GKI_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Release Type"
        type: choice
        options: [ Actions, Pre-Release, Release ]
        default: Actions
      ksu_commit:
        description: "KSU Commit (optional)"
        type: string
        default: ""
        required: false
      kernel_build_version:
        description: "Kernel Version to Build"
        type: choice
        options:
          - all
          - a12-5-10
          - a13-5-10
          - a13-5-15
          - a14-5-15
          - a14-6-1
          - a15-6-6
          - a16-6-12
          - lts
          - custom
          - testing
          - bypass
        default: custom
      feature_set:
        description: "Feature Set"
        type: choice
        options:
          - WKSU+SUSFS+BBG
          - WKSU+BBG
          - WKSU
          - BBG
          - None
        default: WKSU+SUSFS+BBG
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.github/ISSUE_TEMPLATE/**'
      - '.github/*.md'
      - '.github/*.txt'

jobs:
  download-dependencies:
    uses: ./.github/workflows/dependencies.yml

  load-configs:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      a12-5-10: ${{ steps.load.outputs.a12-5-10 }}
      a13-5-10: ${{ steps.load.outputs.a13-5-10 }}
      a13-5-15: ${{ steps.load.outputs.a13-5-15 }}
      a14-5-15: ${{ steps.load.outputs.a14-5-15 }}
      a14-6-1: ${{ steps.load.outputs.a14-6-1 }}
      a15-6-6: ${{ steps.load.outputs.a15-6-6 }}
      a16-6-12: ${{ steps.load.outputs.a16-6-12 }}
      lts: ${{ steps.load.outputs.lts }}
      custom: ${{ steps.load.outputs.custom }}
      testing: ${{ steps.load.outputs.testing }}
      bypass: ${{ steps.load.outputs.bypass }}
    steps:
    - uses: actions/checkout@v4
    - name: Load all matrix configs
      id: load
      run: |
        echo "a12-5-10=$(jq -c . .github/kernel-config/a12-5.10.json)" >> $GITHUB_OUTPUT
        echo "a13-5-10=$(jq -c . .github/kernel-config/a13-5.10.json)" >> $GITHUB_OUTPUT
        echo "a13-5-15=$(jq -c . .github/kernel-config/a13-5.15.json)" >> $GITHUB_OUTPUT
        echo "a14-5-15=$(jq -c . .github/kernel-config/a14-5.15.json)" >> $GITHUB_OUTPUT
        echo "a14-6-1=$(jq -c . .github/kernel-config/a14-6.1.json)" >> $GITHUB_OUTPUT
        echo "a15-6-6=$(jq -c . .github/kernel-config/a15-6.6.json)" >> $GITHUB_OUTPUT
        echo "a16-6-12=$(jq -c . .github/kernel-config/a16-6.12.json)" >> $GITHUB_OUTPUT
        echo "lts=$(jq -c . .github/kernel-config/lts.json)" >> $GITHUB_OUTPUT
        echo "custom=$(jq -c . .github/kernel-config/custom.json)" >> $GITHUB_OUTPUT
        echo "testing=$(jq -c . .github/kernel-config/testing.json)" >> $GITHUB_OUTPUT
        echo "bypass=$(jq -c . .github/kernel-config/bypass.json)" >> $GITHUB_OUTPUT

  build-a12-5-10:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a12-5-10' }}
    needs: [download-dependencies, load-configs]
    name: "Android 12 - 5.10"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a12-5-10) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a13-5-10:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a13-5-10' }}
    needs: [download-dependencies, load-configs]
    name: "Android 13 - 5.10"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a13-5-10) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a13-5-15:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a13-5-15' }}
    needs: [download-dependencies, load-configs]
    name: "Android 13 - 5.15"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a13-5-15) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a14-5-15:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a14-5-15' }}
    needs: [download-dependencies, load-configs]
    name: "Android 14 - 5.15"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a14-5-15) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a14-6-1:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a14-6-1' }}
    needs: [download-dependencies, load-configs]
    name: "Android 14 - 6.1"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a14-6-1) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a15-6-6:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a15-6-6' }}
    needs: [download-dependencies, load-configs]
    name: "Android 15 - 6.6"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a15-6-6) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-a16-6-12:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'a16-6-12' }}
    needs: [download-dependencies, load-configs]
    name: "Android 16 - 6.12"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.a16-6-12) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}
  
  build-lts:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'lts' }}
    needs: [download-dependencies, load-configs]
    name: "LTS Kernels"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.lts) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant || '' }}
      ksu_commit: ${{ inputs.ksu_commit || '' }}
      feature_set: ${{ inputs.feature_set || 'WKSU+SUSFS+BBG' }}

  build-custom:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'custom' }}
    needs: [download-dependencies, load-configs]
    name: "Custom Kernels"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.custom) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant }}
      ksu_commit: ${{ inputs.ksu_commit }}
      feature_set: ${{ inputs.feature_set }}

  build-testing:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'testing' }}
    needs: [download-dependencies, load-configs]
    name: "Testing Kernels"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.testing) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant || '' }}
      ksu_commit: ${{ inputs.ksu_commit || '' }}
      feature_set: ${{ inputs.feature_set || 'WKSU+SUSFS+BBG' }}

  build-bypass:
    if: ${{ inputs.kernel_build_version == 'all' || inputs.kernel_build_version == 'bypass' }}
    needs: [download-dependencies, load-configs]
    name: "Bypass Kernels"
    strategy:
      fail-fast: false
      matrix: ${{ fromJSON(needs.load-configs.outputs.bypass) }}
    uses: ./.github/workflows/build.yml
    secrets: inherit
    with:
      kernel_version: ${{ matrix.kernel_version }}
      variant: ${{ matrix.variant || '' }}
      ksu_commit: ${{ inputs.ksu_commit || '' }}
      feature_set: ${{ inputs.feature_set }}

  rej:
    if: always()
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    needs:
    - build-a12-5-10
    - build-a13-5-10
    - build-a13-5-15
    - build-a14-5-15
    - build-a14-6-1
    - build-a15-6-6
    - build-a16-6-12
    - build-custom
    - build-lts
    - build-testing
    - build-bypass
    steps:
    - name: Download Misc Artifacts
      uses: actions/download-artifact@v5
      with:
        path: ./downloaded-artifacts
        pattern: '*-Rejects'

    - name: Process Reject Artifacts
      run: |
        mkdir -p aio-rejects
        
        # Iterate over Rejects artifacts in downloaded-artifacts
        for dir in ./downloaded-artifacts/*-Rejects; do
            # Ensure it is a directory
            [ -d "$dir" ] || continue
            
            dirname=$(basename "$dir")
          # Process each reject artifact
            
            # Get original name (remove -Rejects suffix)
            original_name=${dirname%-Rejects}
            
            mkdir -p "aio-rejects/$original_name"
            
            # Check for patch-rejects folder (legacy structure) or direct contents
            if [ -d "$dir/patch-rejects" ]; then
              # Legacy structure
                cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/"
            else
              # Current structure
                cp -r "$dir/." "aio-rejects/$original_name/"
            fi
        done
        
        # Zip and upload if we found anything
        if [ "$(ls -A aio-rejects)" ]; then
            # Create a single zip of all rejects
            cd aio-rejects
            zip -r -q -9 ../AIO-REJ.zip .
            cd ..
        else
            echo "No rejects found to upload."
        fi

    - name: Upload AIO-REJ Artifact
      uses: actions/upload-artifact@v4
      with:
        name: AIO-REJ
        path: AIO-REJ.zip
        if-no-files-found: ignore

  release:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_type != 'Actions' }}
    permissions:
      contents: write
    needs:
    - build-a12-5-10
    - build-a13-5-10
    - build-a13-5-15
    - build-a14-5-15
    - build-a14-6-1
    - build-a15-6-6
    - build-a16-6-12
    - build-lts
    - build-custom
    - build-testing
    - build-bypass

    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_NAME: "GKI Kernels With WKSU & SUSFS v2.0.0"
      RELEASE_BODY: ""
    outputs:
      new_tag: ${{ steps.tag.outputs.new_tag }}
    steps:
    - name: Validate Selected Builds
      run: |
        set -euo pipefail

        failed=0
        current_type="${{ inputs.kernel_build_version }}"

        check_selected() {
          local target="$1"
          local job_name="$2"
          local result="$3"
          
          if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then
            if [[ "$result" != "success" ]]; then
              echo "Required job $job_name did not succeed (result: $result)"
              failed=1
            fi
          fi
        }

        check_selected "a12-5-10" "build-a12-5-10" "${{ needs.build-a12-5-10.result }}"
        check_selected "a13-5-10" "build-a13-5-10" "${{ needs.build-a13-5-10.result }}"
        check_selected "a13-5-15" "build-a13-5-15" "${{ needs.build-a13-5-15.result }}"
        check_selected "a14-5-15" "build-a14-5-15" "${{ needs.build-a14-5-15.result }}"
        check_selected "a14-6-1" "build-a14-6-1" "${{ needs.build-a14-6-1.result }}"
        check_selected "a15-6-6" "build-a15-6-6" "${{ needs.build-a15-6-6.result }}"
        check_selected "a16-6-12" "build-a16-6-12" "${{ needs.build-a16-6-12.result }}"
        check_selected "custom" "build-custom" "${{ needs.build-custom.result }}"
        check_selected "lts" "build-lts" "${{ needs.build-lts.result }}"
        check_selected "testing" "build-testing" "${{ needs.build-testing.result }}"

        if [[ "$failed" -ne 0 ]]; then
          exit 1
        fi

    - name: Free Disk Space
      if: true
      uses: endersonmenezes/free-disk-space@v3  # Use @main for latest, @v3 for stable
      with:
        remove_android: true
        remove_dotnet: true
        remove_haskell: true
        remove_tool_cache: true
        remove_swap: true
        remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
        remove_packages_one_command: true
        remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
        rm_cmd: "rmz"  # Use 'rmz' for faster deletion (default: 'rm')
        rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
        testing: false

    - name: Checkout code
      uses: actions/checkout@v4

    - name: Generate New Tag
      id: tag
      if: inputs.release_type != 'Actions'
      run: |
        LATEST_TAG=$(gh api repos/${{ github.repository }}/tags --jq '.[0].name' 2>/dev/null || echo "v0.0.0")
        if [[ -z "$LATEST_TAG" || "$LATEST_TAG" == "null" ]]; then
          LATEST_TAG="v0.0.0"
        fi
        
        if [[ "$LATEST_TAG" =~ ^(.*)-r([0-9]+)$ ]]; then
          VERSION="${BASH_REMATCH[1]}"
          REV="${BASH_REMATCH[2]}"
          NEW_REV=$((REV + 1))
          NEW_TAG="${VERSION}-r${NEW_REV}"
        else
          NEW_TAG="${LATEST_TAG}-r1"
        fi
        
        echo "Latest tag: $LATEST_TAG"
        echo "New tag: $NEW_TAG"
        echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV
        echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT

    - name: Set release body
      run: |
        cat << 'EOF' > release_body.md

        !!THIS RELEASE IS A TESTING RELEASE!!

        **IMPORTANT DISCLAIMER**
        This software is provided for testing and educational purposes only. Use at your own risk.
        The developers are not responsible for any damage, data loss, or issues that may occur.
        Please ensure you have proper backups before installation.

        🔹 Normal 
        - Default kernel configuration 
        - Standard kernel module loading behavior 
        - Recommended for most users 

        🔹 Bypass 
        - Includes module check bypass modifications 
        - What are kernel modules? Kernel modules are pieces of code that can be loaded into the kernel at runtime to extend functionality (like device drivers, filesystem support, etc.). These are different from KernelSU/Magisk modules. 
        - The Problem: Sometimes when installing a custom kernel, the device tries to load a kernel module that fails due to version mismatches, missing dependencies, or signature verification issues. This can cause boot failures or device instability. 
        - The Solution: This version changes one line from false to true to force load the kernel module, bypassing the failure check that would normally prevent loading.

        ⚠️ **IMPORTANT: If you are using a Bypass kernel, please create a GitHub issue!**
        We are now building Bypass kernels on-demand to reduce build time and clutter. If you need a Bypass kernel for your device, please:
        1. Create a GitHub issue using the "Bypass Kernel Report" template
        2. Include: kernel version, device model, Android version, and any issues/observations
        3. Message me on Telegram after creating the issue
        I will prioritize and release a new Bypass build ASAP based on your feedback. This helps us understand which devices need Bypass kernels and build only what's needed!

        Features:
        -> Wild KSU Manager Support
        -> SUSFS ඞ v2.0.0
        -> SUSFS Inline Hooks
        -> Ptrace Patch Support for Older Kernels (<5.16) (Disabled for testing)
        -> IPSet Support for Advanced Network Filtering (Disabled for testing, please msg me if you need it)
        -> Wireguard Support 
        -> BBR v1 Support (Disabled for testing, please msg me if you need it)
        -> BBG: https://github.com/vc-teahouse/Baseband-guard (Disabled for testing, will be enabled in the future)

        🔹 BBG (Baseband-guard)
        - A lightweight LSM (Linux Security Module) for Android kernel
        - Blocks unauthorized writes to critical partitions/device nodes
        - Prevents malicious tampering with baseband and boot chain
        - Kernel-level protection via LSM hooks
        - Reduces risk of soft-brick/hard-brick issues

        Kernel Flasher:
        -> https://github.com/fatalcoder524/KernelFlasher/

        Manager:
        -> Wild KSU Manager: https://github.com/WildKernels/Wild_KSU

        Module: 
        -> https://github.com/sidex15/ksu_module_susfs

        !!THIS RELEASE IS A TESTING RELEASE!!
        EOF

    - name: Create GitHub Release
      run: |
        PRERELEASE_FLAG=""
        if [ "${{ inputs.release_type }}" == "Pre-Release" ]; then
          PRERELEASE_FLAG="--prerelease"
        fi

        # Create GitHub release
        gh release create "$NEW_TAG" \
          --title "$RELEASE_NAME" \
          --notes-file release_body.md \
          --target "${{ github.sha }}" \
          $PRERELEASE_FLAG

    - name: Download Artifacts
      uses: actions/download-artifact@v5
      with:
        path: ./downloaded-artifacts
        pattern: '*-AnyKernel3'

    - name: Upload Release Assets
      run: |+
        shopt -s nullglob
        mapfile -t anykernel_dirs < <(find ./downloaded-artifacts -maxdepth 2 -type d -name '*-AnyKernel3' -print)

        for dir in "${anykernel_dirs[@]}"; do
          artifact_name=$(basename "$dir")
          # Create zip for each artifact
          (cd "$dir" && zip -r -q -9 "$GITHUB_WORKSPACE/${artifact_name}.zip" ./*) &
        done
        wait

        for dir in "${anykernel_dirs[@]}"; do
          artifact_name=$(basename "$dir")
          # Upload release asset
          gh release upload "$NEW_TAG" "$GITHUB_WORKSPACE/${artifact_name}.zip" --clobber
        done

  notify:
    runs-on: ubuntu-latest
    needs: release
    if: ${{ always() && (inputs.release_type == 'Actions' || needs.release.result == 'success') }}
    permissions:
      contents: read
      actions: read
    steps:
      - name: Free Disk Space
        uses: endersonmenezes/free-disk-space@v3
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true
          remove_swap: true
          remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
          remove_packages_one_command: true
          remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
          rm_cmd: "rmz"
          rmz_version: "3.1.1"
          testing: false

      - name: Send Telegram Notification
        uses: ./.github/actions/telegram-notify
        with:
          release_type: ${{ inputs.release_type }}
          new_tag: ${{ needs.release.outputs.new_tag }}
          release_result: ${{ needs.release.result }}
          telegram_bot_token: ${{ secrets.TELEGRAM_BOT_TOKEN }}
          telegram_chat_id: ${{ secrets.TELEGRAM_CHAT_ID }}
          telegram_topic_id: ${{ secrets.TELEGRAM_TOPIC_ID_GKI }}
          telegram_user_id: ${{ secrets.TELEGRAM_USER_ID }}