GKI_KernelSU_SUSFS/.github/actions/remove-protected-exports/action.yml

name: 'Remove Protected Exports'
description: 'Remove ABI protected exports and protected modules for Bazel builds with verification'

runs:
  using: "composite"
  steps:
    - name: Remove Protected Exports (Bazel)
      shell: bash
      working-directory: ${{ github.workspace }}/kernel
      run: |
        set -euo pipefail

        if [ -f "build/build.sh" ]; then
          exit 0
        fi

        rm -rf common/android/abi_gki_protected_exports_*

        if ls -1 common/android/abi_gki_protected_exports_* >/dev/null 2>&1; then
          echo "Error: abi_gki_protected_exports_* still exists after removal"
          ls -la common/android/abi_gki_protected_exports_* || true
          exit 1
        fi

        if grep -q '"protected_exports_list"[[:space:]]*:[[:space:]]*"android/abi_gki_protected_exports_aarch64"' common/BUILD.bazel; then
          BEFORE_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
          perl -pi -e 's/^\s*"protected_exports_list"\s*:\s*"android\/abi_gki_protected_exports_aarch64",\s*$//;' common/BUILD.bazel
          AFTER_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
          if [ "$BEFORE_BUILD_BAZEL_SHA" = "$AFTER_BUILD_BAZEL_SHA" ]; then
            echo "Error: common/BUILD.bazel was not modified"
            exit 1
          fi
          if grep -q '"protected_exports_list"[[:space:]]*:[[:space:]]*"android/abi_gki_protected_exports_aarch64"' common/BUILD.bazel; then
            echo "Error: protected_exports_list reference still present in common/BUILD.bazel"
            exit 1
          fi
        fi

        if grep -q '^protected_modules = ' common/modules.bzl; then
          BEFORE_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
          sed -i 's/protected_modules = \[.*\]/protected_modules = []/' common/modules.bzl
          AFTER_MODULES_BZL_SHA="$(sha256sum common/modules.bzl | awk '{print $1}')"
          if [ "$BEFORE_MODULES_BZL_SHA" = "$AFTER_MODULES_BZL_SHA" ]; then
            echo "Error: common/modules.bzl was not modified"
            exit 1
          fi
          if ! grep -q '^protected_modules = \[\]' common/modules.bzl; then
            echo "Error: protected_modules was not set to [] in common/modules.bzl"
            exit 1
          fi
        fi

        # Remove protected_module_names_list for 6.12+ kernels (Bazel build system)
        if grep -q 'protected_module_names_list' common/BUILD.bazel; then
          BEFORE_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
          perl -pi -e 's/^\s*protected_module_names_list\s*=\s*":gki_(?:aarch64|x86_64)_protected_module_names",\s*$//;' common/BUILD.bazel
          AFTER_BUILD_BAZEL_SHA="$(sha256sum common/BUILD.bazel | awk '{print $1}')"
          if [ "$BEFORE_BUILD_BAZEL_SHA" = "$AFTER_BUILD_BAZEL_SHA" ]; then
            echo "Warning: common/BUILD.bazel was not modified for protected_module_names_list (may not be present)"
          fi
          if grep -q 'protected_module_names_list' common/BUILD.bazel; then
            echo "Error: protected_module_names_list reference still present in common/BUILD.bazel"
            grep -n 'protected_module_names_list' common/BUILD.bazel || true
            exit 1
          fi
        fi