name: Build-verified only GKI root variants

on:
  workflow_dispatch:
    inputs:
      kernel_build_version:
        description: "Supported GKI target"
        required: true
        type: choice
        options:
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
        default: android14-6.1
      os_patch_level:
        description: "Patch date (YYYY-MM), kernel sublevel, lts (builds the LTS branch), or all"
        required: true
        type: string
        default: lts
      commit_mode:
        description: "verified = audited pinned SHAs, latest = branch tips at run time"
        required: false
        type: choice
        options:
          - verified
          - latest
        default: verified

permissions:
  contents: read
  actions: write

jobs:
  resolve-pins:
    runs-on: ubuntu-latest
    outputs:
      config_file: ${{ steps.pins.outputs.config_file }}
      susfs_commit: ${{ steps.pins.outputs.susfs_commit }}
      nomount_commit: ${{ steps.pins.outputs.nomount_commit }}
      ksu_commit: ${{ steps.pins.outputs.ksu_commit }}
      next_commit: ${{ steps.pins.outputs.next_commit }}
      resukisu_commit: ${{ steps.pins.outputs.resukisu_commit }}
    steps:
      - id: pins
        shell: bash
        run: |
          set -euo pipefail
          # Verified pins. KernelSU-Next (next) is intentionally NOT pinned: it
          # always resolves at latest. SUSFS below uses the verified pinned SHA per
          # GKI target; build.yml overrides SUSFS to latest ONLY for the next
          # (KernelSU-Next) variant, keeping kernelsu/resukisu stuck on the pin.
          nomount_commit="26417ca5fb4021c4fd0c886e6ee8662d3f7b117a"
          ksu_commit="abc3fdcf5b6ec9e0add131e600d55853a0fffbf2"
          resukisu_commit="03b60f260cce36f23efbd26c9c334edfdc9ce7eb"
          case "${{ inputs.kernel_build_version }}" in
            android12-5.10) susfs_commit="44d9fed948b6d21c25ace142081418690f568dd3" ;;
            android13-5.10) susfs_commit="83ffa9f7a9039e233af3d47aeeb838278b23ef8c" ;;
            android13-5.15) susfs_commit="9623bd64ccb195dc538af70133ad3374f30de795" ;;
            android14-5.15) susfs_commit="fcfdf108e3003fe97a95bf6ed238eb13a93b4aba" ;;
            android14-6.1) susfs_commit="0ff932799d898366d57b3b5984d85cdbcfcfad0a" ;;
            android15-6.6) susfs_commit="7767a4614146d44f7a81a18b6e687dd8316fc959" ;;
            android16-6.12) susfs_commit="78a1f10a21df7271329fe5a733a3cb43c9c6c230" ;;
            *) echo "Unsupported GKI target." >&2; exit 2 ;;
          esac
          next_commit="$(git ls-remote https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev | cut -f1)"
          if [ "${{ inputs.commit_mode }}" = "latest" ]; then
            echo "Resolving latest branch tips..."
            nomount_commit="$(git ls-remote https://github.com/maxsteeel/nomount.git refs/heads/dev | cut -f1)"
            ksu_commit="$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | cut -f1)"
            resukisu_commit="$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | cut -f1)"
            susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
          fi
          echo "config_file=.github/config/${{ inputs.kernel_build_version }}.json" >> "$GITHUB_OUTPUT"
          echo "susfs_commit=$susfs_commit" >> "$GITHUB_OUTPUT"
          echo "nomount_commit=$nomount_commit" >> "$GITHUB_OUTPUT"
          echo "ksu_commit=$ksu_commit" >> "$GITHUB_OUTPUT"
          echo "next_commit=$next_commit" >> "$GITHUB_OUTPUT"
          echo "resukisu_commit=$resukisu_commit" >> "$GITHUB_OUTPUT"

  build-nomount-module:
    needs: resolve-pins
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Build NoMount metamodule
        id: nomount-metamodule
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ needs.resolve-pins.outputs.nomount_commit }}

      - name: Upload NoMount metamodule
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.nomount-metamodule.outputs.module_dir }}
          if-no-files-found: error

  build:
    needs: [resolve-pins, build-nomount-module]
    strategy:
      fail-fast: false
      matrix:
        include:
          - flavor: kernelsu
            commit: ${{ needs.resolve-pins.outputs.ksu_commit }}
            variant: KernelSU
          - flavor: next
            commit: ${{ needs.resolve-pins.outputs.next_commit }}
            variant: KernelSU-Next
          - flavor: resukisu
            commit: ${{ needs.resolve-pins.outputs.resukisu_commit }}
            variant: ReSukiSU
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: ${{ needs.resolve-pins.outputs.config_file }}
      feature_set: SUSFS+NTSync+Ptrace+Unicode+BPF
      susfs_commit: ${{ needs.resolve-pins.outputs.susfs_commit }}
      root_flavor: ${{ matrix.flavor }}
      root_commit: ${{ matrix.commit }}
      nomount_commit: ${{ needs.resolve-pins.outputs.nomount_commit }}
      preserve_abi: true
      build_bypass: false
      os_patch_level: ${{ inputs.os_patch_level }}
      variant: ${{ matrix.variant }}
    secrets: inherit