae7ddf205f8ccde32c2a34"
           declare -A PIN_SUSFS=(