GKI_KernelSU_SUSFS/.github/workflows/prepare.yml

name: Prepare and Build

on:
  workflow_call:
    inputs:
      config_file:
        description: "Path to the JSON config file"
        required: true
        type: string
      feature_set:
        description: "Feature Set"
        required: false
        type: string
      ksu_branch:
        description: "KernelSU branch or commit (empty = latest dev)"
        required: false
        type: string
        default: ""
      susfs_commit:
        description: "SUSFS commit hash (empty = latest on auto-derived branch)"
        required: false
        type: string
        default: ""
      root_flavor:
        description: "Mutually exclusive root implementation (classic, next, or resukisu)"
        required: false
        type: string
        default: ""
      root_commit:
        description: "Exact root implementation commit"
        required: false
        type: string
        default: ""
      nomount_commit:
        description: "Exact NoMount commit"
        required: false
        type: string
        default: ""
      preserve_abi:
        description: "Keep ABI/KMI protection files intact and verify their hashes"
        required: false
        type: boolean
        default: false
      build_bypass:
        description: "Produce the legacy bypass image"
        required: false
        type: boolean
        default: true
      os_patch_level:
        description: "Optional filter: patch date (YYYY-MM), kernel sublevel, latest, or all"
        required: false
        type: string
        default: ""
      variant:
        description: "Artifact variant label"
        required: false
        type: string
        default: ""

jobs:
  generate-matrix:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.final.outputs.matrix }}
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v7

      - name: Read Config and Build Final Matrix
        id: final
        shell: bash
        run: |
          if [ ! -f "${{ inputs.config_file }}" ]; then
            echo "Error: Config file not found: ${{ inputs.config_file }}"
            exit 1
          fi

          CONFIG_JSON=$(cat "${{ inputs.config_file }}" | jq -c .)

          # Build { "include": [ {android_version:..., kernel_version:..., sublevel:..., os_patch_level:..., variant: ...}, ... ] }.
          # An explicit patch-level filter keeps manual validation dispatches bounded.
          FINAL=$(jq -cn \
            --argjson cfg "$CONFIG_JSON" \
            --arg requested_variant "${{ inputs.variant }}" '
            ($cfg.version | split("-")) as $version_parts
            | ($cfg.include) as $targets
            | {
              include: (
                [
                  $targets[] as $item
                  | {
                      version: $cfg.version,
                      android_version: $version_parts[0],
                      kernel_version: $version_parts[1],
                      sublevel: $item.sublevel,
                      os_patch_level: $item.date,
                      variant: (if $requested_variant == "" then "Normal" else $requested_variant end)
                    }
                ]
                + (if $requested_variant == "" then [
                    $targets[] as $item
                    | select($item.variant != null)
                    | {
                        version: $cfg.version,
                        android_version: $version_parts[0],
                        kernel_version: $version_parts[1],
                        sublevel: $item.sublevel,
                        os_patch_level: $item.date,
                        variant: $item.variant
                      }
                  ] else [] end)
                | unique_by([.android_version, .kernel_version, .sublevel, .os_patch_level, .variant])
              )
            }')

          SELECTED_PATCH_LEVEL="${{ inputs.os_patch_level }}"
          if [ "$SELECTED_PATCH_LEVEL" = "all" ]; then
            SELECTED_PATCH_LEVEL=""
          elif [ "$SELECTED_PATCH_LEVEL" = "latest" ]; then
            SELECTED_PATCH_LEVEL=$(jq -r '[.include[] | select(.date != "lts") | .date] | last // empty' "${{ inputs.config_file }}")
          fi
          if [ -n "$SELECTED_PATCH_LEVEL" ]; then
            FULL_FINAL="$FINAL"
            FINAL=$(jq -c --arg patch_level "$SELECTED_PATCH_LEVEL" '
              {include: [.include[] | select(.os_patch_level == $patch_level)]}
            ' <<< "$FINAL")
            # No date matched -- try interpreting the value as a kernel sublevel
            if [ "$(jq '.include | length' <<< "$FINAL")" -eq 0 ]; then
              FINAL=$(jq -c --arg sublevel "$SELECTED_PATCH_LEVEL" '
                {include: [.include[] | select(.sublevel == $sublevel)]}
              ' <<< "$FULL_FINAL")
            fi
          fi
          if [ "$(jq '.include | length' <<< "$FINAL")" -eq 0 ]; then
            echo "Error: no build targets match patch level '${SELECTED_PATCH_LEVEL}'." >&2
            exit 1
          fi

          echo "matrix=$FINAL" >> "$GITHUB_OUTPUT"

  build:
    needs: generate-matrix
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
    uses: ./.github/workflows/build.yml
    with:
      version: ${{ matrix.version }}
      android_version: ${{ matrix.android_version }}
      kernel_version: ${{ matrix.kernel_version }}
      sublevel: ${{ matrix.sublevel }}
      os_patch_level: ${{ matrix.os_patch_level }}
      variant: ${{ matrix.variant }}
      feature_set: ${{ inputs.feature_set }}
      ksu_branch: ${{ inputs.ksu_branch }}
      susfs_commit: ${{ inputs.susfs_commit }}
      root_flavor: ${{ inputs.root_flavor }}
      root_commit: ${{ inputs.root_commit }}
      nomount_commit: ${{ inputs.nomount_commit }}
      preserve_abi: ${{ inputs.preserve_abi }}
      build_bypass: ${{ inputs.build_bypass }}
    secrets: inherit