name: Build-verified only GKI root variants

on:
  workflow_dispatch:
    inputs:
      kernel_build_version:
        description: "Supported GKI target"
        required: true
        type: choice
        options:
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
        default: android14-6.1
      os_patch_level:
        description: "Patch date (YYYY-MM), kernel sublevel, lts (builds the LTS branch), or all"
        required: true
        type: string
        default: lts
      commit_mode:
        description: "verified = audited pinned SHAs, latest = branch tips at run time"
        required: false
        type: choice
        options:
          - verified
          - latest
        default: verified

permissions:
  contents: read
  actions: write

jobs:
  resolve-pins:
    runs-on: ubuntu-latest
    outputs:
      config_file: ${{ steps.pins.outputs.config_file }}
      susfs_commit: ${{ steps.pins.outputs.susfs_commit }}
      nomount_commit: ${{ steps.pins.outputs.nomount_commit }}
      classic_commit: ${{ steps.pins.outputs.classic_commit }}
      next_commit: ${{ steps.pins.outputs.next_commit }}
      resukisu_commit: ${{ steps.pins.outputs.resukisu_commit }}
    steps:
      - id: pins
        shell: bash
        run: |
          set -euo pipefail
          nomount_commit="c52936b229c25a4b0e41b6627f7d3bc5eaaaf2b5"
          classic_commit="da9abf498a77d438989fea0f5f4e348b9a540c07"
          next_commit="234f6e040fcbca18b16d2398e1aa225712ec99ad"
          resukisu_commit="3ef06b0fcb0960dc9563256fe26a58e892663387"
          case "${{ inputs.kernel_build_version }}" in
            android12-5.10) susfs_commit="3c14ad549f826b1f53878ec8c12253efebeed75a" ;;
            android13-5.10) susfs_commit="f81aaf10e9560282052bb61dd931315c2ca3e617" ;;
            android13-5.15) susfs_commit="ccb1918684b27644d17a6c842f57b60ae5966025" ;;
            android14-5.15) susfs_commit="0463ac089308014e8c22cc6a4558e0d6d2a53e08" ;;
            android14-6.1) susfs_commit="e287d59066380bf6de4396532d4a42edf4408701" ;;
            android15-6.6) susfs_commit="be7b7ef49a1e1b189c3abf00eacaa7ebdb4168c1" ;;
            android16-6.12) susfs_commit="f37930f374ef88de990d6abea0c67d0ea28c1edc" ;;
            *) echo "Unsupported GKI target." >&2; exit 2 ;;
          esac
          if [ "${{ inputs.commit_mode }}" = "latest" ]; then
            echo "Resolving latest branch tips..."
            susfs_commit="$(git ls-remote https://gitlab.com/simonpunk/susfs4ksu.git "refs/heads/gki-${{ inputs.kernel_build_version }}" | cut -f1)"
            nomount_commit="$(git ls-remote https://github.com/maxsteeel/nomount.git refs/heads/dev | cut -f1)"
            classic_commit="$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | cut -f1)"
            next_commit="$(git ls-remote https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev | cut -f1)"
            resukisu_commit="$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | cut -f1)"
          fi
          echo "config_file=.github/config/${{ inputs.kernel_build_version }}.json" >> "$GITHUB_OUTPUT"
          echo "susfs_commit=$susfs_commit" >> "$GITHUB_OUTPUT"
          echo "nomount_commit=$nomount_commit" >> "$GITHUB_OUTPUT"
          echo "classic_commit=$classic_commit" >> "$GITHUB_OUTPUT"
          echo "next_commit=$next_commit" >> "$GITHUB_OUTPUT"
          echo "resukisu_commit=$resukisu_commit" >> "$GITHUB_OUTPUT"

  build-nomount-module:
    needs: resolve-pins
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Build NoMount metamodule
        id: nomount-metamodule
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ needs.resolve-pins.outputs.nomount_commit }}

      - name: Upload NoMount metamodule
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.nomount-metamodule.outputs.module_path }}
          if-no-files-found: error

  build:
    needs: [resolve-pins, build-nomount-module]
    strategy:
      fail-fast: false
      matrix:
        include:
          - flavor: classic
            commit: ${{ needs.resolve-pins.outputs.classic_commit }}
            variant: Classic-KernelSU
          - flavor: next
            commit: ${{ needs.resolve-pins.outputs.next_commit }}
            variant: KernelSU-Next
          - flavor: resukisu
            commit: ${{ needs.resolve-pins.outputs.resukisu_commit }}
            variant: ReSukiSU
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: ${{ needs.resolve-pins.outputs.config_file }}
      feature_set: SUSFS
      susfs_commit: ${{ needs.resolve-pins.outputs.susfs_commit }}
      root_flavor: ${{ matrix.flavor }}
      root_commit: ${{ matrix.commit }}
      nomount_commit: ${{ needs.resolve-pins.outputs.nomount_commit }}
      preserve_abi: true
      build_bypass: false
      os_patch_level: ${{ inputs.os_patch_level }}
      variant: ${{ matrix.variant }}
    secrets: inherit