name: Build Kernels permissions: contents: write actions: write on: workflow_dispatch: inputs: release_type: description: "Release Type" type: choice options: - Action - Pre-Release - Release default: Pre-Release kernel_build_version: description: "Kernel Version" type: choice options: - All - android12-5.10 - android13-5.10 - android13-5.15 - android14-5.15 - android14-6.1 - android15-6.6 - android16-6.12 default: All os_patch_level: description: "Patch date (YYYY-MM), kernel sublevel, lts, or All (no filter)" required: true type: string default: All brand_name: description: "Kernel Branding" type: string default: Wild commit_mode: description: "latest = branch tips, verified = audited pins, update = build latest then promote verified pins on success" required: false type: choice options: - latest - verified - update default: verified root_flavor: description: "Root Flavor" type: choice options: - KernelSU-Next - KernelSU - ReSukiSU - All default: All use_susfs: description: "SUSFS" type: boolean default: true use_nomount: description: "NoMount" type: boolean default: true use_bbg: description: "Baseband Guard" type: boolean default: true use_net: description: "Networking" type: boolean default: true use_ds: description: "DroidSpaces" type: boolean default: true use_ntsync: description: "NTSync" type: boolean default: true use_ptrace: description: "Ptrace Patch" type: boolean default: true use_unicode: description: "Unicode Fix" type: boolean default: true use_bpf: description: "BPF Stack (BTF + eBPF + FUSE-BPF)" type: boolean default: true use_perf: description: "Performance" type: boolean default: false bypass: description: "Apply kernel version-check bypass hack" type: boolean default: false use_cache: description: "Use ccache/bazel cache (restore/save)" type: boolean default: true jobs: resolve-sources: runs-on: ubuntu-latest outputs: nomount_commit: ${{ steps.resolve.outputs.nomount_commit }} kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }} kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }} root_flavor: ${{ steps.resolve.outputs.root_flavor }} root_commit: ${{ steps.resolve.outputs.root_commit }} root_matrix: ${{ steps.resolve.outputs.root_matrix }} susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }} susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }} susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }} susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }} susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }} susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }} susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }} susfs_commit_android12_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android12_5_10_resukisu }} susfs_commit_android13_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_10_resukisu }} susfs_commit_android13_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_15_resukisu }} susfs_commit_android14_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_5_15_resukisu }} susfs_commit_android14_6_1_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_6_1_resukisu }} susfs_commit_android15_6_6_resukisu: ${{ steps.resolve.outputs.susfs_commit_android15_6_6_resukisu }} susfs_commit_android16_6_12_resukisu: ${{ steps.resolve.outputs.susfs_commit_android16_6_12_resukisu }} ksu_commit: ${{ steps.resolve.outputs.ksu_commit }} resukisu_commit: ${{ steps.resolve.outputs.resukisu_commit }} kernel_patches_commit: ${{ steps.resolve.outputs.kernel_patches_commit }} anykernel3_commit: ${{ steps.resolve.outputs.anykernel3_commit }} droidspaces_commit: ${{ steps.resolve.outputs.droidspaces_commit }} feature_set: ${{ steps.features.outputs.feature_set }} manager_list: ${{ steps.manager.outputs.manager_list }} steps: - name: Resolve latest component commits id: resolve shell: bash run: | set -euo pipefail # Commit resolution mode. 'latest' (default) resolves branch tips at # run time via git ls-remote. 'verified' uses the audited pins below for # NoMount, kernelsu/resukisu roots, and SUSFS; KernelSU-Next stays latest. COMMIT_MODE="${{ inputs.commit_mode }}" echo "commit_mode=${COMMIT_MODE}" retry() { local n=0 until [ "$n" -ge 5 ]; do "$@" && return 0 n=$((n+1)) echo "retry $n/5 failed for: $*" >&2 sleep 5 done return 1 } resolve_sha() { # repo ref retry git ls-remote "$1" "$2" | awk '{print $1; exit}' } emit() { # key value if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then echo "Failed to resolve $1 (got: ${2:-empty})" >&2 exit 1 fi echo "$1=$2" >> "$GITHUB_OUTPUT" } # Audited pins (from root-variants.yml). Used only when commit_mode=verified. PIN_NOMOUNT="9a1431782f390453de54610fb91bdad03eab5b43" PIN_KERNELSU="e38512f1255ea454d34cc2008d2ef7932547fad6" PIN_RESUKISU="0b5efe9e0102c43ca5c41174d500f5a7080cd0c7" declare -A PIN_SUSFS=( [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017" [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c" [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005" [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889" [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70" [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0" [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0" ) # ReSukiSU keeps its own SUSFS pin set (currently the shared values, # including 6.1 = 0ff93279). KernelSU's set above already diverges on 6.1. declare -A PIN_SUSFS_RESUKISU=( [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017" [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c" [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005" [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889" [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70" [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0" [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0" ) pick() { # pinned repo ref -> pinned when verified, else latest local pinned="$1" repo="$2" ref="$3" if [ "$COMMIT_MODE" = "verified" ] && [ -n "$pinned" ]; then echo "$pinned" else resolve_sha "$repo" "$ref" fi } # NoMount (pinned in verified mode, else dev tip) emit nomount_commit "$(pick "$PIN_NOMOUNT" https://github.com/maxsteeel/nomount.git refs/heads/dev)" # KernelSU-Next manager - always built from the official repo's dev branch. # pershoot's fork is used only for the kernel SUSFS integration (root_commit below), # never for the manager. Manager always builds at latest. emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)" echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT" # Selected root implementation(s). Maps the human-facing choice # (KernelSU-Next / KernelSU / ReSukiSU / All) to internal root-setup # flavors (next / kernelsu / resukisu). Every build always has a root; # 'All' emits a matrix of all three root flavors plus each pinned commit. # # kernelsu and resukisu pin in verified mode; KernelSU-Next (next) always # builds at latest. KERNELSU_COMMIT="$(pick "$PIN_KERNELSU" https://github.com/tiann/KernelSU.git refs/heads/main)" RESUKISU_COMMIT="$(pick "$PIN_RESUKISU" https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)" emit ksu_commit "$KERNELSU_COMMIT" emit resukisu_commit "$RESUKISU_COMMIT" if [ "${{ inputs.use_susfs }}" = "true" ]; then NEXT_COMMIT="$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)" else NEXT_COMMIT="$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)" fi mk_entry() { # flavor variant commit printf '{"root_flavor":"%s","variant":"%s","root_commit":"%s"}' "$1" "$2" "$3" } case "${{ inputs.root_flavor }}" in KernelSU) echo "root_flavor=kernelsu" >> "$GITHUB_OUTPUT" emit root_commit "$KERNELSU_COMMIT" ROOT_MATRIX="[$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT")]" ;; KernelSU-Next) echo "root_flavor=next" >> "$GITHUB_OUTPUT" emit root_commit "$NEXT_COMMIT" ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT")]" ;; ReSukiSU) echo "root_flavor=resukisu" >> "$GITHUB_OUTPUT" emit root_commit "$RESUKISU_COMMIT" ROOT_MATRIX="[$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]" ;; All) # Fan out to all three root variants, each with its pinned commit. ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT"),$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT"),$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]" echo "root_flavor=" >> "$GITHUB_OUTPUT" echo "root_commit=" >> "$GITHUB_OUTPUT" ;; *) echo "ERROR: unknown root_flavor '${{ inputs.root_flavor }}'" >&2 exit 1 ;; esac echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT" # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu). # Always emit the verified pinned SHA here; build.yml overrides to the # latest branch tip per-variant when the root flavor is KernelSU-Next. declare -A SUSFS_BRANCHES=( [susfs_commit_android12_5_10]="gki-android12-5.10" [susfs_commit_android13_5_10]="gki-android13-5.10" [susfs_commit_android13_5_15]="gki-android13-5.15" [susfs_commit_android14_5_15]="gki-android14-5.15" [susfs_commit_android14_6_1]="gki-android14-6.1" [susfs_commit_android15_6_6]="gki-android15-6.6" [susfs_commit_android16_6_12]="gki-android16-6.12" ) for key in "${!SUSFS_BRANCHES[@]}"; do emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})" # Per-flavor ReSukiSU SUSFS pin (same branch, own pin set). emit "${key}_resukisu" "$(pick "${PIN_SUSFS_RESUKISU[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})" done # Tracked build helpers (resolved automatically, before the run) emit kernel_patches_commit "$(resolve_sha https://github.com/WildKernels/kernel_patches.git refs/heads/main)" emit anykernel3_commit "$(resolve_sha https://github.com/WildKernels/AnyKernel3.git refs/heads/gki-2.0)" emit droidspaces_commit "$(resolve_sha https://github.com/ravindu644/Droidspaces-OSS.git refs/heads/main)" echo "Resolved:" env | grep -E '^(nomount_commit|kernelsu_commit|kernelsu_branch|root_commit|susfs_commit_|kernel_patches_commit|anykernel3_commit|droidspaces_commit)' | sort || true - name: Resolve manager builds for selected root flavor(s) id: manager shell: bash run: | set -euo pipefail # Each selected root must ship ALL manager APK builds. KernelSU-Next publishes # its manager APKs (manager + manager-spoofed) from the official dev-tip # build-manager-ci run; kernelsu (KernelSU) and ReSukiSU expose theirs as # CI-run artifacts. All three are pinned to an exact commit. resolve_one() { # flavor local flavor="$1" local owner repo wf stock case "$flavor" in next) owner="KernelSU-Next"; repo="KernelSU-Next"; wf="build-manager-ci.yml" # Manager is built from the official dev-tip commit (grabbed at run start). stock="${{ steps.resolve.outputs.kernelsu_commit }}" run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ -H "Authorization: Bearer ${{ github.token }}" \ "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \ | jq -r '.workflow_runs[0].id // empty') if [[ -z "${run_id}" ]]; then echo "ERROR: no ${repo} manager build exists for dev commit ${stock}" >&2 exit 1 fi printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager,manager-spoofed"}' \ "$flavor" "$owner" "$repo" "$run_id" "$stock" ;; kernelsu) owner="tiann"; repo="KernelSU"; wf="build-manager.yml" stock=$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | awk '{print $1; exit}') run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \ | jq -r '.workflow_runs[0].id // empty') if [[ -z "${run_id}" ]]; then echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2 exit 1 fi printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager"}' \ "$flavor" "$owner" "$repo" "$run_id" "$stock" ;; resukisu) owner="ReSukiSU"; repo="ReSukiSU"; wf="build-manager.yml" stock=$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | awk '{print $1; exit}') run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \ | jq -r '.workflow_runs[0].id // empty') if [[ -z "${run_id}" ]]; then echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2 exit 1 fi printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"Manager-release,Spoofed-Manager-release,Manager-debug"}' \ "$flavor" "$owner" "$repo" "$run_id" "$stock" ;; *) echo "skipping unknown flavor: $flavor" >&2 return 0 ;; esac } FLAVORS="${{ inputs.root_flavor }}" echo "Root flavor: ${FLAVORS}" LIST="" case "${FLAVORS}" in All) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)"$'\n'"$(resolve_one kernelsu)"$'\n'"$(resolve_one resukisu)") ;; KernelSU-Next) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)") ;; KernelSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one kernelsu)") ;; ReSukiSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one resukisu)") ;; *) echo "Skipping manager resolution (no root flavor / none)." ;; esac if [ -n "$LIST" ]; then echo "manager_list=$LIST" >> "$GITHUB_OUTPUT" echo "Manager sources resolved." else echo "manager_list=[]" >> "$GITHUB_OUTPUT" fi - name: Compose requested feature set id: features shell: bash run: | set -euo pipefail # Every build always has a root implementation (no 'none' option), so # SUSFS always has a root to hook into -- no extra guard needed. # A Release/Pre-Release ships whichever manger build(s) were resolved # in the manager step above (exact match per root flavor). No root # restriction applies here anymore -- KernelSU-Next, KernelSU, ReSukiSU, # or 'All' are all valid release targets. FEATURES="" [ "${{ inputs.use_susfs }}" = "true" ] && FEATURES="${FEATURES}SUSFS+" [ "${{ inputs.use_nomount }}" = "true" ] && FEATURES="${FEATURES}NoMount+" [ "${{ inputs.use_bbg }}" = "true" ] && FEATURES="${FEATURES}BBG+" [ "${{ inputs.use_net }}" = "true" ] && FEATURES="${FEATURES}NET+" [ "${{ inputs.use_ds }}" = "true" ] && FEATURES="${FEATURES}DS+" [ "${{ inputs.use_ntsync }}" = "true" ] && FEATURES="${FEATURES}NTSync+" [ "${{ inputs.use_ptrace }}" = "true" ] && FEATURES="${FEATURES}Ptrace+" [ "${{ inputs.use_unicode }}" = "true" ] && FEATURES="${FEATURES}Unicode+" [ "${{ inputs.use_bpf }}" = "true" ] && FEATURES="${FEATURES}BPF+" [ "${{ inputs.use_perf }}" = "true" ] && FEATURES="${FEATURES}Perf+" echo "feature_set=${FEATURES%+}" >> "$GITHUB_OUTPUT" - name: Clone shared source repos once if: inputs.use_nomount shell: bash run: | set -euo pipefail mkdir -p sources # NoMount kernel sources at the resolved commit (pinned or dev tip) git clone --no-checkout https://github.com/maxsteeel/nomount.git sources/nomount git -C sources/nomount fetch --depth=1 origin "${{ steps.resolve.outputs.nomount_commit }}" git -C sources/nomount checkout --detach "${{ steps.resolve.outputs.nomount_commit }}" [ "$(git -C sources/nomount rev-parse HEAD)" = "${{ steps.resolve.outputs.nomount_commit }}" ] || \ { echo "NoMount clone HEAD mismatch" >&2; exit 1; } list-manager-apks: needs: resolve-sources if: needs.resolve-sources.outputs.manager_list != '' runs-on: ubuntu-latest outputs: apk_list: ${{ steps.scan.outputs.apk_list }} steps: - uses: actions/checkout@v7 - name: Download and scan all manager APKs id: scan shell: bash env: MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }} GH_TOKEN: ${{ github.token }} run: | set -euo pipefail MANAGER_LIST=$(echo "$MANAGER_LIST" | sed 's/^\[,/[/') if ! echo "$MANAGER_LIST" | jq empty 2>/dev/null; then echo "ERROR: Invalid MANAGER_LIST JSON" echo "Raw: $MANAGER_LIST" exit 0 fi OUT_APKS="${GITHUB_WORKSPACE:-$PWD}/manager_apks" MANIFEST="${GITHUB_WORKSPACE:-$PWD}/manifest.txt" rm -rf "$OUT_APKS" "$MANIFEST" mkdir -p "$OUT_APKS" : > "$MANIFEST" echo "$MANAGER_LIST" | jq -c '.[]' | while read -r M; do OWNER=$(echo "$M" | jq -r .owner) REPO=$(echo "$M" | jq -r .repo) SRC=$(echo "$M" | jq -r .source) RUN_ID=$(echo "$M" | jq -r .run_id) WANT=$(echo "$M" | jq -r '.want // ""') DLDIR="dl_${REPO}" mkdir -p "$DLDIR" ( cd "$DLDIR" if [ "$SRC" = "release" ]; then curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" > rel.json for URL in $(jq -r '.assets[] | select(.name | endswith(".apk")) | .browser_download_url' rel.json); do NAME="${URL##*/}" curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$NAME" "$URL" cp -f "$NAME" "$OUT_APKS/$NAME" echo "$OWNER|$REPO|$NAME" >> "$MANIFEST" done else AJSON=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ -H "Authorization: Bearer ${GH_TOKEN}" \ "https://api.github.com/repos/${OWNER}/${REPO}/actions/runs/${RUN_ID}/artifacts") if [ -z "$WANT" ]; then ART_IDS=$(echo "$AJSON" | jq -r '.artifacts[].id') else ART_IDS=$(echo "$AJSON" | jq -r --arg want "$WANT" ' ($want | split(",")) as $wl | .artifacts[] | select(.name as $n | any($wl[]; $n == .)) | .id') fi echo "$ART_IDS" | while read -r AID; do [ -n "$AID" ] || continue curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \ -H "Authorization: Bearer ${GH_TOKEN}" \ -o "_${AID}.zip" \ "https://api.github.com/repos/${OWNER}/${REPO}/actions/artifacts/${AID}/zip" mkdir -p "_${AID}" unzip -o -q "_${AID}.zip" -d "_${AID}" || true rm -f "_${AID}.zip" for apk in _${AID}/*.apk; do [ -f "$apk" ] || continue NAME="$(basename "$apk")" cp -f "$apk" "$OUT_APKS/$NAME" echo "$OWNER|$REPO|$NAME" >> "$MANIFEST" done rm -rf "_${AID}" done fi ) done # Build the flat apk list from the manifest (single source of truth) APK_JSON="[]" while IFS='|' read -r o r n; do [ -n "$n" ] || continue APK_JSON=$(echo "$APK_JSON" | jq -c --arg o "$o" --arg r "$r" --arg n "$n" \ '. + [{owner:$o,repo:$r,apk:$n}]') done < "$MANIFEST" echo "apk_list=${APK_JSON}" >> "$GITHUB_OUTPUT" echo "Found $(wc -l < "$MANIFEST") manager APKs" ls -1 "$OUT_APKS" - name: Upload all manager APKs as one cross-blob uses: actions/upload-artifact@v7 with: name: manager-apks path: manager_apks/ if-no-files-found: warn publish-manager-artifacts: needs: list-manager-apks if: needs.list-manager-apks.outputs.apk_list != '' runs-on: ubuntu-latest strategy: fail-fast: false matrix: item: ${{ fromJson(needs.list-manager-apks.outputs.apk_list) }} steps: - uses: actions/checkout@v7 - name: Download manager cross-blob uses: actions/download-artifact@v7 with: name: manager-apks path: manager_apks merge-multiple: true - name: Upload ${{ matrix.item.apk }} as its own artifact uses: actions/upload-artifact@v7 with: name: manager-apk-${{ matrix.item.apk }} path: manager_apks/${{ matrix.item.apk }} if-no-files-found: error build-nomount-module: needs: resolve-sources runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 if: inputs.use_nomount - name: Clone NoMount source at pinned commit id: clone if: inputs.use_nomount shell: bash run: | set -euo pipefail COMMIT="${{ needs.resolve-sources.outputs.nomount_commit }}" if ! [[ "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then echo "NoMount commit must be a full 40-character SHA." >&2 exit 2 fi echo "NoMount commit: ${COMMIT}" echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT" - name: Build NoMount metamodule (nm only, no .ko) if: inputs.use_nomount id: buildmod uses: ./.github/actions/nomount-metamodule with: commit: ${{ steps.clone.outputs.commit }} - name: Upload NoMount metamodule if: inputs.use_nomount uses: actions/upload-artifact@v7 with: name: NoMount-Metamodule path: ${{ steps.buildmod.outputs.module_dir }} if-no-files-found: error compression-level: 0 build-android12-5-10: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android12-5.10')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android12-5.10.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android12_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android12_5_10 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android13-5-10: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.10')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android13-5.10.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_10 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android13-5-15: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.15')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android13-5.15.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_15 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android14-5-15: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-5.15')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android14-5.15.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_5_15 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android14-6-1: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-6.1')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android14-6.1.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_6_1 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android15-6-6: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android15-6.6')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android15-6.6.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android15_6_6_resukisu || needs.resolve-sources.outputs.susfs_commit_android15_6_6 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit build-android16-6-12: needs: - resolve-sources - build-nomount-module - publish-manager-artifacts if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android16-6.12')" strategy: fail-fast: false matrix: root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }} uses: ./.github/workflows/prepare.yml with: config_file: .github/config/android16-6.12.json feature_set: ${{ needs.resolve-sources.outputs.feature_set }} susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android16_6_12_resukisu || needs.resolve-sources.outputs.susfs_commit_android16_6_12 }} nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }} kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }} root_flavor: ${{ matrix.root.root_flavor }} root_commit: ${{ matrix.root.root_commit }} variant: ${{ matrix.root.variant }} ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }} anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }} droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }} brand_name: ${{ inputs.brand_name }} os_patch_level: ${{ inputs.os_patch_level }} bypass: ${{ inputs.bypass }} use_cache: ${{ inputs.use_cache }} secrets: inherit update-verified-pins: if: "!inputs.test_release_notes && inputs.commit_mode == 'update'" runs-on: ubuntu-latest permissions: actions: read contents: write needs: - resolve-sources - build-android12-5-10 - build-android13-5-10 - build-android13-5-15 - build-android14-5-15 - build-android14-6-1 - build-android15-6-6 - build-android16-6-12 steps: - uses: actions/checkout@v7 with: ref: ${{ github.ref }} token: ${{ github.token }} - name: Promote verified pins on success id: promote shell: bash run: | set -euo pipefail python3 .github/scripts/update_verified_pins.py env: GH_TOKEN: ${{ github.token }} NOMOUNT_SHA: ${{ needs.resolve-sources.outputs.nomount_commit }} KERNELSU_SHA: ${{ needs.resolve-sources.outputs.ksu_commit }} RESUKISU_SHA: ${{ needs.resolve-sources.outputs.resukisu_commit }} APPROVE_NOMOUNT: ${{ inputs.use_nomount }} APPROVE_KERNELSU: ${{ (inputs.root_flavor == 'KernelSU' || inputs.root_flavor == 'All') }} APPROVE_RESUKISU: ${{ (inputs.root_flavor == 'ReSukiSU' || inputs.root_flavor == 'All') }} - name: Commit promoted pins if: always() && steps.promote.conclusion == 'success' shell: bash run: | set -euo pipefail git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" STAMP="$(date -u +%Y-%m-%dT%H%M%SZ)" git add .github/workflows/main.yml .github/pins/history if git diff --cached --quiet; then echo "No pin changes to commit." exit 0 fi git commit -m "chore(pins): promote verified commits to latest built (${STAMP})" git push rej: if: "!inputs.test_release_notes && always()" runs-on: ubuntu-latest permissions: actions: read contents: read needs: - build-android12-5-10 - build-android13-5-10 - build-android13-5-15 - build-android14-5-15 - build-android14-6-1 - build-android15-6-6 - build-android16-6-12 steps: - name: Download Misc Artifacts uses: actions/download-artifact@v7 with: path: ./downloaded-artifacts pattern: '*-Rejects' merge-multiple: false - name: Process Reject Artifacts run: | mkdir -p aio-rejects # Iterate over Rejects artifacts in downloaded-artifacts for dir in ./downloaded-artifacts/*-Rejects; do [ -d "$dir" ] || continue dirname=$(basename "$dir") original_name=${dirname%-Rejects} source_dir="$dir" if [ -d "$dir/patch-rejects" ]; then source_dir="$dir/patch-rejects" fi mapfile -t rej_files < <(find "$source_dir" -type f -name '*.rej' | sort) filtered_rej_files=() for rej_file in "${rej_files[@]}"; do rel_rej="${rej_file#${source_dir}/}" rel_name="$(basename "$rel_rej")" if [ "$rel_rej" = "common/mm/rmap.c.rej" ] || [ "$rel_name" = "i2c-nomadik.c.rej" ]; then echo "Skipping $rel_rej because it is an ignored reject file" continue fi filtered_rej_files+=("$rej_file") done if [ "${#filtered_rej_files[@]}" -eq 0 ]; then echo "Skipping $dirname because it only contains ignored reject files" continue fi mkdir -p "aio-rejects/$original_name" if [ -d "$dir/patch-rejects" ]; then cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/" else cp -r "$dir/." "aio-rejects/$original_name/" fi find "aio-rejects/$original_name" -type f -name 'i2c-nomadik.c.rej' -delete done if [ "$(ls -A aio-rejects)" ]; then cd aio-rejects zip -r -q -9 ../AIO-REJ.zip . cd .. else echo "No rejects found to upload." fi - name: Rejects Summary run: | echo "Reject artifacts were collected locally only and are not uploaded." >> "$GITHUB_STEP_SUMMARY" - name: Upload AIO-REJ Artifact uses: actions/upload-artifact@v7 with: name: AIO-REJ path: AIO-REJ.zip if-no-files-found: ignore release: runs-on: ubuntu-latest if: always() && github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.release_type == 'Pre-Release' || inputs.release_type == 'Release') permissions: contents: write needs: - build-android12-5-10 - build-android13-5-10 - build-android13-5-15 - build-android14-5-15 - build-android14-6-1 - build-android15-6-6 - build-android16-6-12 - build-nomount-module - publish-manager-artifacts env: GH_TOKEN: ${{ github.token }} outputs: new_tag: ${{ steps.tag.outputs.new_tag }} steps: - name: Validate Selected Builds run: | set -euo pipefail failed=0 current_type="${{ inputs.kernel_build_version }}" check_selected() { local target="$1" local job_name="$2" local result="$3" if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then if [[ "$result" != "success" ]]; then echo "Required job $job_name did not succeed (result: $result)" failed=1 fi fi } check_selected "android12-5.10" "build-android12-5-10" "${{ needs.build-android12-5-10.result }}" check_selected "android13-5.10" "build-android13-5-10" "${{ needs.build-android13-5-10.result }}" check_selected "android13-5.15" "build-android13-5-15" "${{ needs.build-android13-5-15.result }}" check_selected "android14-5.15" "build-android14-5-15" "${{ needs.build-android14-5-15.result }}" check_selected "android14-6.1" "build-android14-6-1" "${{ needs.build-android14-6-1.result }}" check_selected "android15-6.6" "build-android15-6-6" "${{ needs.build-android15-6-6.result }}" check_selected "android16-6.12" "build-android16-6-12" "${{ needs.build-android16-6-12.result }}" if [[ "$failed" -ne 0 ]]; then exit 1 fi - name: Free Disk Space if: true uses: endersonmenezes/free-disk-space@v3 # Use @main for latest, @v3 for stable with: remove_android: true remove_dotnet: true remove_haskell: true remove_tool_cache: true remove_swap: true remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*" remove_packages_one_command: true remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle" rm_cmd: "rmz" # Use 'rmz' for faster deletion (default: 'rm') rmz_version: "3.1.1" # Required when rm_cmd is 'rmz' testing: false - name: Checkout code uses: actions/checkout@v7 - name: Generate New Tag id: tag if: inputs.release_type != 'Action' run: | mapfile -t RELEASE_TAGS < <(gh api --paginate "repos/${{ github.repository }}/tags?per_page=100" --jq '.[].name' 2>/dev/null | grep -E '^r[0-9]+$' || true) LATEST_REV=0 for TAG in "${RELEASE_TAGS[@]}"; do REV="${TAG#r}" if [[ "$REV" =~ ^[0-9]+$ && "$REV" -gt "$LATEST_REV" ]]; then LATEST_REV="$REV" fi done if [[ "$LATEST_REV" -gt 0 ]]; then NEW_TAG="r$((LATEST_REV + 1))" else NEW_TAG="r1" fi if [[ ${#RELEASE_TAGS[@]} -gt 0 ]]; then echo "Latest r-tag: r${LATEST_REV}" else echo "No existing r-tags found; starting at r1" fi echo "New tag: $NEW_TAG" echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT - name: Set Release Title id: release_meta run: | set -euo pipefail # Format release title: convert rN -> Release N if [[ "${NEW_TAG}" =~ ^r([0-9]+)$ ]]; then REV_NUM="${BASH_REMATCH[1]}" release_title="Release ${REV_NUM}" else release_title="Release ${NEW_TAG}" fi echo "release_title=$release_title" >> "$GITHUB_OUTPUT" - name: Extract KernelSU Version Info id: ksu_version run: | set -euo pipefail KSU_REPO="https://github.com/pershoot/KernelSU-Next.git" KSU_INPUT="dev-susfs" # Try as branch first, fall back to commit if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then echo "Cloning KernelSU-Next from branch: $KSU_INPUT" git clone --branch "$KSU_INPUT" "$KSU_REPO" /tmp/kernelsu-next cd /tmp/kernelsu-next KSUN_COMMIT=$(git rev-parse HEAD) else echo "Cloning KernelSU-Next from dev-susfs branch, then checking out commit: $KSU_INPUT" git clone --branch dev-susfs "$KSU_REPO" /tmp/kernelsu-next cd /tmp/kernelsu-next git fetch --depth=50 origin "$KSU_INPUT" git checkout "$KSU_INPUT" KSUN_COMMIT="$KSU_INPUT" fi # The manager is built on the OFFICIAL KernelSU-Next repo # (pershoot's workflows are all disabled). Find the official dev # commit this fork's branch is synced with (merge-base of our # branch vs official dev), then link the manager build run for # that commit. pershoot's own dev branch is intentionally ignored. retry() { local n=0 until [ "$n" -ge 5 ]; do "$@" && return 0 n=$((n+1)) echo "retry $n/5 failed for: $*" >&2 sleep 5 done return 1 } OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git" retry git fetch "$OFFICIAL_KSU_REPO" dev STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD) echo "KSU Stock Commit (official sync point): $STOCK_COMMIT" # Extract version info - anchored to the official sync point # (STOCK_COMMIT), i.e. the commit the linked manager is built from. # Mirrors pershoot c0a2c5fd: count the merge-base with origin, not # the fork's extra commits, so the version shown in the release # notes matches what the kernel reports and the manager displays. COMMITS_COUNT=$(git rev-list --count "$STOCK_COMMIT") BASE_VERSION=30000 KSU_VERSION=$(expr $COMMITS_COUNT "+" $BASE_VERSION) # Extract git tag at the sync point KSU_GIT_TAG=$(git describe --tags --abbrev=0 "$STOCK_COMMIT" 2>/dev/null || echo "no-tag") MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" | jq -r '.workflow_runs[0].id // empty') if [[ -n "${MANAGER_RUN_ID:-}" ]]; then KSU_MANAGER="https://github.com/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}" KSU_MANAGER_NOTE="built from stock dev commit ${STOCK_COMMIT:0:12} (exact match)" else # Validated up-front in resolve-sources; a release cannot proceed without # the exact manager run. Fail rather than link a mismatched manager. echo "ERROR: exact manager build no longer available for ${STOCK_COMMIT}" >&2 exit 1 fi echo "Commits count: $COMMITS_COUNT" echo "KSU Version: $KSU_VERSION" echo "KSU Git Tag: $KSU_GIT_TAG" echo "KSU Manager: $KSU_MANAGER" # Export as environment for next step echo "KSUN_BRANCH=$KSU_INPUT" >> $GITHUB_ENV echo "KSUN_COMMIT=$KSUN_COMMIT" >> $GITHUB_ENV echo "KSU_COMMITS_COUNT=$COMMITS_COUNT" >> $GITHUB_ENV echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV echo "KSU_MANAGER=$KSU_MANAGER" >> $GITHUB_ENV echo "KSU_MANAGER_NOTE=${KSU_MANAGER_NOTE:-}" >> $GITHUB_ENV echo "MANAGER_RUN_ID=$MANAGER_RUN_ID" >> $GITHUB_ENV - name: Set release body env: ROOT_FLAVOR: ${{ inputs.root_flavor }} FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }} MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }} USE_SUSFS: ${{ inputs.use_susfs }} USE_BBG: ${{ inputs.use_bbg }} USE_DS: ${{ inputs.use_ds }} USE_NET: ${{ inputs.use_net }} USE_NTSYNC: ${{ inputs.use_ntsync }} USE_PTRACE: ${{ inputs.use_ptrace }} USE_UNICODE: ${{ inputs.use_unicode }} USE_BPF: ${{ inputs.use_bpf }} run: | set -e : > release_body.md python3 - <<'PYEOF' > release_body.md import json import os from pathlib import Path def env(name, default=""): return os.environ.get(name, default).strip() def parse_managers(raw): raw = raw.strip() if not raw: return [] try: data = json.loads(raw) except json.JSONDecodeError: return [] return data if isinstance(data, list) else [] def build_preamble(): return ( "# Wild Kernels for GKI2 Devices\n\n" "> [!CAUTION]\n" "> This software is provided for testing and educational purposes only. " "Use at your own risk. The developers are not responsible for any damage, " "data loss, or issues that may occur. Please ensure you have proper backups " "before installation.\n\n" "Join the Telegram group: \n\n" "---\n\n" ) def build_managers_section(managers): if not managers: return "" flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"} lines = [] for m in managers: flavor = m.get("flavor", "") label = flavor_labels.get(flavor, flavor or "unknown") run_id = m.get("run_id") stock = m.get("stock", "") if run_id: url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}" stock_note = f" (stock `{stock[:12]}`)" if stock else "" lines.append(f"- **{label}:** [{url}]({url}){stock_note}") else: lines.append(f"- **{label}:** release assets") return "**Managers:**\n" + "\n".join(lines) + "\n" def build_ksu_section(): version = env("KSU_VERSION", "unknown") tag = env("KSU_GIT_TAG", "no-tag") branch = env("KSUN_BRANCH", "dev") commit = env("KSUN_COMMIT", "unknown") manager_url = env("KSU_MANAGER", "") manager_note = env("KSU_MANAGER_NOTE", "") parts = ["## KernelSU", ""] parts.append(f"- **Version:** `{version}`") if tag and tag != "no-tag": parts.append(f"- **Tag:** `{tag}`") parts.append(f"- **Branch:** `{branch}`") parts.append(f"- **Commit:** `{commit}`") if manager_url: note = f" - {manager_note}" if manager_note else "" base = manager_url.split("/actions/")[0] parts.append(f"- **Manager:** [{base}]({manager_url}){note}") parts.append("") return "\n".join(parts) def build_susfs_section(): variant_envs = [ ("android12-5.10", "susfs_commit_android12_5_10"), ("android13-5.10", "susfs_commit_android13_5_10"), ("android13-5.15", "susfs_commit_android13_5_15"), ("android14-5.15", "susfs_commit_android14_5_15"), ("android14-6.1", "susfs_commit_android14_6_1"), ("android15-6.6", "susfs_commit_android15_6_6"), ("android16-6.12", "susfs_commit_android16_6_12"), ] per_variant = [] for variant, env_key in variant_envs: sha = env(env_key) if sha and len(sha) == 40: per_variant.append((variant, sha)) if per_variant: parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""] for variant, sha in per_variant: parts.append(f"- **{variant}:** `{sha}`") parts.append("") return "\n".join(parts) sha = env("SUSFS_COMMIT", "") if sha: return f"## SUSFS\n\n- **Commit:** `{sha}`\n" return "" def build_root_section(): root_flavor = env("ROOT_FLAVOR", "unknown") feature_set = env("FEATURE_SET", "") parts = ["## This Build", ""] parts.append(f"- **Root:** `{root_flavor}`") if feature_set: parts.append(f"- **Feature Set:** `{feature_set}`") parts.append("") return "\n".join(parts) def build_features_section(): enabled = [] if env("USE_SUSFS", "true") == "true": enabled.append("SUSFS") if env("USE_BBG", "true") == "true": enabled.append("Baseband Guard") if env("USE_DS", "true") == "true": enabled.append("DroidSpaces-OSS") if env("USE_NET", "true") == "true": enabled.append("Networking") if env("USE_NTSYNC", "true") == "true": enabled.append("NTSync") if env("USE_PTRACE", "true") == "true": enabled.append("Ptrace Leak Fix") if env("USE_UNICODE", "true") == "true": enabled.append("Unicode Fix") if env("USE_BPF", "true") == "true": enabled.append("BTF / eBPF / FUSE-BPF") if env("USE_PERF", "true") == "true": enabled.append("Performance Tuning") if not enabled: return "" parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""] feature_doc_map = [ ("SUSFS", "susfs.md"), ("Baseband Guard", "bbg.md"), ("DroidSpaces-OSS", "droidspaces.md"), ("Networking", "networking.md"), ("NTSync", "ntsync.md"), ("Ptrace Leak Fix", "ptrace.md"), ("Unicode Fix", "unicode.md"), ("BTF / eBPF / FUSE-BPF", "bpf.md"), ("Performance Tuning", "performance.md"), ] for feature, doc in feature_doc_map: if feature in enabled: parts.append(f"- [{feature}](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/{doc})") parts.append("") return "\n".join(parts) def build_install_section(): return ( "## Install with Kernel Flasher\n\n" "> [!NOTE]\n" "> This method is more convenient when upgrading KernelSU and can be done without a computer. Make a backup first.\n\n" "**Steps:**\n\n" "1. **Download the AnyKernel3 ZIP.** If you don\'t know which file to download, carefully read the description of KMI and Security patch level in this document.\n" "2. **Open the Kernel Flasher app**, grant necessary root permissions, and use the provided AnyKernel3 ZIP to flash.\n\n" "This requires the [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) app to have root permissions. " "Other apps that can be used include [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) and [PixelFlasher](https://github.com/badabing2005/PixelFlasher). " "Full guide: [docs/installation.md](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/installation.md)\n" ) def render(): parts = [] parts.append(build_preamble()) parts.append(build_root_section()) parts.append(build_ksu_section()) parts.append(build_susfs_section()) parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", "")))) parts.append(build_features_section()) parts.append(build_install_section()) return "\n".join(parts) output = render() print(output, end="") summary = os.environ.get("GITHUB_STEP_SUMMARY") if summary: Path(summary).write_text(output) PYEOF - name: Publish release notes preview run: | { echo "## Release Notes Preview" echo cat release_body.md } >> "$GITHUB_STEP_SUMMARY" - name: Upload release notes artifact uses: actions/upload-artifact@v7 with: name: release-notes path: release_body.md retention-days: 7 if-no-files-found: error - name: Download Manager APK zips uses: actions/download-artifact@v7 with: path: release-assets/manager pattern: 'manager-apk-*' merge-multiple: true if-no-files-found: ignore - name: Download AnyKernel3 Artifacts uses: actions/download-artifact@v7 with: path: release-assets pattern: '*-AnyKernel3' merge-multiple: false - name: Download NoMount metamodule uses: actions/download-artifact@v7 with: path: release-assets pattern: '*NoMount-Metamodule' merge-multiple: false if-no-files-found: ignore - name: Zip AnyKernel3 for Release run: | set -e shopt -s nullglob for dir in release-assets/*-AnyKernel3; do zip_name="${dir}.zip" rm -f "$zip_name" cd "$dir" zip -r -q -9 "../$(basename "$zip_name")" . cd - >/dev/null done - name: Zip NoMount Metamodule for Release run: | set -e shopt -s nullglob for dir in release-assets/*NoMount-Metamodule; do zip_name="${dir}.zip" rm -f "$zip_name" cd "$dir" zip -r -q -9 "../$(basename "$zip_name")" . cd - >/dev/null done - name: Create Release uses: softprops/action-gh-release@v1 with: tag_name: ${{ steps.tag.outputs.new_tag }} name: ${{ steps.release_meta.outputs.release_title }} body_path: release_body.md draft: false prerelease: ${{ inputs.release_type == 'Pre-Release' }} files: | release-assets/**/*.zip release-assets/**/*-boot*.img notes-preview: if: always() && github.event_name == 'workflow_dispatch' needs: [resolve-sources, build-android12-5-10, build-android13-5-10, build-android13-5-15, build-android14-5-15, build-android14-6-1, build-android15-6-6, build-android16-6-12, release] runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 - name: Render release notes preview (always) env: ROOT_FLAVOR: ${{ inputs.root_flavor }} FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }} MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }} USE_SUSFS: ${{ inputs.use_susfs }} USE_BBG: ${{ inputs.use_bbg }} USE_DS: ${{ inputs.use_ds }} USE_NET: ${{ inputs.use_net }} USE_NTSYNC: ${{ inputs.use_ntsync }} USE_PTRACE: ${{ inputs.use_ptrace }} USE_UNICODE: ${{ inputs.use_unicode }} USE_BPF: ${{ inputs.use_bpf }} # KSU version not computed here; render will show placeholder if release job skipped run: | set -e python3 - <<'PYEOF' > release_body.md import json import os from pathlib import Path def env(name, default=""): return os.environ.get(name, default).strip() def parse_managers(raw): raw = raw.strip() if not raw: return [] try: data = json.loads(raw) except json.JSONDecodeError: return [] return data if isinstance(data, list) else [] def build_preamble(): return ( "# Wild Kernels for GKI2 Devices\n\n" "> [!CAUTION]\n" "> This software is provided for testing and educational purposes only. " "Use at your own risk. The developers are not responsible for any damage, " "data loss, or issues that may occur. Please ensure you have proper backups " "before installation.\n\n" "Join the Telegram group: \n\n" "---\n\n" ) def build_managers_section(managers): if not managers: return "" flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"} lines = [] for m in managers: flavor = m.get("flavor", "") label = flavor_labels.get(flavor, flavor or "unknown") run_id = m.get("run_id") stock = m.get("stock", "") if run_id: url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}" stock_note = f" (stock `{stock[:12]}`)" if stock else "" lines.append(f"- **{label}:** [{url}]({url}){stock_note}") else: lines.append(f"- **{label}:** release assets") return "**Managers:**\n" + "\n".join(lines) + "\n" def build_ksu_section(): version = env("KSU_VERSION", "unknown") tag = env("KSU_GIT_TAG", "no-tag") branch = env("KSUN_BRANCH", "dev") commit = env("KSUN_COMMIT", "unknown") manager_url = env("KSU_MANAGER", "") manager_note = env("KSU_MANAGER_NOTE", "") parts = ["## KernelSU", ""] parts.append(f"- **Version:** `{version}`") if tag and tag != "no-tag": parts.append(f"- **Tag:** `{tag}`") parts.append(f"- **Branch:** `{branch}`") parts.append(f"- **Commit:** `{commit}`") if manager_url: note = f" - {manager_note}" if manager_note else "" base = manager_url.split("/actions/")[0] parts.append(f"- **Manager:** [{base}]({manager_url}){note}") parts.append("") return "\n".join(parts) def build_susfs_section(): variant_envs = [ ("android12-5.10", "susfs_commit_android12_5_10"), ("android13-5.10", "susfs_commit_android13_5_10"), ("android13-5.15", "susfs_commit_android13_5_15"), ("android14-5.15", "susfs_commit_android14_5_15"), ("android14-6.1", "susfs_commit_android14_6_1"), ("android15-6.6", "susfs_commit_android15_6_6"), ("android16-6.12", "susfs_commit_android16_6_12"), ] per_variant = [] for variant, env_key in variant_envs: sha = env(env_key) if sha and len(sha) == 40: per_variant.append((variant, sha)) if per_variant: parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""] for variant, sha in per_variant: parts.append(f"- **{variant}:** `{sha}`") parts.append("") return "\n".join(parts) sha = env("SUSFS_COMMIT", "") if sha: return f"## SUSFS\n\n- **Commit:** `{sha}`\n" return "" def build_root_section(): root_flavor = env("ROOT_FLAVOR", "unknown") feature_set = env("FEATURE_SET", "") parts = ["## This Build", ""] parts.append(f"- **Root:** `{root_flavor}`") if feature_set: parts.append(f"- **Feature Set:** `{feature_set}`") parts.append("") return "\n".join(parts) def build_features_section(): enabled = [] if env("USE_SUSFS", "true") == "true": enabled.append("SUSFS") if env("USE_BBG", "true") == "true": enabled.append("Baseband Guard") if env("USE_DS", "true") == "true": enabled.append("DroidSpaces-OSS") if env("USE_NET", "true") == "true": enabled.append("Networking") if env("USE_NTSYNC", "true") == "true": enabled.append("NTSync") if env("USE_PTRACE", "true") == "true": enabled.append("Ptrace Leak Fix") if env("USE_UNICODE", "true") == "true": enabled.append("Unicode Fix") if env("USE_BPF", "true") == "true": enabled.append("BTF / eBPF / FUSE-BPF") if env("USE_PERF", "true") == "true": enabled.append("Performance Tuning") if not enabled: return "" parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""] feature_doc_map = [ ("SUSFS", "susfs.md"), ("Baseband Guard", "bbg.md"), ("DroidSpaces-OSS", "droidspaces.md"), ("Networking", "networking.md"), ("NTSync", "ntsync.md"), ("Ptrace Leak Fix", "ptrace.md"), ("Unicode Fix", "unicode.md"), ("BTF / eBPF / FUSE-BPF", "bpf.md"), ("Performance Tuning", "performance.md"), ] for feature, doc in feature_doc_map: if feature in enabled: parts.append(f"- [{feature}](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/{doc})") parts.append("") return "\n".join(parts) def build_install_section(): return ( "## Install with Kernel Flasher\n\n" "> [!NOTE]\n" "> This method is more convenient when upgrading KernelSU and can be done without a computer. Make a backup first.\n\n" "**Steps:**\n\n" "1. **Download the AnyKernel3 ZIP.** If you don\'t know which file to download, carefully read the description of KMI and Security patch level in this document.\n" "2. **Open the Kernel Flasher app**, grant necessary root permissions, and use the provided AnyKernel3 ZIP to flash.\n\n" "This requires the [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) app to have root permissions. " "Other apps that can be used include [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) and [PixelFlasher](https://github.com/badabing2005/PixelFlasher). " "Full guide: [docs/installation.md](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/installation.md)\n" ) def render(): parts = [] parts.append(build_preamble()) parts.append(build_root_section()) parts.append(build_ksu_section()) parts.append(build_susfs_section()) parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", "")))) parts.append(build_features_section()) parts.append(build_install_section()) return "\n".join(parts) output = render() print(output, end="") PYEOF { echo "## Release Notes Preview (CI Summary)" echo cat release_body.md } >> "$GITHUB_STEP_SUMMARY" - name: Upload release notes preview artifact uses: actions/upload-artifact@v7 with: name: release-notes-preview path: release_body.md retention-days: 7 if-no-files-found: warn