GKI_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Release Type"
        type: choice
        options:
          - Action
          - Pre-Release
          - Release
        default: Pre-Release
      kernel_build_version:
        description: "Kernel Version"
        type: choice
        options:
          - All
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
        default: All
      os_patch_level:
        description: "Patch date (YYYY-MM), kernel sublevel, lts, or All (no filter)"
        required: true
        type: string
        default: All
      brand_name:
        description: "Kernel Branding"
        type: string
        default: Wild
      commit_mode:
        description: "latest = branch tips, verified = audited pins, update = build latest then promote verified pins on success"
        required: false
        type: choice
        options:
          - latest
          - verified
          - update
        default: verified
      root_flavor:
        description: "Root Flavor"
        type: choice
        options:
          - KernelSU-Next
          - KernelSU
          - ReSukiSU
          - All
        default: All
      use_susfs:
        description: "SUSFS"
        type: boolean
        default: true
      use_nomount:
        description: "NoMount"
        type: boolean
        default: true
      use_bbg:
        description: "Baseband Guard"
        type: boolean
        default: true
      use_net:
        description: "Networking"
        type: boolean
        default: true
      use_ds:
        description: "DroidSpaces"
        type: boolean
        default: true
      use_ntsync:
        description: "NTSync"
        type: boolean
        default: true
      use_ptrace:
        description: "Ptrace Patch"
        type: boolean
        default: true
      use_unicode:
        description: "Unicode Fix"
        type: boolean
        default: true
      use_bpf:
        description: "BPF Stack (BTF + eBPF + FUSE-BPF)"
        type: boolean
        default: true
      use_perf:
        description: "Performance"
        type: boolean
        default: false
      bypass:
        description: "Apply kernel version-check bypass hack"
        type: boolean
        default: false
      use_cache:
        description: "Use ccache/bazel cache (restore/save)"
        type: boolean
        default: true

jobs:
  resolve-sources:
    runs-on: ubuntu-latest
    outputs:
      nomount_commit: ${{ steps.resolve.outputs.nomount_commit }}
      kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }}
      kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }}
      root_flavor: ${{ steps.resolve.outputs.root_flavor }}
      root_commit: ${{ steps.resolve.outputs.root_commit }}
      root_matrix: ${{ steps.resolve.outputs.root_matrix }}
      susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }}
      susfs_commit_android12_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android12_5_10_resukisu }}
      susfs_commit_android13_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_10_resukisu }}
      susfs_commit_android13_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_15_resukisu }}
      susfs_commit_android14_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_5_15_resukisu }}
      susfs_commit_android14_6_1_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_6_1_resukisu }}
      susfs_commit_android15_6_6_resukisu: ${{ steps.resolve.outputs.susfs_commit_android15_6_6_resukisu }}
      susfs_commit_android16_6_12_resukisu: ${{ steps.resolve.outputs.susfs_commit_android16_6_12_resukisu }}
      ksu_commit: ${{ steps.resolve.outputs.ksu_commit }}
      resukisu_commit: ${{ steps.resolve.outputs.resukisu_commit }}
      kernel_patches_commit: ${{ steps.resolve.outputs.kernel_patches_commit }}
      anykernel3_commit: ${{ steps.resolve.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ steps.resolve.outputs.droidspaces_commit }}
      feature_set: ${{ steps.features.outputs.feature_set }}
      manager_list: ${{ steps.manager.outputs.manager_list }}
    steps:
      - name: Resolve latest component commits
        id: resolve
        shell: bash
        run: |
          set -euo pipefail

          # Commit resolution mode. 'latest' (default) resolves branch tips at
          # run time via git ls-remote. 'verified' uses the audited pins below for
          # NoMount, kernelsu/resukisu roots, and SUSFS; KernelSU-Next stays latest.
          COMMIT_MODE="${{ inputs.commit_mode }}"
          echo "commit_mode=${COMMIT_MODE}"

          retry() {
            local n=0
            until [ "$n" -ge 5 ]; do
              "$@" && return 0
              n=$((n+1))
              echo "retry $n/5 failed for: $*" >&2
              sleep 5
            done
            return 1
          }

          resolve_sha() { # repo ref
            retry git ls-remote "$1" "$2" | awk '{print $1; exit}'
          }

          emit() { # key value
            if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then
              echo "Failed to resolve $1 (got: ${2:-empty})" >&2
              exit 1
            fi
            echo "$1=$2" >> "$GITHUB_OUTPUT"
          }

          # Audited pins (from root-variants.yml). Used only when commit_mode=verified.
          PIN_NOMOUNT="9a1431782f390453de54610fb91bdad03eab5b43"
          PIN_KERNELSU="e38512f1255ea454d34cc2008d2ef7932547fad6"
          PIN_RESUKISU="0b5efe9e0102c43ca5c41174d500f5a7080cd0c7"
          declare -A PIN_SUSFS=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )
          # ReSukiSU keeps its own SUSFS pin set (currently the shared values,
          # including 6.1 = 0ff93279). KernelSU's set above already diverges on 6.1.
          declare -A PIN_SUSFS_RESUKISU=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )

          pick() { # pinned repo ref  -> pinned when verified, else latest
            local pinned="$1" repo="$2" ref="$3"
            if [ "$COMMIT_MODE" = "verified" ] && [ -n "$pinned" ]; then
              echo "$pinned"
            else
              resolve_sha "$repo" "$ref"
            fi
          }

          # NoMount (pinned in verified mode, else dev tip)
          emit nomount_commit "$(pick "$PIN_NOMOUNT" https://github.com/maxsteeel/nomount.git refs/heads/dev)"

          # KernelSU-Next manager - always built from the official repo's dev branch.
          # pershoot's fork is used only for the kernel SUSFS integration (root_commit below),
          # never for the manager. Manager always builds at latest.
          emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT"

          # Selected root implementation(s). Maps the human-facing choice
          # (KernelSU-Next / KernelSU / ReSukiSU / All) to internal root-setup
          # flavors (next / kernelsu / resukisu). Every build always has a root;
          # 'All' emits a matrix of all three root flavors plus each pinned commit.
          #
          # kernelsu and resukisu pin in verified mode; KernelSU-Next (next) always
          # builds at latest.
          KERNELSU_COMMIT="$(pick "$PIN_KERNELSU" https://github.com/tiann/KernelSU.git refs/heads/main)"
          RESUKISU_COMMIT="$(pick "$PIN_RESUKISU" https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)"
          emit ksu_commit "$KERNELSU_COMMIT"
          emit resukisu_commit "$RESUKISU_COMMIT"
          if [ "${{ inputs.use_susfs }}" = "true" ]; then
            NEXT_COMMIT="$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)"
          else
            NEXT_COMMIT="$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          fi

          mk_entry() { # flavor variant commit
            printf '{"root_flavor":"%s","variant":"%s","root_commit":"%s"}' "$1" "$2" "$3"
          }

          case "${{ inputs.root_flavor }}" in
            KernelSU)
              echo "root_flavor=kernelsu" >> "$GITHUB_OUTPUT"
              emit root_commit "$KERNELSU_COMMIT"
              ROOT_MATRIX="[$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT")]"
              ;;
            KernelSU-Next)
              echo "root_flavor=next" >> "$GITHUB_OUTPUT"
              emit root_commit "$NEXT_COMMIT"
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT")]"
              ;;
            ReSukiSU)
              echo "root_flavor=resukisu" >> "$GITHUB_OUTPUT"
              emit root_commit "$RESUKISU_COMMIT"
              ROOT_MATRIX="[$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              ;;
            All)
              # Fan out to all three root variants, each with its pinned commit.
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT"),$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT"),$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              echo "root_flavor=" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "ERROR: unknown root_flavor '${{ inputs.root_flavor }}'" >&2
              exit 1
              ;;
          esac
          echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"

          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu).
          # Always emit the verified pinned SHA here; build.yml overrides to the
          # latest branch tip per-variant when the root flavor is KernelSU-Next.
          declare -A SUSFS_BRANCHES=(
            [susfs_commit_android12_5_10]="gki-android12-5.10"
            [susfs_commit_android13_5_10]="gki-android13-5.10"
            [susfs_commit_android13_5_15]="gki-android13-5.15"
            [susfs_commit_android14_5_15]="gki-android14-5.15"
            [susfs_commit_android14_6_1]="gki-android14-6.1"
            [susfs_commit_android15_6_6]="gki-android15-6.6"
            [susfs_commit_android16_6_12]="gki-android16-6.12"
          )
          for key in "${!SUSFS_BRANCHES[@]}"; do
            emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
            # Per-flavor ReSukiSU SUSFS pin (same branch, own pin set).
            emit "${key}_resukisu" "$(pick "${PIN_SUSFS_RESUKISU[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
          done

          # Tracked build helpers (resolved automatically, before the run)
          emit kernel_patches_commit "$(resolve_sha https://github.com/WildKernels/kernel_patches.git refs/heads/main)"
          emit anykernel3_commit   "$(resolve_sha https://github.com/WildKernels/AnyKernel3.git refs/heads/gki-2.0)"
          emit droidspaces_commit  "$(resolve_sha https://github.com/ravindu644/Droidspaces-OSS.git refs/heads/main)"

          echo "Resolved:"
          env | grep -E '^(nomount_commit|kernelsu_commit|kernelsu_branch|root_commit|susfs_commit_|kernel_patches_commit|anykernel3_commit|droidspaces_commit)' | sort || true

      - name: Resolve manager builds for selected root flavor(s)
        id: manager
        shell: bash
        run: |
          set -euo pipefail

          # Each selected root must ship ALL manager APK builds. KernelSU-Next publishes
          # its manager APKs (manager + manager-spoofed) from the official dev-tip
          # build-manager-ci run; kernelsu (KernelSU) and ReSukiSU expose theirs as
          # CI-run artifacts. All three are pinned to an exact commit.
          resolve_one() { # flavor
            local flavor="$1"
            local owner repo wf stock
            case "$flavor" in
              next)
                owner="KernelSU-Next"; repo="KernelSU-Next"; wf="build-manager-ci.yml"
                # Manager is built from the official dev-tip commit (grabbed at run start).
                stock="${{ steps.resolve.outputs.kernelsu_commit }}"
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${{ github.token }}" \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for dev commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager,manager-spoofed"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;

              kernelsu)
                owner="tiann"; repo="KernelSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              resukisu)
                owner="ReSukiSU"; repo="ReSukiSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                  exit 1
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"Manager-release,Spoofed-Manager-release,Manager-debug"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              *)
                echo "skipping unknown flavor: $flavor" >&2
                return 0
                ;;
            esac
          }

          FLAVORS="${{ inputs.root_flavor }}"
          echo "Root flavor: ${FLAVORS}"
          LIST=""
          case "${FLAVORS}" in
            All) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)"$'\n'"$(resolve_one kernelsu)"$'\n'"$(resolve_one resukisu)") ;;
            KernelSU-Next) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)") ;;
            KernelSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one kernelsu)") ;;
            ReSukiSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one resukisu)") ;;
            *) echo "Skipping manager resolution (no root flavor / none)." ;;
          esac
          if [ -n "$LIST" ]; then
            echo "manager_list=$LIST" >> "$GITHUB_OUTPUT"
            echo "Manager sources resolved."
          else
            echo "manager_list=[]" >> "$GITHUB_OUTPUT"
          fi

      - name: Compose requested feature set
        id: features
        shell: bash
        run: |
          set -euo pipefail

          # Every build always has a root implementation (no 'none' option), so
          # SUSFS always has a root to hook into -- no extra guard needed.

          # A Release/Pre-Release ships whichever manger build(s) were resolved
          # in the manager step above (exact match per root flavor). No root
          # restriction applies here anymore -- KernelSU-Next, KernelSU, ReSukiSU,
          # or 'All' are all valid release targets.

          FEATURES=""
          [ "${{ inputs.use_susfs }}" = "true" ] && FEATURES="${FEATURES}SUSFS+"
          [ "${{ inputs.use_nomount }}" = "true" ] && FEATURES="${FEATURES}NoMount+"
          [ "${{ inputs.use_bbg }}" = "true" ] && FEATURES="${FEATURES}BBG+"
          [ "${{ inputs.use_net }}" = "true" ] && FEATURES="${FEATURES}NET+"
          [ "${{ inputs.use_ds }}" = "true" ] && FEATURES="${FEATURES}DS+"
          [ "${{ inputs.use_ntsync }}" = "true" ] && FEATURES="${FEATURES}NTSync+"
          [ "${{ inputs.use_ptrace }}" = "true" ] && FEATURES="${FEATURES}Ptrace+"
          [ "${{ inputs.use_unicode }}" = "true" ] && FEATURES="${FEATURES}Unicode+"
          [ "${{ inputs.use_bpf }}" = "true" ] && FEATURES="${FEATURES}BPF+"
          [ "${{ inputs.use_perf }}" = "true" ] && FEATURES="${FEATURES}Perf+"
          echo "feature_set=${FEATURES%+}" >> "$GITHUB_OUTPUT"

      - name: Clone shared source repos once
        if: inputs.use_nomount
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p sources

          # NoMount kernel sources at the resolved commit (pinned or dev tip)
          git clone --no-checkout https://github.com/maxsteeel/nomount.git sources/nomount
          git -C sources/nomount fetch --depth=1 origin "${{ steps.resolve.outputs.nomount_commit }}"
          git -C sources/nomount checkout --detach "${{ steps.resolve.outputs.nomount_commit }}"
          [ "$(git -C sources/nomount rev-parse HEAD)" = "${{ steps.resolve.outputs.nomount_commit }}" ] || \
            { echo "NoMount clone HEAD mismatch" >&2; exit 1; }

  list-manager-apks:
    needs: resolve-sources
    if: needs.resolve-sources.outputs.manager_list != ''
    runs-on: ubuntu-latest
    outputs:
      apk_list: ${{ steps.scan.outputs.apk_list }}
    steps:
      - uses: actions/checkout@v7

      - name: Download and scan all manager APKs
        id: scan
        shell: bash
        env:
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          MANAGER_LIST=$(echo "$MANAGER_LIST" | sed 's/^\[,/[/')
          if ! echo "$MANAGER_LIST" | jq empty 2>/dev/null; then
            echo "ERROR: Invalid MANAGER_LIST JSON"
            echo "Raw: $MANAGER_LIST"
            exit 0
          fi
          OUT_APKS="${GITHUB_WORKSPACE:-$PWD}/manager_apks"
          MANIFEST="${GITHUB_WORKSPACE:-$PWD}/manifest.txt"
          rm -rf "$OUT_APKS" "$MANIFEST"
          mkdir -p "$OUT_APKS"
          : > "$MANIFEST"
          echo "$MANAGER_LIST" | jq -c '.[]' | while read -r M; do
            OWNER=$(echo "$M" | jq -r .owner)
            REPO=$(echo "$M" | jq -r .repo)
            SRC=$(echo "$M" | jq -r .source)
            RUN_ID=$(echo "$M" | jq -r .run_id)
            WANT=$(echo "$M" | jq -r '.want // ""')
            DLDIR="dl_${REPO}"
            mkdir -p "$DLDIR"
            (
              cd "$DLDIR"
              if [ "$SRC" = "release" ]; then
                curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" > rel.json
                for URL in $(jq -r '.assets[] | select(.name | endswith(".apk")) | .browser_download_url' rel.json); do
                  NAME="${URL##*/}"
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$NAME" "$URL"
                  cp -f "$NAME" "$OUT_APKS/$NAME"
                  echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                done
              else
                AJSON=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${GH_TOKEN}" \
                  "https://api.github.com/repos/${OWNER}/${REPO}/actions/runs/${RUN_ID}/artifacts")
                if [ -z "$WANT" ]; then
                  ART_IDS=$(echo "$AJSON" | jq -r '.artifacts[].id')
                else
                  ART_IDS=$(echo "$AJSON" | jq -r --arg want "$WANT" '
                    ($want | split(",")) as $wl |
                    .artifacts[] | select(.name as $n | any($wl[]; $n == .)) | .id')
                fi
                echo "$ART_IDS" | while read -r AID; do
                  [ -n "$AID" ] || continue
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                    -H "Authorization: Bearer ${GH_TOKEN}" \
                    -o "_${AID}.zip" \
                    "https://api.github.com/repos/${OWNER}/${REPO}/actions/artifacts/${AID}/zip"
                  mkdir -p "_${AID}"
                  unzip -o -q "_${AID}.zip" -d "_${AID}" || true
                  rm -f "_${AID}.zip"
                  for apk in _${AID}/*.apk; do
                    [ -f "$apk" ] || continue
                    NAME="$(basename "$apk")"
                    cp -f "$apk" "$OUT_APKS/$NAME"
                    echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                  done
                  rm -rf "_${AID}"
                done
              fi
            )
          done
          # Build the flat apk list from the manifest (single source of truth)
          APK_JSON="[]"
          while IFS='|' read -r o r n; do
            [ -n "$n" ] || continue
            APK_JSON=$(echo "$APK_JSON" | jq -c --arg o "$o" --arg r "$r" --arg n "$n" \
              '. + [{owner:$o,repo:$r,apk:$n}]')
          done < "$MANIFEST"
          echo "apk_list=${APK_JSON}" >> "$GITHUB_OUTPUT"
          echo "Found $(wc -l < "$MANIFEST") manager APKs"
          ls -1 "$OUT_APKS"

      - name: Upload all manager APKs as one cross-blob
        uses: actions/upload-artifact@v7
        with:
          name: manager-apks
          path: manager_apks/
          if-no-files-found: warn

  publish-manager-artifacts:
    needs: list-manager-apks
    if: needs.list-manager-apks.outputs.apk_list != ''
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        item: ${{ fromJson(needs.list-manager-apks.outputs.apk_list) }}
    steps:
      - uses: actions/checkout@v7

      - name: Download manager cross-blob
        uses: actions/download-artifact@v7
        with:
          name: manager-apks
          path: manager_apks
          merge-multiple: true

      - name: Upload ${{ matrix.item.apk }} as its own artifact
        uses: actions/upload-artifact@v7
        with:
          name: manager-apk-${{ matrix.item.apk }}
          path: manager_apks/${{ matrix.item.apk }}
          if-no-files-found: error

  build-nomount-module:
    needs: resolve-sources
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        if: inputs.use_nomount

      - name: Clone NoMount source at pinned commit
        id: clone
        if: inputs.use_nomount
        shell: bash
        run: |
          set -euo pipefail
          COMMIT="${{ needs.resolve-sources.outputs.nomount_commit }}"
          if ! [[ "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
            echo "NoMount commit must be a full 40-character SHA." >&2
            exit 2
          fi
          echo "NoMount commit: ${COMMIT}"
          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"

      - name: Build NoMount metamodule (nm only, no .ko)
        if: inputs.use_nomount
        id: buildmod
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ steps.clone.outputs.commit }}

      - name: Upload NoMount metamodule
        if: inputs.use_nomount
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.buildmod.outputs.module_dir }}
          if-no-files-found: error
          compression-level: 0

  build-android12-5-10:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android12-5.10')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android12-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android12_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android13-5-10:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.10')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android13-5-15:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.15')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android14-5-15:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-5.15')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android14-6-1:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-6.1')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-6.1.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android15-6-6:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android15-6.6')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android15-6.6.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android15_6_6_resukisu || needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android16-6-12:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "!inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android16-6.12')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android16-6.12.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android16_6_12_resukisu || needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  update-verified-pins:
    if: "!inputs.test_release_notes && inputs.commit_mode == 'update'"
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    needs:
    - resolve-sources
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    steps:
    - uses: actions/checkout@v7
      with:
        ref: ${{ github.ref }}
        token: ${{ github.token }}

    - name: Promote verified pins on success
      id: promote
      shell: bash
      run: |
        set -euo pipefail
        python3 .github/scripts/update_verified_pins.py
      env:
        GH_TOKEN: ${{ github.token }}
        NOMOUNT_SHA: ${{ needs.resolve-sources.outputs.nomount_commit }}
        KERNELSU_SHA: ${{ needs.resolve-sources.outputs.ksu_commit }}
        RESUKISU_SHA: ${{ needs.resolve-sources.outputs.resukisu_commit }}
        APPROVE_NOMOUNT: ${{ inputs.use_nomount }}
        APPROVE_KERNELSU: ${{ (inputs.root_flavor == 'KernelSU' || inputs.root_flavor == 'All') }}
        APPROVE_RESUKISU: ${{ (inputs.root_flavor == 'ReSukiSU' || inputs.root_flavor == 'All') }}

    - name: Commit promoted pins
      if: always() && steps.promote.conclusion == 'success'
      shell: bash
      run: |
        set -euo pipefail
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        STAMP="$(date -u +%Y-%m-%dT%H%M%SZ)"
        git add .github/workflows/main.yml .github/pins/history
        if git diff --cached --quiet; then
          echo "No pin changes to commit."
          exit 0
        fi
        git commit -m "chore(pins): promote verified commits to latest built (${STAMP})"
        git push
  rej:
    if: "!inputs.test_release_notes && always()"
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12

    steps:
    - name: Download Misc Artifacts
      uses: actions/download-artifact@v7
      with:
        path: ./downloaded-artifacts
        pattern: '*-Rejects'
        merge-multiple: false

    - name: Process Reject Artifacts
      run: |
        mkdir -p aio-rejects

        # Iterate over Rejects artifacts in downloaded-artifacts
        for dir in ./downloaded-artifacts/*-Rejects; do
            [ -d "$dir" ] || continue

            dirname=$(basename "$dir")
            original_name=${dirname%-Rejects}
            source_dir="$dir"

            if [ -d "$dir/patch-rejects" ]; then
              source_dir="$dir/patch-rejects"
            fi

            mapfile -t rej_files < <(find "$source_dir" -type f -name '*.rej' | sort)
            filtered_rej_files=()
            for rej_file in "${rej_files[@]}"; do
              rel_rej="${rej_file#${source_dir}/}"
              rel_name="$(basename "$rel_rej")"
              if [ "$rel_rej" = "common/mm/rmap.c.rej" ] || [ "$rel_name" = "i2c-nomadik.c.rej" ]; then
                echo "Skipping $rel_rej because it is an ignored reject file"
                continue
              fi
              filtered_rej_files+=("$rej_file")
            done

            if [ "${#filtered_rej_files[@]}" -eq 0 ]; then
              echo "Skipping $dirname because it only contains ignored reject files"
              continue
            fi

            mkdir -p "aio-rejects/$original_name"

            if [ -d "$dir/patch-rejects" ]; then
              cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/"
            else
              cp -r "$dir/." "aio-rejects/$original_name/"
            fi

            find "aio-rejects/$original_name" -type f -name 'i2c-nomadik.c.rej' -delete
        done

        if [ "$(ls -A aio-rejects)" ]; then
            cd aio-rejects
            zip -r -q -9 ../AIO-REJ.zip .
            cd ..
        else
            echo "No rejects found to upload."
        fi

    - name: Rejects Summary
      run: |
        echo "Reject artifacts were collected locally only and are not uploaded." >> "$GITHUB_STEP_SUMMARY"

    - name: Upload AIO-REJ Artifact
      uses: actions/upload-artifact@v7
      with:
        name: AIO-REJ
        path: AIO-REJ.zip
        if-no-files-found: ignore

  release:
    runs-on: ubuntu-latest
    if: always() && github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.release_type == 'Pre-Release' || inputs.release_type == 'Release')
    permissions:
      contents: write
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    - build-nomount-module
    - publish-manager-artifacts

    env:
      GH_TOKEN: ${{ github.token }}
    outputs:
      new_tag: ${{ steps.tag.outputs.new_tag }}
    steps:
    - name: Validate Selected Builds
      run: |
        set -euo pipefail

        failed=0
        current_type="${{ inputs.kernel_build_version }}"

        check_selected() {
          local target="$1"
          local job_name="$2"
          local result="$3"
          
          if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then
            if [[ "$result" != "success" ]]; then
              echo "Required job $job_name did not succeed (result: $result)"
              failed=1
            fi
          fi
        }

        check_selected "android12-5.10" "build-android12-5-10" "${{ needs.build-android12-5-10.result }}"
        check_selected "android13-5.10" "build-android13-5-10" "${{ needs.build-android13-5-10.result }}"
        check_selected "android13-5.15" "build-android13-5-15" "${{ needs.build-android13-5-15.result }}"
        check_selected "android14-5.15" "build-android14-5-15" "${{ needs.build-android14-5-15.result }}"
        check_selected "android14-6.1" "build-android14-6-1" "${{ needs.build-android14-6-1.result }}"
        check_selected "android15-6.6" "build-android15-6-6" "${{ needs.build-android15-6-6.result }}"
        check_selected "android16-6.12" "build-android16-6-12" "${{ needs.build-android16-6-12.result }}"

        if [[ "$failed" -ne 0 ]]; then
          exit 1
        fi

    - name: Free Disk Space
      if: true
      uses: endersonmenezes/free-disk-space@v3  # Use @main for latest, @v3 for stable
      with:
        remove_android: true
        remove_dotnet: true
        remove_haskell: true
        remove_tool_cache: true
        remove_swap: true
        remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
        remove_packages_one_command: true
        remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
        rm_cmd: "rmz"  # Use 'rmz' for faster deletion (default: 'rm')
        rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
        testing: false

    - name: Checkout code
      uses: actions/checkout@v7

    - name: Generate New Tag
      id: tag
      if: inputs.release_type != 'Action'
      run: |
        mapfile -t RELEASE_TAGS < <(gh api --paginate "repos/${{ github.repository }}/tags?per_page=100" --jq '.[].name' 2>/dev/null | grep -E '^r[0-9]+$' || true)

        LATEST_REV=0
        for TAG in "${RELEASE_TAGS[@]}"; do
          REV="${TAG#r}"
          if [[ "$REV" =~ ^[0-9]+$ && "$REV" -gt "$LATEST_REV" ]]; then
            LATEST_REV="$REV"
          fi
        done

        if [[ "$LATEST_REV" -gt 0 ]]; then
          NEW_TAG="r$((LATEST_REV + 1))"
        else
          NEW_TAG="r1"
        fi

        if [[ ${#RELEASE_TAGS[@]} -gt 0 ]]; then
          echo "Latest r-tag: r${LATEST_REV}"
        else
          echo "No existing r-tags found; starting at r1"
        fi
        echo "New tag: $NEW_TAG"
        echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV
        echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT

    - name: Set Release Title
      id: release_meta
      run: |
        set -euo pipefail

        # Format release title: convert rN -> Release N
        if [[ "${NEW_TAG}" =~ ^r([0-9]+)$ ]]; then
          REV_NUM="${BASH_REMATCH[1]}"
          release_title="Release ${REV_NUM}"
        else
          release_title="Release ${NEW_TAG}"
        fi

        echo "release_title=$release_title" >> "$GITHUB_OUTPUT"

    - name: Extract KernelSU Version Info
      id: ksu_version
      run: |
        set -euo pipefail

        KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
        KSU_INPUT="dev-susfs"

        # Try as branch first, fall back to commit
        if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
          echo "Cloning KernelSU-Next from branch: $KSU_INPUT"
          git clone --branch "$KSU_INPUT" "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          KSUN_COMMIT=$(git rev-parse HEAD)
        else
          echo "Cloning KernelSU-Next from dev-susfs branch, then checking out commit: $KSU_INPUT"
          git clone --branch dev-susfs "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          git fetch --depth=50 origin "$KSU_INPUT"
          git checkout "$KSU_INPUT"
          KSUN_COMMIT="$KSU_INPUT"
        fi

        # The manager is built on the OFFICIAL KernelSU-Next repo
        # (pershoot's workflows are all disabled). Find the official dev
        # commit this fork's branch is synced with (merge-base of our
        # branch vs official dev), then link the manager build run for
        # that commit. pershoot's own dev branch is intentionally ignored.
        retry() {
          local n=0
          until [ "$n" -ge 5 ]; do
            "$@" && return 0
            n=$((n+1))
            echo "retry $n/5 failed for: $*" >&2
            sleep 5
          done
          return 1
        }

        OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git"
        retry git fetch "$OFFICIAL_KSU_REPO" dev
        STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD)
        echo "KSU Stock Commit (official sync point): $STOCK_COMMIT"

        # Extract version info - anchored to the official sync point
        # (STOCK_COMMIT), i.e. the commit the linked manager is built from.
        # Mirrors pershoot c0a2c5fd: count the merge-base with origin, not
        # the fork's extra commits, so the version shown in the release
        # notes matches what the kernel reports and the manager displays.
        COMMITS_COUNT=$(git rev-list --count "$STOCK_COMMIT")
        BASE_VERSION=30000
        KSU_VERSION=$(expr $COMMITS_COUNT "+" $BASE_VERSION)

        # Extract git tag at the sync point
        KSU_GIT_TAG=$(git describe --tags --abbrev=0 "$STOCK_COMMIT" 2>/dev/null || echo "no-tag")

        MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" | jq -r '.workflow_runs[0].id // empty')
        if [[ -n "${MANAGER_RUN_ID:-}" ]]; then
          KSU_MANAGER="https://github.com/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}"
          KSU_MANAGER_NOTE="built from stock dev commit ${STOCK_COMMIT:0:12} (exact match)"
        else
          # Validated up-front in resolve-sources; a release cannot proceed without
          # the exact manager run. Fail rather than link a mismatched manager.
          echo "ERROR: exact manager build no longer available for ${STOCK_COMMIT}" >&2
          exit 1
        fi

        echo "Commits count: $COMMITS_COUNT"
        echo "KSU Version: $KSU_VERSION"
        echo "KSU Git Tag: $KSU_GIT_TAG"
        echo "KSU Manager: $KSU_MANAGER"

        # Export as environment for next step
        echo "KSUN_BRANCH=$KSU_INPUT" >> $GITHUB_ENV
        echo "KSUN_COMMIT=$KSUN_COMMIT" >> $GITHUB_ENV
        echo "KSU_COMMITS_COUNT=$COMMITS_COUNT" >> $GITHUB_ENV
        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
        echo "KSU_MANAGER=$KSU_MANAGER" >> $GITHUB_ENV
        echo "KSU_MANAGER_NOTE=${KSU_MANAGER_NOTE:-}" >> $GITHUB_ENV
        echo "MANAGER_RUN_ID=$MANAGER_RUN_ID" >> $GITHUB_ENV

    - name: Set release body
      env:
        ROOT_FLAVOR: ${{ inputs.root_flavor }}
        FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }}
        MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
        USE_SUSFS: ${{ inputs.use_susfs }}
        USE_BBG: ${{ inputs.use_bbg }}
        USE_DS: ${{ inputs.use_ds }}
        USE_NET: ${{ inputs.use_net }}
        USE_NTSYNC: ${{ inputs.use_ntsync }}
        USE_PTRACE: ${{ inputs.use_ptrace }}
        USE_UNICODE: ${{ inputs.use_unicode }}
        USE_BPF: ${{ inputs.use_bpf }}
      run: |
        set -e

        : > release_body.md

        python3 - <<'PYEOF' > release_body.md
        import json
        import os
        from pathlib import Path

        def env(name, default=""):
            return os.environ.get(name, default).strip()

        def parse_managers(raw):
            raw = raw.strip()
            if not raw:
                return []
            try:
                data = json.loads(raw)
            except json.JSONDecodeError:
                return []
            return data if isinstance(data, list) else []

        def build_preamble():
            return (
                "# Wild Kernels for GKI2 Devices\n\n"
                "> [!CAUTION]\n"
                "> This software is provided for testing and educational purposes only. "
                "Use at your own risk. The developers are not responsible for any damage, "
                "data loss, or issues that may occur. Please ensure you have proper backups "
                "before installation.\n\n"
                "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
                "---\n\n"
            )

        def build_managers_section(managers):
            if not managers:
                return ""
            flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
            lines = []
            for m in managers:
                flavor = m.get("flavor", "")
                label = flavor_labels.get(flavor, flavor or "unknown")
                run_id = m.get("run_id")
                stock = m.get("stock", "")
                if run_id:
                    url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}"
                    stock_note = f" (stock `{stock[:12]}`)" if stock else ""
                    lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
                else:
                    lines.append(f"- **{label}:** release assets")
            return "**Managers:**\n" + "\n".join(lines) + "\n"

        def build_ksu_section():
            version = env("KSU_VERSION", "unknown")
            tag = env("KSU_GIT_TAG", "no-tag")
            branch = env("KSUN_BRANCH", "dev")
            commit = env("KSUN_COMMIT", "unknown")
            manager_url = env("KSU_MANAGER", "")
            manager_note = env("KSU_MANAGER_NOTE", "")
            parts = ["## KernelSU", ""]
            parts.append(f"- **Version:** `{version}`")
            if tag and tag != "no-tag":
                parts.append(f"- **Tag:** `{tag}`")
            parts.append(f"- **Branch:** `{branch}`")
            parts.append(f"- **Commit:** `{commit}`")
            if manager_url:
                note = f" - {manager_note}" if manager_note else ""
                base = manager_url.split("/actions/")[0]
                parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
            parts.append("")
            return "\n".join(parts)

        def build_susfs_section():
            variant_envs = [
                ("android12-5.10", "susfs_commit_android12_5_10"),
                ("android13-5.10", "susfs_commit_android13_5_10"),
                ("android13-5.15", "susfs_commit_android13_5_15"),
                ("android14-5.15", "susfs_commit_android14_5_15"),
                ("android14-6.1", "susfs_commit_android14_6_1"),
                ("android15-6.6", "susfs_commit_android15_6_6"),
                ("android16-6.12", "susfs_commit_android16_6_12"),
            ]
            per_variant = []
            for variant, env_key in variant_envs:
                sha = env(env_key)
                if sha and len(sha) == 40:
                    per_variant.append((variant, sha))
            if per_variant:
                parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""]
                for variant, sha in per_variant:
                    parts.append(f"- **{variant}:** `{sha}`")
                parts.append("")
                return "\n".join(parts)
            sha = env("SUSFS_COMMIT", "")
            if sha:
                return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
            return ""

        def build_root_section():
            root_flavor = env("ROOT_FLAVOR", "unknown")
            feature_set = env("FEATURE_SET", "")
            parts = ["## This Build", ""]
            parts.append(f"- **Root:** `{root_flavor}`")
            if feature_set:
                parts.append(f"- **Feature Set:** `{feature_set}`")
            parts.append("")
            return "\n".join(parts)

        def build_features_section():
            enabled = []
            if env("USE_SUSFS", "true") == "true":
                enabled.append("SUSFS")
            if env("USE_BBG", "true") == "true":
                enabled.append("Baseband Guard")
            if env("USE_DS", "true") == "true":
                enabled.append("DroidSpaces-OSS")
            if env("USE_NET", "true") == "true":
                enabled.append("Networking")
            if env("USE_NTSYNC", "true") == "true":
                enabled.append("NTSync")
            if env("USE_PTRACE", "true") == "true":
                enabled.append("Ptrace Leak Fix")
            if env("USE_UNICODE", "true") == "true":
                enabled.append("Unicode Fix")
            if env("USE_BPF", "true") == "true":
                enabled.append("BTF / eBPF / FUSE-BPF")
            if env("USE_PERF", "true") == "true":
                enabled.append("Performance Tuning")
            if not enabled:
                return ""
            parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""]
            feature_doc_map = [
                ("SUSFS", "susfs.md"),
                ("Baseband Guard", "bbg.md"),
                ("DroidSpaces-OSS", "droidspaces.md"),
                ("Networking", "networking.md"),
                ("NTSync", "ntsync.md"),
                ("Ptrace Leak Fix", "ptrace.md"),
                ("Unicode Fix", "unicode.md"),
                ("BTF / eBPF / FUSE-BPF", "bpf.md"),
                ("Performance Tuning", "performance.md"),
            ]
            for feature, doc in feature_doc_map:
                if feature in enabled:
                    parts.append(f"- [{feature}](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/{doc})")
            parts.append("")
            return "\n".join(parts)

        def build_install_section():
            return (
                "## Install with Kernel Flasher\n\n"
                "> [!NOTE]\n"
                "> This method is more convenient when upgrading KernelSU and can be done without a computer. Make a backup first.\n\n"
                "**Steps:**\n\n"
                "1. **Download the AnyKernel3 ZIP.** If you don\'t know which file to download, carefully read the description of KMI and Security patch level in this document.\n"
                "2. **Open the Kernel Flasher app**, grant necessary root permissions, and use the provided AnyKernel3 ZIP to flash.\n\n"
                "This requires the [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) app to have root permissions. "
                "Other apps that can be used include [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) and [PixelFlasher](https://github.com/badabing2005/PixelFlasher). "
                "Full guide: [docs/installation.md](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/installation.md)\n"
            )

        def render():
            parts = []
            parts.append(build_preamble())
            parts.append(build_root_section())
            parts.append(build_ksu_section())
            parts.append(build_susfs_section())
            parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
            parts.append(build_features_section())
            parts.append(build_install_section())
            return "\n".join(parts)

        output = render()
        print(output, end="")
        summary = os.environ.get("GITHUB_STEP_SUMMARY")
        if summary:
            Path(summary).write_text(output)
        PYEOF

    - name: Publish release notes preview
      run: |
        {
          echo "## Release Notes Preview"
          echo
          cat release_body.md
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Upload release notes artifact
      uses: actions/upload-artifact@v7
      with:
        name: release-notes
        path: release_body.md
        retention-days: 7
        if-no-files-found: error

    - name: Download Manager APK zips
      uses: actions/download-artifact@v7
      with:
        path: release-assets/manager
        pattern: 'manager-apk-*'
        merge-multiple: true
        if-no-files-found: ignore

    - name: Download AnyKernel3 Artifacts
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*-AnyKernel3'
        merge-multiple: false

    - name: Download NoMount metamodule
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*NoMount-Metamodule'
        merge-multiple: false
        if-no-files-found: ignore

    - name: Zip AnyKernel3 for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*-AnyKernel3; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Zip NoMount Metamodule for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*NoMount-Metamodule; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ steps.tag.outputs.new_tag }}
        name: ${{ steps.release_meta.outputs.release_title }}
        body_path: release_body.md
        draft: false
        prerelease: ${{ inputs.release_type == 'Pre-Release' }}
        files: |
          release-assets/**/*.zip
          release-assets/**/*-boot*.img

  notes-preview:
    if: always() && github.event_name == 'workflow_dispatch'
    needs: [resolve-sources, build-android12-5-10, build-android13-5-10, build-android13-5-15, build-android14-5-15, build-android14-6-1, build-android15-6-6, build-android16-6-12, release]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Render release notes preview (always)
        env:
          ROOT_FLAVOR: ${{ inputs.root_flavor }}
          FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }}
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          USE_SUSFS: ${{ inputs.use_susfs }}
          USE_BBG: ${{ inputs.use_bbg }}
          USE_DS: ${{ inputs.use_ds }}
          USE_NET: ${{ inputs.use_net }}
          USE_NTSYNC: ${{ inputs.use_ntsync }}
          USE_PTRACE: ${{ inputs.use_ptrace }}
          USE_UNICODE: ${{ inputs.use_unicode }}
          USE_BPF: ${{ inputs.use_bpf }}
          # KSU version not computed here; render will show placeholder if release job skipped
        run: |
          set -e
          python3 - <<'PYEOF' > release_body.md
          import json
          import os
          from pathlib import Path

          def env(name, default=""):
              return os.environ.get(name, default).strip()

          def parse_managers(raw):
              raw = raw.strip()
              if not raw:
                  return []
              try:
                  data = json.loads(raw)
              except json.JSONDecodeError:
                  return []
              return data if isinstance(data, list) else []

          def build_preamble():
              return (
                  "# Wild Kernels for GKI2 Devices\n\n"
                  "> [!CAUTION]\n"
                  "> This software is provided for testing and educational purposes only. "
                  "Use at your own risk. The developers are not responsible for any damage, "
                  "data loss, or issues that may occur. Please ensure you have proper backups "
                  "before installation.\n\n"
                  "Join the Telegram group: <https://t.me/WildKernelsTG>\n\n"
                  "---\n\n"
              )

          def build_managers_section(managers):
              if not managers:
                  return ""
              flavor_labels = {"next": "KernelSU-Next", "kernelsu": "KernelSU", "resukisu": "ReSukiSU"}
              lines = []
              for m in managers:
                  flavor = m.get("flavor", "")
                  label = flavor_labels.get(flavor, flavor or "unknown")
                  run_id = m.get("run_id")
                  stock = m.get("stock", "")
                  if run_id:
                      url = f"https://github.com/{m.get('owner','')}/{m.get('repo','')}/actions/runs/{run_id}"
                      stock_note = f" (stock `{stock[:12]}`)" if stock else ""
                      lines.append(f"- **{label}:** [{url}]({url}){stock_note}")
                  else:
                      lines.append(f"- **{label}:** release assets")
              return "**Managers:**\n" + "\n".join(lines) + "\n"

          def build_ksu_section():
              version = env("KSU_VERSION", "unknown")
              tag = env("KSU_GIT_TAG", "no-tag")
              branch = env("KSUN_BRANCH", "dev")
              commit = env("KSUN_COMMIT", "unknown")
              manager_url = env("KSU_MANAGER", "")
              manager_note = env("KSU_MANAGER_NOTE", "")
              parts = ["## KernelSU", ""]
              parts.append(f"- **Version:** `{version}`")
              if tag and tag != "no-tag":
                  parts.append(f"- **Tag:** `{tag}`")
              parts.append(f"- **Branch:** `{branch}`")
              parts.append(f"- **Commit:** `{commit}`")
              if manager_url:
                  note = f" - {manager_note}" if manager_note else ""
                  base = manager_url.split("/actions/")[0]
                  parts.append(f"- **Manager:** [{base}]({manager_url}){note}")
              parts.append("")
              return "\n".join(parts)

          def build_susfs_section():
              variant_envs = [
                  ("android12-5.10", "susfs_commit_android12_5_10"),
                  ("android13-5.10", "susfs_commit_android13_5_10"),
                  ("android13-5.15", "susfs_commit_android13_5_15"),
                  ("android14-5.15", "susfs_commit_android14_5_15"),
                  ("android14-6.1", "susfs_commit_android14_6_1"),
                  ("android15-6.6", "susfs_commit_android15_6_6"),
                  ("android16-6.12", "susfs_commit_android16_6_12"),
              ]
              per_variant = []
              for variant, env_key in variant_envs:
                  sha = env(env_key)
                  if sha and len(sha) == 40:
                      per_variant.append((variant, sha))
              if per_variant:
                  parts = ["## SUSFS", "", "Pinned SUSFS commits per Android/kernel variant:", ""]
                  for variant, sha in per_variant:
                      parts.append(f"- **{variant}:** `{sha}`")
                  parts.append("")
                  return "\n".join(parts)
              sha = env("SUSFS_COMMIT", "")
              if sha:
                  return f"## SUSFS\n\n- **Commit:** `{sha}`\n"
              return ""

          def build_root_section():
              root_flavor = env("ROOT_FLAVOR", "unknown")
              feature_set = env("FEATURE_SET", "")
              parts = ["## This Build", ""]
              parts.append(f"- **Root:** `{root_flavor}`")
              if feature_set:
                  parts.append(f"- **Feature Set:** `{feature_set}`")
              parts.append("")
              return "\n".join(parts)

          def build_features_section():
              enabled = []
              if env("USE_SUSFS", "true") == "true":
                  enabled.append("SUSFS")
              if env("USE_BBG", "true") == "true":
                  enabled.append("Baseband Guard")
              if env("USE_DS", "true") == "true":
                  enabled.append("DroidSpaces-OSS")
              if env("USE_NET", "true") == "true":
                  enabled.append("Networking")
              if env("USE_NTSYNC", "true") == "true":
                  enabled.append("NTSync")
              if env("USE_PTRACE", "true") == "true":
                  enabled.append("Ptrace Leak Fix")
              if env("USE_UNICODE", "true") == "true":
                  enabled.append("Unicode Fix")
              if env("USE_BPF", "true") == "true":
                  enabled.append("BTF / eBPF / FUSE-BPF")
              if env("USE_PERF", "true") == "true":
                  enabled.append("Performance Tuning")
              if not enabled:
                  return ""
              parts = ["## Features Included", "", "See [Kernel Features Documentation](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/features.md) for full details.", ""]
              feature_doc_map = [
                  ("SUSFS", "susfs.md"),
                  ("Baseband Guard", "bbg.md"),
                  ("DroidSpaces-OSS", "droidspaces.md"),
                  ("Networking", "networking.md"),
                  ("NTSync", "ntsync.md"),
                  ("Ptrace Leak Fix", "ptrace.md"),
                  ("Unicode Fix", "unicode.md"),
                  ("BTF / eBPF / FUSE-BPF", "bpf.md"),
                  ("Performance Tuning", "performance.md"),
              ]
              for feature, doc in feature_doc_map:
                  if feature in enabled:
                      parts.append(f"- [{feature}](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/{doc})")
              parts.append("")
              return "\n".join(parts)

          def build_install_section():
              return (
                  "## Install with Kernel Flasher\n\n"
                  "> [!NOTE]\n"
                  "> This method is more convenient when upgrading KernelSU and can be done without a computer. Make a backup first.\n\n"
                  "**Steps:**\n\n"
                  "1. **Download the AnyKernel3 ZIP.** If you don\'t know which file to download, carefully read the description of KMI and Security patch level in this document.\n"
                  "2. **Open the Kernel Flasher app**, grant necessary root permissions, and use the provided AnyKernel3 ZIP to flash.\n\n"
                  "This requires the [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) app to have root permissions. "
                  "Other apps that can be used include [Kernel Flasher](https://github.com/fatalcoder524/KernelFlasher) and [PixelFlasher](https://github.com/badabing2005/PixelFlasher). "
                  "Full guide: [docs/installation.md](https://github.com/WildKernels/GKI_KernelSU_SUSFS/blob/dev/docs/installation.md)\n"
              )

          def render():
              parts = []
              parts.append(build_preamble())
              parts.append(build_root_section())
              parts.append(build_ksu_section())
              parts.append(build_susfs_section())
              parts.append(build_managers_section(parse_managers(env("MANAGER_LIST", ""))))
              parts.append(build_features_section())
              parts.append(build_install_section())
              return "\n".join(parts)

          output = render()
          print(output, end="")
          PYEOF
          {
            echo "## Release Notes Preview (CI Summary)"
            echo
            cat release_body.md
          } >> "$GITHUB_STEP_SUMMARY"
      - name: Upload release notes preview artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-notes-preview
          path: release_body.md
          retention-days: 7
          if-no-files-found: warn