GKI_KernelSU_SUSFS/.github/workflows/gki-kernel.yml

name: GKI Kernel Build
permissions:
  contents: write  # Allow writing to repository contents (for pushing tags)
  actions: write   # Allows triggering actions

on:
  workflow_call: # This allows this workflow to be called from another workflow
    inputs:
      android_version:
        required: true
        type: string
      kernel_version:
        required: true
        type: string
      sub_level:
        required: true
        type: string
      os_patch_level:
        required: true
        type: string
      runner:
        required: true
        type: string
      lto_type:
        required: true
        type: string
      kernelsu_variant:
        required: true
        type: string
      kernelsu_branch:
        required: true
        type: string
      kernelsu_branch_other:
        required: false
        type: string

jobs:
  build-kernel-kernelsu-susfs:
    runs-on: ${{ inputs.runner }}

    steps:
      - name: Maximize build space
        if: ${{ inputs.runner == 'ubuntu-22.04' }}
        uses: easimon/maximize-build-space@master
        with:
          root-reserve-mb: 8192
          temp-reserve-mb: 2048
          swap-size-mb: 8192
          remove-dotnet: "true"
          remove-android: "true"
          remove-haskell: "true"
          remove-codeql: "true"

      - name: Clean up workspace
        run: rm -rf ${{ github.workspace }}/*

      - name: Set CONFIG Environment Variable
        run: |
          # Set CONFIG dynamically based on inputs values
          CONFIG="${{ inputs.android_version }}-${{ inputs.kernel_version }}-${{ inputs.sub_level }}"

          # Set CONFIG as an environment variable for future steps
          echo "CONFIG=$CONFIG" >> $GITHUB_ENV

          echo "CONFIG set to: $CONFIG"

      - name: Cache toolchain
        id: cache-toolchain
        uses: actions/cache@v4
        with:
          path: |
            kernel-build-tools
            mkbootimg
          key: toolchain-${{ runner.os }}-v1

      # Step 2: Download toolchain if cache was not found
      - name: Download toolchain (if cache not found)
        if: steps.cache-toolchain.outputs.cache-hit != 'true'
        run: |
          AOSP_MIRROR=https://android.googlesource.com
          BRANCH=main-kernel-build-2024
          git clone $AOSP_MIRROR/kernel/prebuilts/build-tools -b $BRANCH --depth 1 kernel-build-tools
          git clone $AOSP_MIRROR/platform/system/tools/mkbootimg -b $BRANCH --depth 1 mkbootimg

      - name: Set environment variables
        run: |
          echo "AVBTOOL=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/bin/avbtool" >> $GITHUB_ENV
          echo "MKBOOTIMG=$GITHUB_WORKSPACE/mkbootimg/mkbootimg.py" >> $GITHUB_ENV
          echo "UNPACK_BOOTIMG=$GITHUB_WORKSPACE/mkbootimg/unpack_bootimg.py" >> $GITHUB_ENV

      - name: Set boot sign key
        env:
          BOOT_SIGN_KEY: ${{ secrets.BOOT_SIGN_KEY }}
        run: |
          if [ ! -z "$BOOT_SIGN_KEY" ]; then
            echo "$BOOT_SIGN_KEY" > ./kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem
            echo "BOOT_SIGN_KEY_PATH=$GITHUB_WORKSPACE/kernel-build-tools/linux-x86/share/avb/testkey_rsa2048.pem" >> $GITHUB_ENV
          else
            echo "BOOT_SIGN_KEY is not set. Exiting..."
            exit 1
          fi

      - name: Install Repo
        run: |
          # Install dependencies
          mkdir -p ./git-repo
          curl https://storage.googleapis.com/git-repo-downloads/repo > ./git-repo/repo
          chmod a+rx ./git-repo/repo
          echo "REPO=$GITHUB_WORKSPACE/./git-repo/repo" >> $GITHUB_ENV

      - name: Clone AnyKernel3 and Other Dependencies
        run: |
          echo "Cloning AnyKernel3 and other dependencies..."

          # Define the branch names using the inputs values
          SUSFS_BRANCH="gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}"

          # Debug print the branches
          echo "Using branch for SUSFS: $SUSFS_BRANCH"

          # Clone repositories using the branch names
          git clone https://github.com/WildPlusKernel/AnyKernel3.git -b "gki"
          git clone https://gitlab.com/simonpunk/susfs4ksu.git -b "$SUSFS_BRANCH"
          git clone https://github.com/WildPlusKernel/kernel_patches.git

      - name: Set CONFIG Environment Variable
        run: |
          # Set CONFIG dynamically based on inputs values
          CONFIG="${{ inputs.android_version }}-${{ inputs.kernel_version }}-${{ inputs.sub_level }}"

          # Set CONFIG as an environment variable for future steps
          echo "CONFIG=$CONFIG" >> $GITHUB_ENV

          echo "CONFIG set to: $CONFIG"

      - name: Initialize and Sync Kernel Source
        run: |
          echo "Creating folder for configuration: $CONFIG..."
          mkdir -p "$CONFIG"
          cd "$CONFIG"

          # Initialize and sync kernel source
          echo "Initializing and syncing kernel source..."
          FORMATTED_BRANCH="${{ inputs.android_version }}-${{ inputs.kernel_version }}-${{ inputs.os_patch_level }}"
          $REPO init --depth=1 --u https://android.googlesource.com/kernel/manifest -b common-${FORMATTED_BRANCH} --repo-rev=v2.16

          REMOTE_BRANCH=$(git ls-remote https://android.googlesource.com/kernel/common ${FORMATTED_BRANCH})
          DEFAULT_MANIFEST_PATH=.repo/manifests/default.xml

          # Check if branch is deprecated
          if grep -q deprecated <<< $REMOTE_BRANCH; then
            echo "Found deprecated branch: $FORMATTED_BRANCH"
            sed -i "s/\"${FORMATTED_BRANCH}\"/\"deprecated\/${FORMATTED_BRANCH}\"/g" $DEFAULT_MANIFEST_PATH
          fi

          # Sync repo and apply patches
          $REPO --version
          $REPO --trace sync -c -j$(nproc --all) --no-tags --fail-fast

      - name: Determine the branch for KernelSU
        run: |
          if [[ "${{ inputs.kernelsu_branch }}" == "Stable" ]]; then
              echo "BRANCH=-" >> $GITHUB_ENV
          elif [[ "${{ inputs.kernelsu_branch }}" == "Dev" && ( "${{ inputs.kernelsu_variant }}" == "Official" || "${{ inputs.kernelsu_variant }}" == "MKSU" ) ]]; then
              echo "BRANCH=-s main" >> $GITHUB_ENV
          elif [[ "${{ inputs.kernelsu_branch }}" == "Dev" && "${{ inputs.kernelsu_variant }}" == "Next" ]]; then
              echo "BRANCH=-s next" >> $GITHUB_ENV
          elif [[ "${{ inputs.kernelsu_branch }}" == "Other" && -n "${{ inputs.kernelsu_branch_other }}" ]]; then
            echo "BRANCH=-s ${{ inputs.kernelsu_branch_other }}" >> $GITHUB_ENV
          else
            echo "Error: Custom branch not provided for 'Other'" >&2
            exit 1
          fi
      
      - name: Add KernelSU
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd "$CONFIG"

          if [ "${{ inputs.kernelsu_variant }}" == "Official" ]; then
            echo "Adding KernelSU Official..."
            curl -LSs "https://raw.githubusercontent.com/tiann/KernelSU/main/kernel/setup.sh" | bash $BRANCH
          elif [ "${{ inputs.kernelsu_variant }}" == "Next" ]; then
            echo "Adding KernelSU Next..."
            curl -LSs "https://raw.githubusercontent.com/rifsxd/KernelSU-Next/next/kernel/setup.sh" | bash $BRANCH
          elif [ "${{ inputs.kernelsu_variant }}" == "MKSU" ]; then
            echo "Adding KernelSU MKSU..."
            curl -LSs "https://raw.githubusercontent.com/5ec1cff/KernelSU/main/kernel/setup.sh" | bash $BRANCH

            # Revert commit of remove pts_unix98_lookup_pre
            cd KernelSU
            git revert -m 1 $(git log --grep="remove devpts hook" --pretty=format:"%h") -n
            KSU_VERSION=$(expr $(/usr/bin/git rev-list --count HEAD) "+" 12063)
            echo "KSUVER=$KSU_VERSION" >> $GITHUB_ENV
            sed -i "s/DKSU_VERSION=16/DKSU_VERSION=${KSU_VERSION}/" kernel/Makefile
          else
            echo "Invalid KernelSU variant selected!"
            exit 1
          fi

      - name: Apply SUSFS Patches for KernelSU Variants
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd "$CONFIG"
          
          echo "Applying SUSFS patches..."
          
          # Copy SUSFS patches
          cp ../susfs4ksu/kernel_patches/50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch ./common/
          cp ../susfs4ksu/kernel_patches/fs/* ./common/fs/
          cp ../susfs4ksu/kernel_patches/include/linux/* ./common/include/linux/

          if [ "${{ inputs.kernelsu_variant }}" == "Official" ]; then
            echo "Applying SUSFS patches for Official KernelSU..."
            cp ../susfs4ksu/kernel_patches/KernelSU/10_enable_susfs_for_ksu.patch ./KernelSU/
            cd ./KernelSU
            patch -p1 --forward < 10_enable_susfs_for_ksu.patch
          elif [ "${{ inputs.kernelsu_variant }}" == "Next" ]; then
            echo "Applying SUSFS patches for KernelSU-Next..."
            cd ./KernelSU-Next
            cp ../../kernel_patches/KernelSU-Next-Implement-SUSFS-v1.5.5-Universal.patch ./
            patch -p1 --forward < KernelSU-Next-Implement-SUSFS-v1.5.5-Universal.patch || true
          elif [ "${{ inputs.kernelsu_variant }}" == "MKSU" ]; then
            echo "Applying SUSFS patches for MKSU..."
            cp ../susfs4ksu/kernel_patches/KernelSU/10_enable_susfs_for_ksu.patch ./KernelSU/
            cd ./KernelSU
            patch -p1 --forward < 10_enable_susfs_for_ksu.patch || true
            
            echo "Applying MKSU specific SUSFS patch..."
            cp ../../kernel_patches/mksu_susfs.patch ../KernelSU/
            patch -p1 < mksu_susfs.patch
          else
            echo "Invalid KernelSU variant selected!"
            exit 1
          fi

          # Change to common directory and apply common SUSFS patch
          cd ../common
          patch -p1 < 50_add_susfs_in_gki-${{ inputs.android_version }}-${{ inputs.kernel_version }}.patch || true

      - name: Apply Hide Stuff Patches
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd "$CONFIG/common"
          # Apply additional patch
          cp ../../kernel_patches/69_hide_stuff.patch ./
          patch -p1 -F 3 < 69_hide_stuff.patch
            
      - name: Add SUSFS Configuration Settings
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd "$CONFIG"

          echo "Adding configuration settings to gki_defconfig..."

          # Add SUSFS configuration settings
          echo "CONFIG_KSU=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_HAS_MAGIC_MOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SUS_PATH=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SUS_MOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_AUTO_ADD_SUS_KSU_DEFAULT_MOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_AUTO_ADD_SUS_BIND_MOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SUS_KSTAT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SUS_OVERLAYFS=n" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_TRY_UMOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_AUTO_ADD_TRY_UMOUNT_FOR_BIND_MOUNT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SPOOF_UNAME=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_ENABLE_LOG=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SPOOF_CMDLINE_OR_BOOTCONFIG=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_OPEN_REDIRECT=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_KSU_SUSFS_SUS_SU=y" >> ./common/arch/arm64/configs/gki_defconfig

          # Add additional tmpfs config setting
          echo "CONFIG_TMPFS_XATTR=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_TMPFS_POSIX_ACL=y" >> ./common/arch/arm64/configs/gki_defconfig

          # Add additional tmpfs config setting
          echo "CONFIG_IP_NF_TARGET_TTL=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_IP6_NF_TARGET_HL=y" >> ./common/arch/arm64/configs/gki_defconfig
          echo "CONFIG_IP6_NF_MATCH_HL=y" >> ./common/arch/arm64/configs/gki_defconfig

          # Remove check_defconfig
          sed -i 's/check_defconfig//' ./common/build.config.gki

      - name: Build the Kernel
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd "$CONFIG"

          sed -i '$s|echo "\$res"|echo "\$res-Wild+"|' ./common/scripts/setlocalversion

          # Run perl command to modify UTS_VERSION
          perl -pi -e 's{UTS_VERSION="\$\(echo \$UTS_VERSION \$CONFIG_FLAGS \$TIMESTAMP \| cut -b -\$UTS_LEN\)"}{UTS_VERSION="#1 SMP PREEMPT Sat Apr 20 04:20:00 UTC 2024"}' ./common/scripts/mkcompile_h

          echo "Building the kernel..."
          if [ -f "build/build.sh" ]; then
            sed -i 's/-dirty//' ./common/scripts/setlocalversion
            LTO=${{ inputs.lto_type }} BUILD_CONFIG=common/build.config.gki.aarch64 build/build.sh
          else
            rm -rf ./common/android/abi_gki_protected_exports_*
            sed -i "/stable_scmversion_cmd/s/-maybe-dirty//g" ./build/kernel/kleaf/impl/stamp.bzl
            sed -i 's/^CONFIG_LOCALVERSION=.*/CONFIG_LOCALVERSION="-Wild+"/' ./common/scripts/setlocalversion
            tools/bazel build --config=fast --lto=${{ inputs.lto_type }} //common:kernel_aarch64_dist
          fi

      - name: Create Bootimgs Folder and Copy Images
        if: ${{ inputs.android_version == 'android12' || inputs.android_version == 'android13' }}
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          mkdir bootimgs

          echo "Creating bootimgs folder and copying images..."
          cp ./$CONFIG/out/${{ inputs.android_version }}-${{ inputs.kernel_version }}/dist/Image ./bootimgs
          cp ./$CONFIG/out/${{ inputs.android_version }}-${{ inputs.kernel_version }}/dist/Image.lz4 ./bootimgs
          cp ./$CONFIG/out/${{ inputs.android_version }}-${{ inputs.kernel_version }}/dist/Image ./
          cp ./$CONFIG/out/${{ inputs.android_version }}-${{ inputs.kernel_version }}/dist/Image.lz4 ./

          # Create gzip of the Image file
          gzip -n -k -f -9 ./Image > ./Image.gz

      - name: Create Bootimgs Folder and Copy Images
        if: ${{ inputs.android_version == 'android14' || inputs.android_version == 'android15' }}
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          mkdir bootimgs

          echo "Creating bootimgs folder and copying images..."
          cp ./$CONFIG/bazel-bin/common/kernel_aarch64/Image ./bootimgs
          cp ./$CONFIG/bazel-bin/common/kernel_aarch64/Image.lz4 ./bootimgs
          cp ./$CONFIG/bazel-bin/common/kernel_aarch64/Image ./
          cp ./$CONFIG/bazel-bin/common/kernel_aarch64/Image.lz4 ./

          # Create gzip of the Image file
          gzip -n -k -f -9 ./Image > ./Image.gz

      - name: Create ZIP Files for Different Formats
        run: |
          echo "Creating zip files for all formats..."
          cd ./AnyKernel3

          # Create and upload zip for each format
          ZIP_NAME="${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-AnyKernel3.zip"
          echo "Creating zip file: $ZIP_NAME..."
          mv ../Image ./Image
          zip -r "../$ZIP_NAME" ./*
          rm ./Image

          ZIP_NAME="${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-AnyKernel3-lz4.zip"
          echo "Creating zip file: $ZIP_NAME..."
          mv ../Image.lz4 ./Image.lz4
          zip -r "../$ZIP_NAME" ./*
          rm ./Image.lz4

          ZIP_NAME="${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-AnyKernel3-gz.zip"
          echo "Creating zip file: $ZIP_NAME..."
          mv ../Image.gz ./Image.gz
          zip -r "../$ZIP_NAME" ./*
          rm ./Image.gz

      - name: Run Boot Image ${{ inputs.android_version }} Build Script
        if: ${{ inputs.android_version == 'android12' }}
        run: |
          echo "Changing to configuration directory: $CONFIG..."
          cd bootimgs

          GKI_URL=https://dl.google.com/android/gki/gki-certified-boot-android12-5.10-"${{ inputs.os_patch_level }}"_r1.zip
          FALLBACK_URL=https://dl.google.com/android/gki/gki-certified-boot-android12-5.10-2023-01_r1.zip

          # Check if the GKI URL is available
          echo "Checking if GKI kernel URL is reachable: $GKI_URL"
          status=$(curl -sL -w "%{http_code}" "$GKI_URL" -o /dev/null)

          if [ "$status" = "200" ]; then
              echo "[+] Downloading from GKI_URL"
              curl -Lo gki-kernel.zip "$GKI_URL"
          else
              echo "[+] $GKI_URL not found, using $FALLBACK_URL"
              curl -Lo gki-kernel.zip "$FALLBACK_URL"
          fi

          # Unzip the downloaded kernel and remove the zip
          echo "Unzipping the downloaded kernel..."
          unzip gki-kernel.zip && rm gki-kernel.zip

          echo "Unpacking boot.img..."
          FULL_PATH=$(pwd)/boot-5.10.img
          echo "Unpacking using: $FULL_PATH"

          echo "Running unpack_bootimg.py..."
          $UNPACK_BOOTIMG --boot_img="$FULL_PATH"

          echo "Building Image.gz"
          gzip -n -k -f -9 ./Image > ./Image.gz

          echo "Building boot.img"
          $MKBOOTIMG --header_version 4 --kernel Image --output boot.img --ramdisk out/ramdisk --os_version 12.0.0 --os_patch_level "${{ inputs.os_patch_level }}"
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot.img

          echo "Building boot-gz.img"
          $MKBOOTIMG --header_version 4 --kernel Image.gz --output boot-gz.img --ramdisk out/ramdisk --os_version 12.0.0 --os_patch_level "${{ inputs.os_patch_level }}"
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot-gz.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot-gz.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot-gz.img

          echo "Building boot-lz4.img"
          $MKBOOTIMG --header_version 4 --kernel Image.lz4 --output boot-lz4.img --ramdisk out/ramdisk --os_version 12.0.0 --os_patch_level "${{ inputs.os_patch_level }}"
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot-lz4.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot-lz4.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot-lz4.img

      - name: Run Boot Image ${{ inputs.android_version }} Build Script
        if: ${{ inputs.android_version == 'android13' || inputs.android_version == 'android14' || inputs.android_version == 'android15' }}
        run: |
          cd bootimgs

          echo "Building Image.gz"
          gzip -n -k -f -9 ./Image > ./Image.gz

          echo "Building boot.img"
          $MKBOOTIMG --header_version 4 --kernel Image --output boot.img
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot.img

          echo "Building boot-gz.img"
          $MKBOOTIMG --header_version 4 --kernel Image.gz --output boot-gz.img
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot-gz.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot-gz.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot-gz.img

          echo "Building boot-lz4.img"
          $MKBOOTIMG --header_version 4 --kernel Image.lz4 --output boot-lz4.img
          $AVBTOOL add_hash_footer --partition_name boot --partition_size $((64 * 1024 * 1024)) --image boot-lz4.img --algorithm SHA256_RSA2048 --key $BOOT_SIGN_KEY_PATH
          cp ./boot-lz4.img ../${{ inputs.android_version }}-${{ inputs.kernel_version }}.${{ inputs.sub_level }}-${{ inputs.os_patch_level }}-boot-lz4.img

      - name: Upload Build Artifacts
        uses: actions/upload-artifact@v4
        with:
          name: kernel-${{ env.CONFIG }}
          path: |
            *.zip
            *.img