GKI_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Release Type"
        type: choice
        options:
          - Action
          - Pre-Release
          - Release
        default: Action
      kernel_build_version:
        description: "Kernel Version"
        type: choice
        options:
          - All
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
        default: All
      os_patch_level:
        description: "Patch date (YYYY-MM), kernel sublevel, lts, or All (no filter)"
        required: true
        type: string
        default: All
      brand_name:
        description: "Kernel Branding"
        type: string
        default: Wild
      commit_mode:
        description: "latest = branch tips, verified = audited pins, update = build latest then promote verified pins on success"
        required: false
        type: choice
        options:
          - latest
          - verified
          - update
        default: verified
      root_flavor:
        description: "Root Flavor"
        type: choice
        options:
          - KernelSU-Next
          - KernelSU
          - ReSukiSU
          - All
        default: All
      use_susfs:
        description: "SUSFS"
        type: boolean
        default: true
      use_nomount:
        description: "NoMount"
        type: boolean
        default: true
      use_bbg:
        description: "Baseband Guard"
        type: boolean
        default: true
      use_net:
        description: "Networking"
        type: boolean
        default: true
      use_ds:
        description: "DroidSpaces"
        type: boolean
        default: true
      use_ntsync:
        description: "NTSync"
        type: boolean
        default: true
      use_ptrace:
        description: "Ptrace Patch"
        type: boolean
        default: true
      use_unicode:
        description: "Unicode Fix"
        type: boolean
        default: true
      use_bpf:
        description: "BPF Stack (BTF + eBPF + FUSE-BPF)"
        type: boolean
        default: true
      use_perf:
        description: "Performance"
        type: boolean
        default: false
      preserve_abi:
        description: "Preserve ABI/KMI (capture/verify; uncheck to strip protected exports)"
        type: boolean
        default: true

jobs:
  prepare-ccache:
    name: Prepare ccache binary (download once)
    runs-on: ubuntu-latest
    steps:
      - name: Download custom ccache once
        if: false
        run: |
          set -uo pipefail
          echo "::group::Download ccache"
          url="https://raw.githubusercontent.com/WildKernels/kernel_patches/refs/heads/main/ccache/ccache-x86-64"
          ok=0
          for attempt in 1 2 3 4 5 6; do
            if curl -LfsS --connect-timeout 30 --max-time 120 -H "User-Agent: Mozilla/5.0" "$url" -o ccache && [ -s ccache ]; then
              ok=1; break
            fi
            echo "attempt $attempt failed (GitHub raw 504/throttle); backing off..."
            sleep $(( attempt * 5 + RANDOM % 6 ))
          done
          if [ "$ok" = 1 ]; then
            echo "✅ downloaded ccache once for all matrix jobs"
          else
            echo "::warning::custom ccache download failed; matrix jobs will fall back to the apt ccache"
            rm -f ccache
          fi
          echo "::endgroup::"
      - name: Upload ccache artifact
        if: false
        uses: actions/upload-artifact@v7
        with:
          name: ccache-binary
          path: ccache
          retention-days: 1
          if-no-files-found: warn

  resolve-sources:
    runs-on: ubuntu-latest
    outputs:
      nomount_commit: ${{ steps.resolve.outputs.nomount_commit }}
      kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }}
      kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }}
      root_flavor: ${{ steps.resolve.outputs.root_flavor }}
      root_commit: ${{ steps.resolve.outputs.root_commit }}
      root_matrix: ${{ steps.resolve.outputs.root_matrix }}
      susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }}
      susfs_commit_android12_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android12_5_10_resukisu }}
      susfs_commit_android13_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_10_resukisu }}
      susfs_commit_android13_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_15_resukisu }}
      susfs_commit_android14_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_5_15_resukisu }}
      susfs_commit_android14_6_1_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_6_1_resukisu }}
      susfs_commit_android15_6_6_resukisu: ${{ steps.resolve.outputs.susfs_commit_android15_6_6_resukisu }}
      susfs_commit_android16_6_12_resukisu: ${{ steps.resolve.outputs.susfs_commit_android16_6_12_resukisu }}
      ksu_commit: ${{ steps.resolve.outputs.ksu_commit }}
      resukisu_commit: ${{ steps.resolve.outputs.resukisu_commit }}
      kernel_patches_commit: ${{ steps.resolve.outputs.kernel_patches_commit }}
      anykernel3_commit: ${{ steps.resolve.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ steps.resolve.outputs.droidspaces_commit }}
      feature_set: ${{ steps.features.outputs.feature_set }}
      manager_list: ${{ steps.manager.outputs.manager_list }}
    steps:
      - name: Resolve latest component commits
        id: resolve
        shell: bash
        run: |
          set -euo pipefail

          # Commit resolution mode. 'latest' (default) resolves branch tips at
          # run time via git ls-remote. 'verified' uses the audited pins below for
          # NoMount, kernelsu/resukisu roots, and SUSFS; KernelSU-Next stays latest.
          COMMIT_MODE="${{ inputs.commit_mode }}"
          echo "commit_mode=${COMMIT_MODE}"

          retry() {
            local n=0
            until [ "$n" -ge 5 ]; do
              "$@" && return 0
              n=$((n+1))
              echo "retry $n/5 failed for: $*" >&2
              sleep 5
            done
            return 1
          }

          resolve_sha() { # repo ref
            retry git ls-remote "$1" "$2" | awk '{print $1; exit}'
          }

          emit() { # key value
            if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then
              echo "Failed to resolve $1 (got: ${2:-empty})" >&2
              exit 1
            fi
            echo "$1=$2" >> "$GITHUB_OUTPUT"
          }

          # Audited pins (from root-variants.yml). Used only when commit_mode=verified.
          PIN_NOMOUNT="26417ca5fb4021c4fd0c886e6ee8662d3f7b117a"
          PIN_KERNELSU="abc3fdcf5b6ec9e0add131e600d55853a0fffbf2"
          PIN_RESUKISU="03b60f260cce36f23efbd26c9c334edfdc9ce7eb"
          declare -A PIN_SUSFS=(
            [susfs_commit_android12_5_10]="44d9fed948b6d21c25ace142081418690f568dd3"
            [susfs_commit_android13_5_10]="83ffa9f7a9039e233af3d47aeeb838278b23ef8c"
            [susfs_commit_android13_5_15]="9623bd64ccb195dc538af70133ad3374f30de795"
            [susfs_commit_android14_5_15]="fcfdf108e3003fe97a95bf6ed238eb13a93b4aba"
            [susfs_commit_android14_6_1]="0ff932799d898366d57b3b5984d85cdbcfcfad0a"
            [susfs_commit_android15_6_6]="7767a4614146d44f7a81a18b6e687dd8316fc959"
            [susfs_commit_android16_6_12]="78a1f10a21df7271329fe5a733a3cb43c9c6c230"
          )
          # ReSukiSU keeps its own SUSFS pin set (currently the shared values,
          # including 6.1 = 0ff93279). KernelSU's set above already diverges on 6.1.
          declare -A PIN_SUSFS_RESUKISU=(
            [susfs_commit_android12_5_10]="44d9fed948b6d21c25ace142081418690f568dd3"
            [susfs_commit_android13_5_10]="83ffa9f7a9039e233af3d47aeeb838278b23ef8c"
            [susfs_commit_android13_5_15]="9623bd64ccb195dc538af70133ad3374f30de795"
            [susfs_commit_android14_5_15]="fcfdf108e3003fe97a95bf6ed238eb13a93b4aba"
            [susfs_commit_android14_6_1]="0ff932799d898366d57b3b5984d85cdbcfcfad0a"
            [susfs_commit_android15_6_6]="7767a4614146d44f7a81a18b6e687dd8316fc959"
            [susfs_commit_android16_6_12]="78a1f10a21df7271329fe5a733a3cb43c9c6c230"
          )

          pick() { # pinned repo ref  -> pinned when verified, else latest
            local pinned="$1" repo="$2" ref="$3"
            if [ "$COMMIT_MODE" = "verified" ] && [ -n "$pinned" ]; then
              echo "$pinned"
            else
              resolve_sha "$repo" "$ref"
            fi
          }

          # NoMount (pinned in verified mode, else dev tip)
          emit nomount_commit "$(pick "$PIN_NOMOUNT" https://github.com/maxsteeel/nomount.git refs/heads/dev)"

          # KernelSU-Next manager — always built from the official repo's dev branch.
          # pershoot's fork is used only for the kernel SUSFS integration (root_commit below),
          # never for the manager. Manager always builds at latest.
          emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT"

          # Selected root implementation(s). Maps the human-facing choice
          # (KernelSU-Next / KernelSU / ReSukiSU / All) to internal root-setup
          # flavors (next / kernelsu / resukisu). Every build always has a root;
          # 'All' emits a matrix of all three root flavors plus each pinned commit.
          #
          # kernelsu and resukisu pin in verified mode; KernelSU-Next (next) always
          # builds at latest.
          KERNELSU_COMMIT="$(pick "$PIN_KERNELSU" https://github.com/tiann/KernelSU.git refs/heads/main)"
          RESUKISU_COMMIT="$(pick "$PIN_RESUKISU" https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)"
          emit ksu_commit "$KERNELSU_COMMIT"
          emit resukisu_commit "$RESUKISU_COMMIT"
          if [ "${{ inputs.use_susfs }}" = "true" ]; then
            NEXT_COMMIT="$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)"
          else
            NEXT_COMMIT="$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          fi

          mk_entry() { # flavor variant commit
            printf '{"root_flavor":"%s","variant":"%s","root_commit":"%s"}' "$1" "$2" "$3"
          }

          case "${{ inputs.root_flavor }}" in
            KernelSU)
              echo "root_flavor=kernelsu" >> "$GITHUB_OUTPUT"
              emit root_commit "$KERNELSU_COMMIT"
              ROOT_MATRIX="[$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT")]"
              ;;
            KernelSU-Next)
              echo "root_flavor=next" >> "$GITHUB_OUTPUT"
              emit root_commit "$NEXT_COMMIT"
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT")]"
              ;;
            ReSukiSU)
              echo "root_flavor=resukisu" >> "$GITHUB_OUTPUT"
              emit root_commit "$RESUKISU_COMMIT"
              ROOT_MATRIX="[$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              ;;
            All)
              # Fan out to all three root variants, each with its pinned commit.
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT"),$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT"),$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              echo "root_flavor=" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "ERROR: unknown root_flavor '${{ inputs.root_flavor }}'" >&2
              exit 1
              ;;
          esac
          echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"

          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu).
          # Always emit the verified pinned SHA here; build.yml overrides to the
          # latest branch tip per-variant when the root flavor is KernelSU-Next.
          declare -A SUSFS_BRANCHES=(
            [susfs_commit_android12_5_10]="gki-android12-5.10"
            [susfs_commit_android13_5_10]="gki-android13-5.10"
            [susfs_commit_android13_5_15]="gki-android13-5.15"
            [susfs_commit_android14_5_15]="gki-android14-5.15"
            [susfs_commit_android14_6_1]="gki-android14-6.1"
            [susfs_commit_android15_6_6]="gki-android15-6.6"
            [susfs_commit_android16_6_12]="gki-android16-6.12"
          )
          for key in "${!SUSFS_BRANCHES[@]}"; do
            emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
            # Per-flavor ReSukiSU SUSFS pin (same branch, own pin set).
            emit "${key}_resukisu" "$(pick "${PIN_SUSFS_RESUKISU[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
          done

          # Tracked build helpers (resolved automatically, before the run)
          emit kernel_patches_commit "$(resolve_sha https://github.com/WildKernels/kernel_patches.git refs/heads/main)"
          emit anykernel3_commit   "$(resolve_sha https://github.com/WildKernels/AnyKernel3.git refs/heads/gki-2.0)"
          emit droidspaces_commit  "$(resolve_sha https://github.com/ravindu644/Droidspaces-OSS.git refs/heads/main)"

          echo "Resolved:"
          env | grep -E '^(nomount_commit|kernelsu_commit|kernelsu_branch|root_commit|susfs_commit_|kernel_patches_commit|anykernel3_commit|droidspaces_commit)' | sort || true

      - name: Resolve manager builds for selected root flavor(s)
        id: manager
        shell: bash
        run: |
          set -euo pipefail

          # Each selected root must ship ALL manager APK builds. KernelSU-Next publishes
          # its manager APKs (manager + manager-spoofed) from the official dev-tip
          # build-manager-ci run; kernelsu (KernelSU) and ReSukiSU expose theirs as
          # CI-run artifacts. All three are pinned to an exact commit.
          resolve_one() { # flavor
            local flavor="$1"
            local owner repo wf stock
            case "$flavor" in
              next)
                owner="KernelSU-Next"; repo="KernelSU-Next"; wf="build-manager-ci.yml"
                # Manager is built from the official dev-tip commit (grabbed at run start).
                stock="${{ steps.resolve.outputs.kernelsu_commit }}"
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${{ secrets.MY_GITHUB_TOKEN }}" \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for dev commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager,manager-spoofed"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;

              kernelsu)
                owner="tiann"; repo="KernelSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              resukisu)
                owner="ReSukiSU"; repo="ReSukiSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"Manager-release,Spoofed-Manager-release,Manager-debug"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              *)
                echo "skipping unknown flavor: $flavor" >&2
                return 0
                ;;
            esac
          }

          FLAVORS="${{ inputs.root_flavor }}"
          echo "Root flavor: ${FLAVORS}"
          LIST=""
          case "${FLAVORS}" in
            All) LIST="$(resolve_one next),$(resolve_one kernelsu),$(resolve_one resukisu)" ;;
            KernelSU-Next) LIST="$(resolve_one next)" ;;
            KernelSU) LIST="$(resolve_one kernelsu)" ;;
            ReSukiSU) LIST="$(resolve_one resukisu)" ;;
            *) echo "Skipping manager resolution (no root flavor / none)." ;;
          esac
          if [ -n "$LIST" ]; then
            echo "manager_list=[$LIST]" >> "$GITHUB_OUTPUT"
            echo "Manager sources resolved."
          else
            echo "manager_list=" >> "$GITHUB_OUTPUT"
          fi

      - name: Compose requested feature set
        id: features
        shell: bash
        run: |
          set -euo pipefail

          # Every build always has a root implementation (no 'none' option), so
          # SUSFS always has a root to hook into -- no extra guard needed.

          # A Release/Pre-Release ships whichever manger build(s) were resolved
          # in the manager step above (exact match per root flavor). No root
          # restriction applies here anymore -- KernelSU-Next, KernelSU, ReSukiSU,
          # or 'All' are all valid release targets.

          FEATURES=""
          [ "${{ inputs.use_susfs }}" = "true" ] && FEATURES="${FEATURES}SUSFS+"
          [ "${{ inputs.use_nomount }}" = "true" ] && FEATURES="${FEATURES}NoMount+"
          [ "${{ inputs.use_bbg }}" = "true" ] && FEATURES="${FEATURES}BBG+"
          [ "${{ inputs.use_net }}" = "true" ] && FEATURES="${FEATURES}NET+"
          [ "${{ inputs.use_ds }}" = "true" ] && FEATURES="${FEATURES}DS+"
          [ "${{ inputs.use_ntsync }}" = "true" ] && FEATURES="${FEATURES}NTSync+"
          [ "${{ inputs.use_ptrace }}" = "true" ] && FEATURES="${FEATURES}Ptrace+"
          [ "${{ inputs.use_unicode }}" = "true" ] && FEATURES="${FEATURES}Unicode+"
          [ "${{ inputs.use_bpf }}" = "true" ] && FEATURES="${FEATURES}BPF+"
          [ "${{ inputs.use_perf }}" = "true" ] && FEATURES="${FEATURES}Perf+"
          echo "feature_set=${FEATURES%+}" >> "$GITHUB_OUTPUT"

      - name: Clone shared source repos once
        if: ${{ inputs.use_nomount }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p sources

          # NoMount kernel sources at the resolved commit (pinned or dev tip)
          git clone --no-checkout https://github.com/maxsteeel/nomount.git sources/nomount
          git -C sources/nomount fetch --depth=1 origin "${{ steps.resolve.outputs.nomount_commit }}"
          git -C sources/nomount checkout --detach "${{ steps.resolve.outputs.nomount_commit }}"
          [ "$(git -C sources/nomount rev-parse HEAD)" = "${{ steps.resolve.outputs.nomount_commit }}" ] || \
            { echo "NoMount clone HEAD mismatch" >&2; exit 1; }

  list-manager-apks:
    needs: resolve-sources
    if: ${{ needs.resolve-sources.outputs.manager_list != '' }}
    runs-on: ubuntu-latest
    outputs:
      apk_list: ${{ steps.scan.outputs.apk_list }}
    steps:
      - uses: actions/checkout@v7

      - name: Download and scan all manager APKs
        id: scan
        shell: bash
        env:
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          TOKEN: ${{ secrets.MY_GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          OUT_APKS="${GITHUB_WORKSPACE:-$PWD}/manager_apks"
          MANIFEST="${GITHUB_WORKSPACE:-$PWD}/manifest.txt"
          rm -rf "$OUT_APKS" "$MANIFEST"
          mkdir -p "$OUT_APKS"
          : > "$MANIFEST"
          echo "$MANAGER_LIST" | jq -c '.[]' | while read -r M; do
            OWNER=$(echo "$M" | jq -r .owner)
            REPO=$(echo "$M" | jq -r .repo)
            SRC=$(echo "$M" | jq -r .source)
            RUN_ID=$(echo "$M" | jq -r .run_id)
            WANT=$(echo "$M" | jq -r '.want // ""')
            DLDIR="dl_${REPO}"
            mkdir -p "$DLDIR"
            (
              cd "$DLDIR"
              if [ "$SRC" = "release" ]; then
                curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" > rel.json
                for URL in $(jq -r '.assets[] | select(.name | endswith(".apk")) | .browser_download_url' rel.json); do
                  NAME="${URL##*/}"
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$NAME" "$URL"
                  cp -f "$NAME" "$OUT_APKS/$NAME"
                  echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                done
              else
                AJSON=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${TOKEN}" \
                  "https://api.github.com/repos/${OWNER}/${REPO}/actions/runs/${RUN_ID}/artifacts")
                if [ -z "$WANT" ]; then
                  ART_IDS=$(echo "$AJSON" | jq -r '.artifacts[].id')
                else
                  ART_IDS=$(echo "$AJSON" | jq -r --arg want "$WANT" '
                    ($want | split(",")) as $wl |
                    .artifacts[] | select(.name as $n | any($wl[]; $n == .)) | .id')
                fi
                echo "$ART_IDS" | while read -r AID; do
                  [ -n "$AID" ] || continue
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                    -H "Authorization: Bearer ${TOKEN}" \
                    -o "_${AID}.zip" \
                    "https://api.github.com/repos/${OWNER}/${REPO}/actions/artifacts/${AID}/zip"
                  mkdir -p "_${AID}"
                  unzip -o -q "_${AID}.zip" -d "_${AID}" || true
                  rm -f "_${AID}.zip"
                  for apk in _${AID}/*.apk; do
                    [ -f "$apk" ] || continue
                    NAME="$(basename "$apk")"
                    cp -f "$apk" "$OUT_APKS/$NAME"
                    echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                  done
                  rm -rf "_${AID}"
                done
              fi
            )
          done
          # Build the flat apk list from the manifest (single source of truth)
          APK_JSON="[]"
          while IFS='|' read -r o r n; do
            [ -n "$n" ] || continue
            APK_JSON=$(echo "$APK_JSON" | jq -c --arg o "$o" --arg r "$r" --arg n "$n" \
              '. + [{owner:$o,repo:$r,apk:$n}]')
          done < "$MANIFEST"
          echo "apk_list=${APK_JSON}" >> "$GITHUB_OUTPUT"
          echo "Found $(wc -l < "$MANIFEST") manager APKs"
          ls -1 "$OUT_APKS"
      - name: Upload all manager APKs as one cross-blob
        uses: actions/upload-artifact@v7
        with:
          name: manager-apks
          path: manager_apks/
          if-no-files-found: error

  publish-manager-artifacts:
    needs: list-manager-apks
    if: ${{ needs.list-manager-apks.outputs.apk_list != '' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        item: ${{ fromJson(needs.list-manager-apks.outputs.apk_list) }}
    steps:
      - uses: actions/checkout@v7

      - name: Download manager cross-blob
        uses: actions/download-artifact@v7
        with:
          name: manager-apks
          path: manager_apks
          merge-multiple: true

      - name: Upload ${{ matrix.item.apk }} as its own artifact
        uses: actions/upload-artifact@v7
        with:
          name: manager-apk-${{ matrix.item.apk }}
          path: manager_apks/${{ matrix.item.apk }}
          if-no-files-found: error

  build-nomount-module:
    needs: resolve-sources
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        if: ${{ inputs.use_nomount }}

      - name: Clone NoMount source at pinned commit
        id: clone
        if: ${{ inputs.use_nomount }}
        shell: bash
        run: |
          set -euo pipefail
          COMMIT="${{ needs.resolve-sources.outputs.nomount_commit }}"
          if ! [[ "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
            echo "NoMount commit must be a full 40-character SHA." >&2
            exit 2
          fi
          echo "NoMount commit: ${COMMIT}"
          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"

      - name: Build NoMount metamodule (nm only, no .ko)
        if: ${{ inputs.use_nomount }}
        id: buildmod
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ steps.clone.outputs.commit }}

      - name: Upload NoMount metamodule
        if: ${{ inputs.use_nomount }}
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.buildmod.outputs.module_dir }}
          if-no-files-found: error
          compression-level: 0

  build-android12-5-10:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android12-5.10') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android12-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android12_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android13-5-10:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.10') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android13-5-15:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.15') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android14-5-15:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-5.15') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android14-6-1:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-6.1') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-6.1.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android15-6-6:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android15-6.6') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android15-6.6.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android15_6_6_resukisu || needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  build-android16-6-12:
    needs:
    - prepare-ccache
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android16-6.12') }}
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android16-6.12.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android16_6_12_resukisu || needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      preserve_abi: ${{ inputs.preserve_abi }}
      os_patch_level: ${{ inputs.os_patch_level }}
    secrets: inherit

  update-verified-pins:
    if: ${{ !inputs.test_release_notes && inputs.commit_mode == 'update' }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    needs:
    - resolve-sources
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    steps:
    - uses: actions/checkout@v7
      with:
        ref: ${{ github.ref }}
        token: ${{ secrets.GITHUB_TOKEN }}

    - name: Promote verified pins on success
      id: promote
      shell: bash
      run: |
        set -euo pipefail
        python3 .github/scripts/update_verified_pins.py
      env:
        GH_TOKEN: ${{ github.token }}
        NOMOUNT_SHA: ${{ needs.resolve-sources.outputs.nomount_commit }}
        KERNELSU_SHA: ${{ needs.resolve-sources.outputs.ksu_commit }}
        RESUKISU_SHA: ${{ needs.resolve-sources.outputs.resukisu_commit }}
        APPROVE_NOMOUNT: ${{ inputs.use_nomount }}
        APPROVE_KERNELSU: ${{ (inputs.root_flavor == 'KernelSU' || inputs.root_flavor == 'All') }}
        APPROVE_RESUKISU: ${{ (inputs.root_flavor == 'ReSukiSU' || inputs.root_flavor == 'All') }}

    - name: Commit promoted pins
      if: ${{ always() && steps.promote.conclusion == 'success' }}
      shell: bash
      run: |
        set -euo pipefail
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        STAMP="$(date -u +%Y-%m-%dT%H%M%SZ)"
        git add .github/workflows/main.yml .github/pins/history
        if git diff --cached --quiet; then
          echo "No pin changes to commit."
          exit 0
        fi
        git commit -m "chore(pins): promote verified commits to latest built (${STAMP})"
        git push
  rej:
    if: ${{ !inputs.test_release_notes && always() }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12

    steps:
    - name: Download Misc Artifacts
      uses: actions/download-artifact@v7
      with:
        path: ./downloaded-artifacts
        pattern: '*-Rejects'
        merge-multiple: false

    - name: Process Reject Artifacts
      run: |
        mkdir -p aio-rejects

        # Iterate over Rejects artifacts in downloaded-artifacts
        for dir in ./downloaded-artifacts/*-Rejects; do
            [ -d "$dir" ] || continue

            dirname=$(basename "$dir")
            original_name=${dirname%-Rejects}
            source_dir="$dir"

            if [ -d "$dir/patch-rejects" ]; then
              source_dir="$dir/patch-rejects"
            fi

            mapfile -t rej_files < <(find "$source_dir" -type f -name '*.rej' | sort)
            filtered_rej_files=()
            for rej_file in "${rej_files[@]}"; do
              rel_rej="${rej_file#${source_dir}/}"
              rel_name="$(basename "$rel_rej")"
              if [ "$rel_rej" = "common/mm/rmap.c.rej" ] || [ "$rel_name" = "i2c-nomadik.c.rej" ]; then
                echo "Skipping $rel_rej because it is an ignored reject file"
                continue
              fi
              filtered_rej_files+=("$rej_file")
            done

            if [ "${#filtered_rej_files[@]}" -eq 0 ]; then
              echo "Skipping $dirname because it only contains ignored reject files"
              continue
            fi

            mkdir -p "aio-rejects/$original_name"

            if [ -d "$dir/patch-rejects" ]; then
              cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/"
            else
              cp -r "$dir/." "aio-rejects/$original_name/"
            fi

            find "aio-rejects/$original_name" -type f -name 'i2c-nomadik.c.rej' -delete
        done

        if [ "$(ls -A aio-rejects)" ]; then
            cd aio-rejects
            zip -r -q -9 ../AIO-REJ.zip .
            cd ..
        else
            echo "No rejects found to upload."
        fi

    - name: Rejects Summary
      run: |
        echo "Reject artifacts were collected locally only and are not uploaded." >> "$GITHUB_STEP_SUMMARY"

    - name: Upload AIO-REJ Artifact
      uses: actions/upload-artifact@v7
      with:
        name: AIO-REJ
        path: AIO-REJ.zip
        if-no-files-found: ignore

  release:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.release_type == 'Pre-Release' || inputs.release_type == 'Release') }}
    permissions:
      contents: write
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    - build-nomount-module
    - publish-manager-artifacts

    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_NOTES: .github/config/RELEASE_NOTES.md
    outputs:
      new_tag: ${{ steps.tag.outputs.new_tag }}
    steps:
    - name: Validate Selected Builds
      run: |
        set -euo pipefail

        failed=0
        current_type="${{ inputs.kernel_build_version }}"

        check_selected() {
          local target="$1"
          local job_name="$2"
          local result="$3"
          
          if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then
            if [[ "$result" != "success" ]]; then
              echo "Required job $job_name did not succeed (result: $result)"
              failed=1
            fi
          fi
        }

        check_selected "android12-5.10" "build-android12-5-10" "${{ needs.build-android12-5-10.result }}"
        check_selected "android13-5.10" "build-android13-5-10" "${{ needs.build-android13-5-10.result }}"
        check_selected "android13-5.15" "build-android13-5-15" "${{ needs.build-android13-5-15.result }}"
        check_selected "android14-5.15" "build-android14-5-15" "${{ needs.build-android14-5-15.result }}"
        check_selected "android14-6.1" "build-android14-6-1" "${{ needs.build-android14-6-1.result }}"
        check_selected "android15-6.6" "build-android15-6-6" "${{ needs.build-android15-6-6.result }}"
        check_selected "android16-6.12" "build-android16-6-12" "${{ needs.build-android16-6-12.result }}"

        if [[ "$failed" -ne 0 ]]; then
          exit 1
        fi

    - name: Free Disk Space
      if: true
      uses: endersonmenezes/free-disk-space@v3  # Use @main for latest, @v3 for stable
      with:
        remove_android: true
        remove_dotnet: true
        remove_haskell: true
        remove_tool_cache: true
        remove_swap: true
        remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
        remove_packages_one_command: true
        remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
        rm_cmd: "rmz"  # Use 'rmz' for faster deletion (default: 'rm')
        rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
        testing: false

    - name: Checkout code
      uses: actions/checkout@v7

    - name: Generate New Tag
      id: tag
      if: inputs.release_type != 'Action'
      run: |
        mapfile -t RELEASE_TAGS < <(gh api --paginate "repos/${{ github.repository }}/tags?per_page=100" --jq '.[].name' 2>/dev/null | grep -E '^r[0-9]+$' || true)

        LATEST_REV=0
        for TAG in "${RELEASE_TAGS[@]}"; do
          REV="${TAG#r}"
          if [[ "$REV" =~ ^[0-9]+$ && "$REV" -gt "$LATEST_REV" ]]; then
            LATEST_REV="$REV"
          fi
        done

        if [[ "$LATEST_REV" -gt 0 ]]; then
          NEW_TAG="r$((LATEST_REV + 1))"
        else
          NEW_TAG="r1"
        fi

        if [[ ${#RELEASE_TAGS[@]} -gt 0 ]]; then
          echo "Latest r-tag: r${LATEST_REV}"
        else
          echo "No existing r-tags found; starting at r1"
        fi
        echo "New tag: $NEW_TAG"
        echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV
        echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT

    - name: Set Release Title
      id: release_meta
      run: |
        set -euo pipefail

        # Format release title: convert rN -> Release N
        if [[ "${NEW_TAG}" =~ ^r([0-9]+)$ ]]; then
          REV_NUM="${BASH_REMATCH[1]}"
          release_title="Release ${REV_NUM}"
        else
          release_title="Release ${NEW_TAG}"
        fi

        echo "release_title=$release_title" >> "$GITHUB_OUTPUT"

    - name: Extract KernelSU Version Info
      id: ksu_version
      run: |
        set -euo pipefail

        KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
        KSU_INPUT="dev-susfs"

        # Try as branch first, fall back to commit
        if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
          echo "Cloning KernelSU-Next from branch: $KSU_INPUT"
          git clone --branch "$KSU_INPUT" "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          KSUN_COMMIT=$(git rev-parse HEAD)
        else
          echo "Cloning KernelSU-Next from dev-susfs branch, then checking out commit: $KSU_INPUT"
          git clone --branch dev-susfs "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          git fetch --depth=50 origin "$KSU_INPUT"
          git checkout "$KSU_INPUT"
          KSUN_COMMIT="$KSU_INPUT"
        fi

        # The manager is built on the OFFICIAL KernelSU-Next repo
        # (pershoot's workflows are all disabled). Find the official dev
        # commit this fork's branch is synced with (merge-base of our
        # branch vs official dev), then link the manager build run for
        # that commit. pershoot's own dev branch is intentionally ignored.
        retry() {
          local n=0
          until [ "$n" -ge 5 ]; do
            "$@" && return 0
            n=$((n+1))
            echo "retry $n/5 failed for: $*" >&2
            sleep 5
          done
          return 1
        }

        OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git"
        retry git fetch "$OFFICIAL_KSU_REPO" dev
        STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD)
        echo "KSU Stock Commit (official sync point): $STOCK_COMMIT"

        # Extract version info — anchored to the official sync point
        # (STOCK_COMMIT), i.e. the commit the linked manager is built from.
        # Mirrors pershoot c0a2c5fd: count the merge-base with origin, not
        # the fork's extra commits, so the version shown in the release
        # notes matches what the kernel reports and the manager displays.
        COMMITS_COUNT=$(git rev-list --count "$STOCK_COMMIT")
        BASE_VERSION=30000
        KSU_VERSION=$(expr $COMMITS_COUNT "+" $BASE_VERSION)

        # Extract git tag at the sync point
        KSU_GIT_TAG=$(git describe --tags --abbrev=0 "$STOCK_COMMIT" 2>/dev/null || echo "no-tag")

        MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" | jq -r '.workflow_runs[0].id // empty')
        if [[ -n "${MANAGER_RUN_ID:-}" ]]; then
          KSU_MANAGER="https://github.com/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}"
          KSU_MANAGER_NOTE="built from stock dev commit ${STOCK_COMMIT:0:12} (exact match)"
        else
          # Validated up-front in resolve-sources; a release cannot proceed without
          # the exact manager run. Fail rather than link a mismatched manager.
          echo "ERROR: exact manager build no longer available for ${STOCK_COMMIT}" >&2
          exit 1
        fi

        echo "Commits count: $COMMITS_COUNT"
        echo "KSU Version: $KSU_VERSION"
        echo "KSU Git Tag: $KSU_GIT_TAG"
        echo "KSU Manager: $KSU_MANAGER"

        # Export as environment for next step
        echo "KSUN_BRANCH=$KSU_INPUT" >> $GITHUB_ENV
        echo "KSUN_COMMIT=$KSUN_COMMIT" >> $GITHUB_ENV
        echo "KSU_COMMITS_COUNT=$COMMITS_COUNT" >> $GITHUB_ENV
        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
        echo "KSU_MANAGER=$KSU_MANAGER" >> $GITHUB_ENV
        echo "KSU_MANAGER_NOTE=${KSU_MANAGER_NOTE:-}" >> $GITHUB_ENV
        echo "MANAGER_RUN_ID=$MANAGER_RUN_ID" >> $GITHUB_ENV

    - name: Set release body
      env:
        ROOT_FLAVOR: ${{ inputs.root_flavor }}
        FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }}
        MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
        USE_SUSFS: ${{ inputs.use_susfs }}
        USE_BBG: ${{ inputs.use_bbg }}
        USE_DS: ${{ inputs.use_ds }}
        USE_NET: ${{ inputs.use_net }}
        USE_NTSYNC: ${{ inputs.use_ntsync }}
        USE_PTRACE: ${{ inputs.use_ptrace }}
        USE_UNICODE: ${{ inputs.use_unicode }}
        USE_BPF: ${{ inputs.use_bpf }}
      run: |
        set -e

        RELEASE_NOTES_PATH="$RELEASE_NOTES"
        : > release_body.md

        python3 .github/scripts/render_release_body.py "$RELEASE_NOTES_PATH" > release_body.md

    - name: Publish release notes preview
      run: |
        {
          echo "## Release Notes Preview"
          echo
          cat release_body.md
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Upload release notes artifact
      uses: actions/upload-artifact@v7
      with:
        name: release-notes
        path: release_body.md
        retention-days: 7
        if-no-files-found: error

    - name: Download Manager APK zips
      uses: actions/download-artifact@v7
      with:
        path: release-assets/manager
        pattern: 'manager-apk-*'
        merge-multiple: true
        if-no-files-found: ignore

    - name: Download AnyKernel3 Artifacts
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*-AnyKernel3'
        merge-multiple: false

    - name: Download NoMount metamodule
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*NoMount-Metamodule'
        merge-multiple: false
        if-no-files-found: ignore

    - name: Zip AnyKernel3 for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*-AnyKernel3; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Zip NoMount Metamodule for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*NoMount-Metamodule; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ steps.tag.outputs.new_tag }}
        name: ${{ steps.release_meta.outputs.release_title }}
        body_path: release_body.md
        draft: false
        prerelease: ${{ inputs.release_type == 'Pre-Release' }}
        files: |
          release-assets/**/*.zip
          release-assets/**/*-boot*.img

  notes-preview:
    if: always() && github.event_name == 'workflow_dispatch'
    needs: [resolve-sources, build-android12-5-10, build-android13-5-10, build-android13-5-15, build-android14-5-15, build-android14-6-1, build-android15-6-6, build-android16-6-12, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Render release notes preview (always)
        env:
          ROOT_FLAVOR: ${{ inputs.root_flavor }}
          FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }}
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          USE_SUSFS: ${{ inputs.use_susfs }}
          USE_BBG: ${{ inputs.use_bbg }}
          USE_DS: ${{ inputs.use_ds }}
          USE_NET: ${{ inputs.use_net }}
          USE_NTSYNC: ${{ inputs.use_ntsync }}
          USE_PTRACE: ${{ inputs.use_ptrace }}
          USE_UNICODE: ${{ inputs.use_unicode }}
          USE_BPF: ${{ inputs.use_bpf }}
          # KSU version not computed here; render will show placeholder if release job skipped
        run: |
          set -e
          python3 .github/scripts/render_release_body.py .github/config/RELEASE_NOTES.md > release_body.md
          {
            echo "## Release Notes Preview (CI Summary)"
            echo
            cat release_body.md
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Upload release notes preview artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-notes-preview
          path: release_body.md
          retention-days: 7
          if-no-files-found: warn