GKI_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Release Type"
        type: choice
        options:
          - Action
          - Pre-Release
          - Release
        default: Action
      use_cache:
        description: "Use ccache/bazel cache (restore/save)"
        type: boolean
        default: true
      bypass:
        description: "Apply kernel version-check bypass hack"
        type: boolean
        default: false
      kernel_build_version:
        description: "Kernel Version"
        type: choice
        options:
          - All
          - 5.10.x-android12
          - 5.10.x-android13
          - 5.15.x-android13
          - 5.15.x-android14
          - 6.1.x-android14
          - 6.6.x-android15
          - 6.12.x-android16
        default: All
      os_patch_level:
        description: "Patch date (YYYY-MM), kernel sublevel, lts, or All (no filter)"
        required: true
        type: string
        default: All
      brand_name:
        description: "Kernel Branding"
        type: string
        default: Wild
      commit_mode:
        description: "latest = branch tips, verified = audited pins, update = build latest then promote verified pins on success"
        required: false
        type: choice
        options:
          - latest
          - verified
          - update
        default: verified
      root_flavor:
        description: "Root Flavor"
        type: choice
        options:
          - KernelSU-Next
          - KernelSU
          - ReSukiSU
          - SukiSU-Ultra
          - No Root
          - All
        default: All
      use_susfs:
        description: "SUSFS"
        type: boolean
        default: true
      use_nomount:
        description: "NoMount"
        type: boolean
        default: true
      use_bbg:
        description: "Baseband Guard"
        type: boolean
        default: true
      use_net:
        description: "Networking"
        type: boolean
        default: true
      use_ds:
        description: "DroidSpaces"
        type: boolean
        default: true
      use_ntsync:
        description: "NTSync"
        type: boolean
        default: true
      use_ptrace:
        description: "Ptrace Patch"
        type: boolean
        default: true
      use_unicode:
        description: "Unicode Fix"
        type: boolean
        default: true
      use_bpf:
        description: "BPF Stack (BTF + eBPF + FUSE-BPF)"
        type: boolean
        default: true
      use_perf:
        description: "Performance"
        type: boolean
        default: false
      test_release_notes:
        description: "Render release notes preview only (skip all builds + release)"
        type: boolean
        default: false

jobs:
  resolve-sources:
    runs-on: ubuntu-latest
    outputs:
      nomount_commit: ${{ steps.resolve.outputs.nomount_commit }}
      kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }}
      kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }}
      root_flavor: ${{ steps.resolve.outputs.root_flavor }}
      root_commit: ${{ steps.resolve.outputs.root_commit }}
      root_matrix: ${{ steps.resolve.outputs.root_matrix }}
      susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }}
      susfs_commit_android12_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android12_5_10_resukisu }}
      susfs_commit_android13_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_10_resukisu }}
      susfs_commit_android13_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_15_resukisu }}
      susfs_commit_android14_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_5_15_resukisu }}
      susfs_commit_android14_6_1_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_6_1_resukisu }}
      susfs_commit_android15_6_6_resukisu: ${{ steps.resolve.outputs.susfs_commit_android15_6_6_resukisu }}
      susfs_commit_android16_6_12_resukisu: ${{ steps.resolve.outputs.susfs_commit_android16_6_12_resukisu }}
      ksu_commit: ${{ steps.resolve.outputs.ksu_commit }}
      resukisu_commit: ${{ steps.resolve.outputs.resukisu_commit }}
      sukisu_ultra_commit: ${{ steps.resolve.outputs.sukisu_ultra_commit }}
      kernel_patches_commit: ${{ steps.resolve.outputs.kernel_patches_commit }}
      anykernel3_commit: ${{ steps.resolve.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ steps.resolve.outputs.droidspaces_commit }}
      feature_set: ${{ steps.features.outputs.feature_set }}
      manager_list: ${{ steps.manager.outputs.manager_list }}
    steps:
      - name: Resolve latest component commits
        id: resolve
        shell: bash
        run: |
          set -euo pipefail

          # Commit resolution mode. 'latest' (default) resolves branch tips at
          # run time via git ls-remote. 'verified' uses the audited pins below for
          # NoMount, kernelsu/resukisu roots, and SUSFS; KernelSU-Next stays latest.
          COMMIT_MODE="${{ inputs.commit_mode || 'verified' }}"
          echo "commit_mode=${COMMIT_MODE}"

          retry() {
            local n=0
            until [ "$n" -ge 5 ]; do
              "$@" && return 0
              n=$((n+1))
              echo "retry $n/5 failed for: $*" >&2
              sleep 5
            done
            return 1
          }

          resolve_sha() { # repo ref
            retry git ls-remote "$1" "$2" | awk '{print $1; exit}'
          }

          emit() { # key value
            if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then
              echo "Failed to resolve $1 (got: ${2:-empty})" >&2
              exit 1
            fi
            echo "$1=$2" >> "$GITHUB_OUTPUT"
          }

          # Audited pins (from root-variants.yml). Used only when commit_mode=verified.
          PIN_NOMOUNT="d0f57d5c37ff02aae2299daded57919153240cb3"
          PIN_KERNELSU="3c1240625655978f319a98398031100b80e9da7c"
          PIN_RESUKISU="3c1882886dbbb54f4aae7ddf205f8ccde32c2a34"
          PIN_SUKISU_ULTRA="e2912817f4e1b194e582a06e0b5eacf6a3fb7083"
          declare -A PIN_SUSFS=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )
          # ReSukiSU keeps its own SUSFS pin set (currently the shared values,
          # including 6.1 = 0ff93279). KernelSU's set above already diverges on 6.1.
          declare -A PIN_SUSFS_RESUKISU=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )

          pick() { # pinned repo ref  -> pinned when verified, else latest
            local pinned="$1" repo="$2" ref="$3"
            if [ "$COMMIT_MODE" = "verified" ] && [ -n "$pinned" ]; then
              echo "$pinned"
            else
              resolve_sha "$repo" "$ref"
            fi
          }

          # NoMount (pinned in verified mode, else dev tip)
          emit nomount_commit "$(pick "$PIN_NOMOUNT" https://github.com/maxsteeel/nomount.git refs/heads/dev)"

          # KernelSU-Next manager - always built from the official repo's dev branch.
          # pershoot's fork is used only for the kernel SUSFS integration (root_commit below),
          # never for the manager. Manager always builds at latest.
          emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT"

          # Selected root implementation(s). Maps the human-facing choice
          # (KernelSU-Next / KernelSU / ReSukiSU / SukiSU-Ultra / No Root / All)
          # to internal root-setup flavors (next / kernelsu / resukisu /
          # sukisu-ultra / none). 'All' emits a matrix of the three core root
          # flavors plus each pinned commit; SukiSU-Ultra and No Root are
          # opt-in only and never part of 'All'.
          #
          # kernelsu, resukisu, and sukisu-ultra pin in verified mode;
          # KernelSU-Next (next) always builds at latest.
          KERNELSU_COMMIT="$(pick "$PIN_KERNELSU" https://github.com/tiann/KernelSU.git refs/heads/main)"
          RESUKISU_COMMIT="$(pick "$PIN_RESUKISU" https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)"
          SUKISU_ULTRA_COMMIT="$(pick "$PIN_SUKISU_ULTRA" https://github.com/SukiSU-Ultra/SukiSU-Ultra.git refs/heads/builtin)"
          emit ksu_commit "$KERNELSU_COMMIT"
          emit resukisu_commit "$RESUKISU_COMMIT"
          emit sukisu_ultra_commit "$SUKISU_ULTRA_COMMIT"
          if [ "${{ inputs.use_susfs }}" = "true" ]; then
            NEXT_COMMIT="$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)"
          else
            NEXT_COMMIT="$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          fi

          mk_entry() { # flavor variant commit
            printf '{"root_flavor":"%s","variant":"%s","root_commit":"%s"}' "$1" "$2" "$3"
          }

          case "${{ inputs.root_flavor || 'All' }}" in
            KernelSU)
              echo "root_flavor=kernelsu" >> "$GITHUB_OUTPUT"
              emit root_commit "$KERNELSU_COMMIT"
              ROOT_MATRIX="[$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT")]"
              ;;
            KernelSU-Next)
              echo "root_flavor=next" >> "$GITHUB_OUTPUT"
              emit root_commit "$NEXT_COMMIT"
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT")]"
              ;;
            ReSukiSU)
              echo "root_flavor=resukisu" >> "$GITHUB_OUTPUT"
              emit root_commit "$RESUKISU_COMMIT"
              ROOT_MATRIX="[$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              ;;
            SukiSU-Ultra)
              echo "root_flavor=sukisu-ultra" >> "$GITHUB_OUTPUT"
              emit root_commit "$SUKISU_ULTRA_COMMIT"
              ROOT_MATRIX="[$(mk_entry sukisu-ultra SukiSU-Ultra "$SUKISU_ULTRA_COMMIT")]"
              ;;
            "No Root")
              echo "root_flavor=none" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ROOT_MATRIX='[{"root_flavor":"none","variant":"NoRoot","root_commit":""}]'
              ;;
            All)
              # Fan out to all three root variants, each with its pinned commit.
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT"),$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT"),$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              echo "root_flavor=" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ;;
            *)
              echo "ERROR: unknown root_flavor '${{ inputs.root_flavor }}'" >&2
              exit 1
              ;;
          esac
          echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"

          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu).
          # Always emit the verified pinned SHA here; build.yml overrides to the
          # latest branch tip per-variant when the root flavor is KernelSU-Next.
          declare -A SUSFS_BRANCHES=(
            [susfs_commit_android12_5_10]="gki-android12-5.10"
            [susfs_commit_android13_5_10]="gki-android13-5.10"
            [susfs_commit_android13_5_15]="gki-android13-5.15"
            [susfs_commit_android14_5_15]="gki-android14-5.15"
            [susfs_commit_android14_6_1]="gki-android14-6.1"
            [susfs_commit_android15_6_6]="gki-android15-6.6"
            [susfs_commit_android16_6_12]="gki-android16-6.12"
          )
          for key in "${!SUSFS_BRANCHES[@]}"; do
            emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
            # Per-flavor ReSukiSU SUSFS pin (same branch, own pin set).
            emit "${key}_resukisu" "$(pick "${PIN_SUSFS_RESUKISU[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
          done

          # Tracked build helpers (resolved automatically, before the run)
          emit kernel_patches_commit "$(resolve_sha https://github.com/WildKernels/kernel_patches.git refs/heads/main)"
          emit anykernel3_commit   "$(resolve_sha https://github.com/WildKernels/AnyKernel3.git refs/heads/gki-2.0)"
          emit droidspaces_commit  "$(resolve_sha https://github.com/ravindu644/Droidspaces-OSS.git refs/heads/main)"

          echo "Resolved:"
          env | grep -E '^(nomount_commit|kernelsu_commit|kernelsu_branch|root_commit|susfs_commit_|kernel_patches_commit|anykernel3_commit|droidspaces_commit)' | sort || true

      - name: Resolve manager builds for selected root flavor(s)
        id: manager
        shell: bash
        run: |
          set -euo pipefail

          # Each selected root must ship ALL manager APK builds. KernelSU-Next publishes
          # its manager APKs (manager + manager-spoofed) from the official dev-tip
          # build-manager-ci run; kernelsu (KernelSU), ReSukiSU, and SukiSU-Ultra
          # expose theirs as CI-run artifacts. All are pinned to an exact commit.
          # No Root ships no manager.
          resolve_one() { # flavor
            local flavor="$1"
            local owner repo wf stock
            case "$flavor" in
              next)
                owner="KernelSU-Next"; repo="KernelSU-Next"; wf="build-manager-ci.yml"
                # Manager is built from the official dev-tip commit (grabbed at run start).
                stock="${{ steps.resolve.outputs.kernelsu_commit }}"
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${{ github.token }}" \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "No manager build for dev tip ${stock}, falling back to latest successful run" >&2
                  fb=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -H "Authorization: Bearer ${{ github.token }}" "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?branch=dev&status=success&per_page=1")
                  run_id=$(echo "$fb" | jq -r '.workflow_runs[0].id // empty')
                  stock=$(echo "$fb" | jq -r '.workflow_runs[0].head_sha // empty')
                  if [[ -n "$run_id" ]]; then echo "Fallback to ${stock} run ${run_id}" >&2; fi
                  if [[ -z "${run_id}" ]]; then
                    echo "ERROR: no ${repo} manager build exists for dev commit ${stock}" >&2
                    exit 1
                  fi
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager,manager-spoofed"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;

              kernelsu)
                owner="tiann"; repo="KernelSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/tiann/KernelSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "No manager build for stock ${stock}, falling back to latest successful run" >&2
                  fb=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?branch=main&status=success&per_page=1")
                  run_id=$(echo "$fb" | jq -r '.workflow_runs[0].id // empty')
                  stock=$(echo "$fb" | jq -r '.workflow_runs[0].head_sha // empty')
                  if [[ -n "$run_id" ]]; then echo "Fallback to ${stock} run ${run_id}" >&2; fi
                  if [[ -z "${run_id}" ]]; then
                    echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                    exit 1
                  fi
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"manager"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              resukisu)
                owner="ReSukiSU"; repo="ReSukiSU"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "No manager build for stock ${stock}, falling back to latest successful run" >&2
                  fb=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?branch=main&status=success&per_page=1")
                  run_id=$(echo "$fb" | jq -r '.workflow_runs[0].id // empty')
                  stock=$(echo "$fb" | jq -r '.workflow_runs[0].head_sha // empty')
                  if [[ -n "$run_id" ]]; then echo "Fallback to ${stock} run ${run_id}" >&2; fi
                  if [[ -z "${run_id}" ]]; then
                    echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                    exit 1
                  fi
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"Manager-release,Spoofed-Manager-release"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              sukisu-ultra)
                owner="SukiSU-Ultra"; repo="SukiSU-Ultra"; wf="build-manager.yml"
                stock=$(git ls-remote https://github.com/SukiSU-Ultra/SukiSU-Ultra.git refs/heads/main | awk '{print $1; exit}')
                run_id=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?head_sha=${stock}" \
                  | jq -r '.workflow_runs[0].id // empty')
                if [[ -z "${run_id}" ]]; then
                  echo "No manager build for stock ${stock}, falling back to latest successful run" >&2
                  fb=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/${owner}/${repo}/actions/workflows/${wf}/runs?branch=main&status=success&per_page=1")
                  run_id=$(echo "$fb" | jq -r '.workflow_runs[0].id // empty')
                  stock=$(echo "$fb" | jq -r '.workflow_runs[0].head_sha // empty')
                  if [[ -n "$run_id" ]]; then echo "Fallback to ${stock} run ${run_id}" >&2; fi
                  if [[ -z "${run_id}" ]]; then
                    echo "ERROR: no ${repo} manager build exists for stock commit ${stock}" >&2
                    exit 1
                  fi
                fi
                printf '{"flavor":"%s","owner":"%s","repo":"%s","source":"run","run_id":%s,"stock":"%s","want":"Manager,Spoofed-Manager"}' \
                  "$flavor" "$owner" "$repo" "$run_id" "$stock"
                ;;
              *)
                echo "skipping unknown flavor: $flavor" >&2
                return 0
                ;;
            esac
          }

          FLAVORS="${{ inputs.root_flavor || 'All' }}"
          echo "Root flavor: ${FLAVORS}"
          LIST=""
          case "${FLAVORS}" in
            All) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)"$'\n'"$(resolve_one kernelsu)"$'\n'"$(resolve_one resukisu)") ;;
            KernelSU-Next) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one next)") ;;
            KernelSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one kernelsu)") ;;
            ReSukiSU) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one resukisu)") ;;
            SukiSU-Ultra) LIST=$(jq -c -n '[inputs]' <<< "$(resolve_one sukisu-ultra)") ;;
            *) echo "Skipping manager resolution (no root flavor / none)." ;;
          esac
          if [ -n "$LIST" ]; then
            echo "manager_list=$LIST" >> "$GITHUB_OUTPUT"
            echo "Manager sources resolved."
          else
            echo "manager_list=[]" >> "$GITHUB_OUTPUT"
          fi

      - name: Compose requested feature set
        id: features
        shell: bash
        run: |
          set -euo pipefail

          # Root is optional now ('No Root' builds ship no root implementation),
          # so SUSFS on a No Root build applies kernel-side only.

          # A Release/Pre-Release ships whichever manger build(s) were resolved
          # in the manager step above (exact match per root flavor). No root
          # restriction applies here anymore -- KernelSU-Next, KernelSU, ReSukiSU,
          # SukiSU-Ultra, or 'All' are all valid release targets ('No Root'
          # ships no manager).

          FEATURES=""
          [ "${{ inputs.use_susfs }}" = "true" ] && FEATURES="${FEATURES}SUSFS+"
          [ "${{ inputs.use_nomount }}" = "true" ] && FEATURES="${FEATURES}NoMount+"
          [ "${{ inputs.use_bbg }}" = "true" ] && FEATURES="${FEATURES}BBG+"
          [ "${{ inputs.use_net }}" = "true" ] && FEATURES="${FEATURES}NET+"
          [ "${{ inputs.use_ds }}" = "true" ] && FEATURES="${FEATURES}DS+"
          [ "${{ inputs.use_ntsync }}" = "true" ] && FEATURES="${FEATURES}NTSync+"
          [ "${{ inputs.use_ptrace }}" = "true" ] && FEATURES="${FEATURES}Ptrace+"
          [ "${{ inputs.use_unicode }}" = "true" ] && FEATURES="${FEATURES}Unicode+"
          [ "${{ inputs.use_bpf }}" = "true" ] && FEATURES="${FEATURES}BPF+"
          [ "${{ inputs.use_perf }}" = "true" ] && FEATURES="${FEATURES}Perf+"
          echo "feature_set=${FEATURES%+}" >> "$GITHUB_OUTPUT"

      - name: Clone shared source repos once
        if: inputs.use_nomount && !inputs.test_release_notes
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p sources

          # NoMount kernel sources at the resolved commit (pinned or dev tip)
          git clone --no-checkout https://github.com/maxsteeel/nomount.git sources/nomount
          git -C sources/nomount fetch --depth=1 origin "${{ steps.resolve.outputs.nomount_commit }}"
          git -C sources/nomount checkout --detach "${{ steps.resolve.outputs.nomount_commit }}"
          [ "$(git -C sources/nomount rev-parse HEAD)" = "${{ steps.resolve.outputs.nomount_commit }}" ] || \
            { echo "NoMount clone HEAD mismatch" >&2; exit 1; }

  list-manager-apks:
    needs: resolve-sources
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && needs.resolve-sources.outputs.manager_list != ''"
    runs-on: ubuntu-latest
    outputs:
      apk_list: ${{ steps.scan.outputs.apk_list }}
    steps:
      - uses: actions/checkout@v7

      - name: Download and scan all manager APKs
        id: scan
        shell: bash
        env:
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          MANAGER_LIST=$(echo "$MANAGER_LIST" | sed 's/^\[,/[/')
          if ! echo "$MANAGER_LIST" | jq empty 2>/dev/null; then
            echo "ERROR: Invalid MANAGER_LIST JSON"
            echo "Raw: $MANAGER_LIST"
            exit 0
          fi
          OUT_APKS="${GITHUB_WORKSPACE:-$PWD}/manager_apks"
          MANIFEST="${GITHUB_WORKSPACE:-$PWD}/manifest.txt"
          rm -rf "$OUT_APKS" "$MANIFEST"
          mkdir -p "$OUT_APKS"
          : > "$MANIFEST"
          echo "$MANAGER_LIST" | jq -c '.[]' | while read -r M; do
            OWNER=$(echo "$M" | jq -r .owner)
            REPO=$(echo "$M" | jq -r .repo)
            SRC=$(echo "$M" | jq -r .source)
            RUN_ID=$(echo "$M" | jq -r .run_id)
            WANT=$(echo "$M" | jq -r '.want // ""')
            DLDIR="dl_${REPO}"
            mkdir -p "$DLDIR"
            (
              cd "$DLDIR"
              if [ "$SRC" = "release" ]; then
                curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  "https://api.github.com/repos/${OWNER}/${REPO}/releases/latest" > rel.json
                for URL in $(jq -r '.assets[] | select(.name | endswith(".apk")) | .browser_download_url' rel.json); do
                  NAME="${URL##*/}"
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors -o "$NAME" "$URL"
                  cp -f "$NAME" "$OUT_APKS/$NAME"
                  echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                done
              else
                AJSON=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                  -H "Authorization: Bearer ${GH_TOKEN}" \
                  "https://api.github.com/repos/${OWNER}/${REPO}/actions/runs/${RUN_ID}/artifacts")
                if [ -z "$WANT" ]; then
                  ART_IDS=$(echo "$AJSON" | jq -r '.artifacts[].id')
                else
                  ART_IDS=$(echo "$AJSON" | jq -r --arg want "$WANT" '
                    ($want | split(",")) as $wl |
                    .artifacts[] | select(.name as $n | any($wl[]; $n == .)) | .id')
                fi
                echo "$ART_IDS" | while read -r AID; do
                  [ -n "$AID" ] || continue
                  curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
                    -H "Authorization: Bearer ${GH_TOKEN}" \
                    -o "_${AID}.zip" \
                    "https://api.github.com/repos/${OWNER}/${REPO}/actions/artifacts/${AID}/zip"
                  mkdir -p "_${AID}"
                  unzip -o -q "_${AID}.zip" -d "_${AID}" || true
                  rm -f "_${AID}.zip"
                  for apk in _${AID}/*.apk; do
                    [ -f "$apk" ] || continue
                    NAME="$(basename "$apk")"
                    cp -f "$apk" "$OUT_APKS/$NAME"
                    echo "$OWNER|$REPO|$NAME" >> "$MANIFEST"
                  done
                  rm -rf "_${AID}"
                done
              fi
            )
          done
          # Filter ReSukiSU to only release universal and universal spoofed (drop debug/non-universal)
          if grep -q "ReSukiSU|ReSukiSU|" "$MANIFEST" 2>/dev/null; then
            tmp_manifest="${MANIFEST}.filtered"
            : > "$tmp_manifest"
            while IFS='|' read -r o r n; do
              [ -n "$n" ] || continue
              if [ "$o" = "ReSukiSU" ] && [ "$r" = "ReSukiSU" ]; then
                ln=$(echo "$n" | tr '[:upper:]' '[:lower:]')
                # keep only universal apks, drop debug
                if [[ "$ln" != *universal* ]]; then echo "Dropping ReSukiSU non-universal $n" >&2; rm -f "$OUT_APKS/$n"; continue; fi
                if [[ "$ln" == *debug* ]]; then echo "Dropping ReSukiSU debug $n" >&2; rm -f "$OUT_APKS/$n"; continue; fi
                # now only universal release and universal spoofed remain
              fi
              echo "$o|$r|$n" >> "$tmp_manifest"
            done < "$MANIFEST"
            mv "$tmp_manifest" "$MANIFEST"
          fi
          # Build the flat apk list from the manifest (single source of truth)
          APK_JSON="[]"
          while IFS='|' read -r o r n; do
            [ -n "$n" ] || continue
            APK_JSON=$(echo "$APK_JSON" | jq -c --arg o "$o" --arg r "$r" --arg n "$n" \
              '. + [{owner:$o,repo:$r,apk:$n}]')
          done < "$MANIFEST"
          echo "apk_list=${APK_JSON}" >> "$GITHUB_OUTPUT"
          echo "Found $(wc -l < "$MANIFEST") manager APKs"
          ls -1 "$OUT_APKS"

      - name: Upload all manager APKs as one cross-blob
        uses: actions/upload-artifact@v7
        with:
          name: manager-apks
          path: manager_apks/
          if-no-files-found: warn

  publish-manager-artifacts:
    needs: list-manager-apks
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && needs.list-manager-apks.outputs.apk_list != ''"
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        item: ${{ fromJson(needs.list-manager-apks.outputs.apk_list) }}
    steps:
      - uses: actions/checkout@v7

      - name: Download manager cross-blob
        uses: actions/download-artifact@v7
        with:
          name: manager-apks
          path: manager_apks
          merge-multiple: true

      - name: Upload ${{ matrix.item.apk }} as its own artifact
        uses: actions/upload-artifact@v7
        with:
          name: ${{ matrix.item.apk }}
          path: manager_apks/${{ matrix.item.apk }}
          if-no-files-found: error

  build-nomount-module:
    needs: resolve-sources
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        if: inputs.use_nomount

      - name: Clone NoMount source at pinned commit
        id: clone
        if: inputs.use_nomount
        shell: bash
        run: |
          set -euo pipefail
          COMMIT="${{ needs.resolve-sources.outputs.nomount_commit }}"
          if ! [[ "$COMMIT" =~ ^[0-9a-f]{40}$ ]]; then
            echo "NoMount commit must be a full 40-character SHA." >&2
            exit 2
          fi
          echo "NoMount commit: ${COMMIT}"
          echo "commit=${COMMIT}" >> "$GITHUB_OUTPUT"

      - name: Build NoMount metamodule (nm only, no .ko)
        if: inputs.use_nomount
        id: buildmod
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ steps.clone.outputs.commit }}

      - name: Upload NoMount metamodule
        if: inputs.use_nomount
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.buildmod.outputs.module_dir }}
          if-no-files-found: error
          compression-level: 0

  build-android12-5-10:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '5.10.x-android12')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android12-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android12_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android13-5-10:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '5.10.x-android13')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_10_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android13-5-15:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '5.15.x-android13')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android13_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android14-5-15:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '5.15.x-android14')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_5_15_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android14-6-1:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '6.1.x-android14')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-6.1.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android15-6-6:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '6.6.x-android15')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android15-6.6.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android15_6_6_resukisu || needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  build-android16-6-12:
    needs:
    - resolve-sources
    - build-nomount-module
    - publish-manager-artifacts
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == '6.12.x-android16')"
    strategy:
      fail-fast: false
      matrix:
        root: ${{ fromJson(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android16-6.12.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ matrix.root.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android16_6_12_resukisu || needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ matrix.root.root_flavor }}
      root_commit: ${{ matrix.root.root_commit }}
      variant: ${{ matrix.root.variant }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
      os_patch_level: ${{ inputs.os_patch_level }}
      bypass: ${{ inputs.bypass }}
      use_cache: ${{ inputs.use_cache }}
    secrets: inherit

  update-verified-pins:
    concurrency:
      group: update-verified-pins-${{ github.repository }}
      queue: max
      cancel-in-progress: false
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && inputs.commit_mode == 'update'"
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: write
    needs:
    - resolve-sources
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    steps:
    - uses: actions/checkout@v7
      with:
        ref: ${{ github.ref }}
        token: ${{ github.token }}

    - name: Promote verified pins on success
      id: promote
      shell: bash
      run: |
        set -euo pipefail
        python3 .github/scripts/update_verified_pins.py
      env:
        GH_TOKEN: ${{ github.token }}
        NOMOUNT_SHA: ${{ needs.resolve-sources.outputs.nomount_commit }}
        KERNELSU_SHA: ${{ needs.resolve-sources.outputs.ksu_commit }}
        RESUKISU_SHA: ${{ needs.resolve-sources.outputs.resukisu_commit }}
        SUKISU_ULTRA_SHA: ${{ needs.resolve-sources.outputs.sukisu_ultra_commit }}
        APPROVE_NOMOUNT: ${{ inputs.use_nomount }}
        APPROVE_KERNELSU: ${{ (inputs.root_flavor == 'KernelSU' || inputs.root_flavor == 'All') }}
        APPROVE_RESUKISU: ${{ (inputs.root_flavor == 'ReSukiSU' || inputs.root_flavor == 'All') }}
        APPROVE_SUKISU_ULTRA: ${{ inputs.root_flavor == 'SukiSU-Ultra' }}

    - name: Commit promoted pins
      if: always() && steps.promote.conclusion == 'success'
      shell: bash
      run: |
        set -euo pipefail
        git config user.name "github-actions[bot]"
        git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
        STAMP="$(date -u +%Y-%m-%dT%H%M%SZ)"
        git add .github/workflows/main.yml .github/pins/history
        if git diff --cached --quiet; then
          echo "No pin changes to commit."
          exit 0
        fi
        git commit -m "chore(pins): promote verified commits to latest built (${STAMP})"
        git push
  rej:
    if: "github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && always()"
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12

    steps:
    - name: Download Misc Artifacts
      uses: actions/download-artifact@v7
      with:
        path: ./downloaded-artifacts
        pattern: '*-Rejects'
        merge-multiple: false

    - name: Process Reject Artifacts
      run: |
        mkdir -p aio-rejects

        # Iterate over Rejects artifacts in downloaded-artifacts
        for dir in ./downloaded-artifacts/*-Rejects; do
            [ -d "$dir" ] || continue

            dirname=$(basename "$dir")
            original_name=${dirname%-Rejects}
            source_dir="$dir"

            if [ -d "$dir/patch-rejects" ]; then
              source_dir="$dir/patch-rejects"
            fi

            mapfile -t rej_files < <(find "$source_dir" -type f -name '*.rej' | sort)
            filtered_rej_files=()
            for rej_file in "${rej_files[@]}"; do
              rel_rej="${rej_file#${source_dir}/}"
              rel_name="$(basename "$rel_rej")"
              if [ "$rel_rej" = "common/mm/rmap.c.rej" ] || [ "$rel_name" = "i2c-nomadik.c.rej" ]; then
                echo "Skipping $rel_rej because it is an ignored reject file"
                continue
              fi
              filtered_rej_files+=("$rej_file")
            done

            if [ "${#filtered_rej_files[@]}" -eq 0 ]; then
              echo "Skipping $dirname because it only contains ignored reject files"
              continue
            fi

            mkdir -p "aio-rejects/$original_name"

            if [ -d "$dir/patch-rejects" ]; then
              cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/"
            else
              cp -r "$dir/." "aio-rejects/$original_name/"
            fi

            find "aio-rejects/$original_name" -type f -name 'i2c-nomadik.c.rej' -delete
        done

        if [ "$(ls -A aio-rejects)" ]; then
            cd aio-rejects
            zip -r -q -9 ../AIO-REJ.zip .
            cd ..
        else
            echo "No rejects found to upload."
        fi

    - name: Rejects Summary
      run: |
        echo "Reject artifacts were collected locally only and are not uploaded." >> "$GITHUB_STEP_SUMMARY"

    - name: Upload AIO-REJ Artifact
      uses: actions/upload-artifact@v7
      with:
        name: AIO-REJ
        path: AIO-REJ.zip
        if-no-files-found: ignore

  release:
    runs-on: ubuntu-latest
    if: github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.release_type == 'Pre-Release' || inputs.release_type == 'Release')
    permissions:
      contents: write
    needs:
    - resolve-sources
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    - build-nomount-module
    - publish-manager-artifacts
    - notes-preview

    env:
      GH_TOKEN: ${{ github.token }}
    outputs:
      new_tag: ${{ steps.tag.outputs.new_tag }}
    steps:
    - name: Validate Selected Builds
      run: |
        set -euo pipefail

        failed=0
        current_type="${{ inputs.kernel_build_version }}"

        check_selected() {
          local target="$1"
          local job_name="$2"
          local result="$3"
          
          if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then
            if [[ "$result" != "success" ]]; then
              echo "Required job $job_name did not succeed (result: $result)"
              failed=1
            fi
          fi
        }

        check_selected "5.10.x-android12" "build-android12-5-10" "${{ needs.build-android12-5-10.result }}"
        check_selected "5.10.x-android13" "build-android13-5-10" "${{ needs.build-android13-5-10.result }}"
        check_selected "5.15.x-android13" "build-android13-5-15" "${{ needs.build-android13-5-15.result }}"
        check_selected "5.15.x-android14" "build-android14-5-15" "${{ needs.build-android14-5-15.result }}"
        check_selected "6.1.x-android14" "build-android14-6-1" "${{ needs.build-android14-6-1.result }}"
        check_selected "6.6.x-android15" "build-android15-6-6" "${{ needs.build-android15-6-6.result }}"
        check_selected "6.12.x-android16" "build-android16-6-12" "${{ needs.build-android16-6-12.result }}"

        if [[ "$failed" -ne 0 ]]; then
          exit 1
        fi

    - name: Free Disk Space
      if: true
      uses: endersonmenezes/free-disk-space@v3  # Use @main for latest, @v3 for stable
      with:
        remove_android: true
        remove_dotnet: true
        remove_haskell: true
        remove_tool_cache: true
        remove_swap: true
        remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
        remove_packages_one_command: true
        remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
        rm_cmd: "rmz"  # Use 'rmz' for faster deletion (default: 'rm')
        rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
        testing: false

    - name: Checkout code
      uses: actions/checkout@v7

    - name: Generate New Tag
      id: tag
      if: inputs.release_type != 'Action'
      run: |
        mapfile -t RELEASE_TAGS < <(gh api --paginate "repos/${{ github.repository }}/tags?per_page=100" --jq '.[].name' 2>/dev/null | grep -E '^r[0-9]+$' || true)

        LATEST_REV=0
        for TAG in "${RELEASE_TAGS[@]}"; do
          REV="${TAG#r}"
          if [[ "$REV" =~ ^[0-9]+$ && "$REV" -gt "$LATEST_REV" ]]; then
            LATEST_REV="$REV"
          fi
        done

        if [[ "$LATEST_REV" -gt 0 ]]; then
          NEW_TAG="r$((LATEST_REV + 1))"
        else
          NEW_TAG="r1"
        fi

        if [[ ${#RELEASE_TAGS[@]} -gt 0 ]]; then
          echo "Latest r-tag: r${LATEST_REV}"
        else
          echo "No existing r-tags found; starting at r1"
        fi
        echo "New tag: $NEW_TAG"
        echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV
        echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT

    - name: Set Release Title
      id: release_meta
      run: |
        set -euo pipefail

        # Format release title: convert rN -> Release N
        if [[ "${NEW_TAG}" =~ ^r([0-9]+)$ ]]; then
          REV_NUM="${BASH_REMATCH[1]}"
          release_title="Release ${REV_NUM}"
        else
          release_title="Release ${NEW_TAG}"
        fi

        echo "release_title=$release_title" >> "$GITHUB_OUTPUT"

    - name: Extract KernelSU Version Info
      id: ksu_version
      run: |
        set -euo pipefail

        KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
        KSU_INPUT="dev-susfs"

        # Try as branch first, fall back to commit
        if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
          echo "Cloning KernelSU-Next from branch: $KSU_INPUT"
          git clone --branch "$KSU_INPUT" "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          KSUN_COMMIT=$(git rev-parse HEAD)
        else
          echo "Cloning KernelSU-Next from dev-susfs branch, then checking out commit: $KSU_INPUT"
          git clone --branch dev-susfs "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          git fetch --depth=50 origin "$KSU_INPUT"
          git checkout "$KSU_INPUT"
          KSUN_COMMIT="$KSU_INPUT"
        fi

        # The manager is built on the OFFICIAL KernelSU-Next repo
        # (pershoot's workflows are all disabled). Find the official dev
        # commit this fork's branch is synced with (merge-base of our
        # branch vs official dev), then link the manager build run for
        # that commit. pershoot's own dev branch is intentionally ignored.
        retry() {
          local n=0
          until [ "$n" -ge 5 ]; do
            "$@" && return 0
            n=$((n+1))
            echo "retry $n/5 failed for: $*" >&2
            sleep 5
          done
          return 1
        }

        OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git"
        retry git fetch "$OFFICIAL_KSU_REPO" dev
        STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD)
        echo "KSU Stock Commit (official sync point): $STOCK_COMMIT"

        # Extract version info - anchored to the official sync point
        # (STOCK_COMMIT), i.e. the commit the linked manager is built from.
        # Mirrors pershoot c0a2c5fd: count the merge-base with origin, not
        # the fork's extra commits, so the version shown in the release
        # notes matches what the kernel reports and the manager displays.
        COMMITS_COUNT=$(git rev-list --count "$STOCK_COMMIT")
        BASE_VERSION=30000
        KSU_VERSION=$(expr $COMMITS_COUNT "+" $BASE_VERSION)

        # Extract git tag at the sync point
        KSU_GIT_TAG=$(git describe --tags --abbrev=0 "$STOCK_COMMIT" 2>/dev/null || echo "no-tag")

        MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" | jq -r '.workflow_runs[0].id // empty')
        if [[ -n "${MANAGER_RUN_ID:-}" ]]; then
          KSU_MANAGER="https://github.com/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}"
          KSU_MANAGER_NOTE="built from stock dev commit ${STOCK_COMMIT:0:12} (exact match)"
        else
          # Validated up-front in resolve-sources; a release cannot proceed without
          # the exact manager run. Fail rather than link a mismatched manager.
          echo "ERROR: exact manager build no longer available for ${STOCK_COMMIT}" >&2
          exit 1
        fi

        echo "Commits count: $COMMITS_COUNT"
        echo "KSU Version: $KSU_VERSION"
        echo "KSU Git Tag: $KSU_GIT_TAG"
        echo "KSU Manager: $KSU_MANAGER"

        # Exported for the release record; the notes themselves now come
        # from the single release-notes-preview artifact (built by the
        # notes-preview job from resolve-sources outputs).
        echo "KSUN_BRANCH=$KSU_INPUT" >> $GITHUB_ENV
        echo "KSUN_COMMIT=$KSUN_COMMIT" >> $GITHUB_ENV
        echo "KSU_COMMITS_COUNT=$COMMITS_COUNT" >> $GITHUB_ENV
        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
        echo "KSU_MANAGER=$KSU_MANAGER" >> $GITHUB_ENV
        echo "KSU_MANAGER_NOTE=${KSU_MANAGER_NOTE:-}" >> $GITHUB_ENV
        echo "MANAGER_RUN_ID=$MANAGER_RUN_ID" >> $GITHUB_ENV

    - name: Download release notes (single source)
      uses: actions/download-artifact@v7
      with:
        name: release-notes-preview
        path: .
        if-no-files-found: error

    - name: Verify release body is populated
      run: |
        set -euo pipefail
        # resolve-sources outputs silently expand to empty when the job
        # lacks it in `needs` (r20 shipped with _n/a_ everywhere). Fail
        # fast instead of publishing thin notes.
        if grep -q '_n/a_' release_body.md; then
          echo "ERROR: release_body.md contains unresolved _n/a_ entries:" >&2
          grep '_n/a_' release_body.md >&2
          exit 1
        fi
        if ! grep -qE '\[`[0-9a-f]{7}`\]' release_body.md; then
          echo "ERROR: release_body.md has no commit links" >&2
          exit 1
        fi
        echo "Release body OK ($(wc -l < release_body.md) lines)"

    - name: Download Manager APK zips
      uses: actions/download-artifact@v7
      with:
        path: release-assets/manager
        pattern: '*.apk'
        merge-multiple: true
        if-no-files-found: ignore

    # NOTE: one download-artifact step per kernel family. A single
    # pattern ('*-AnyKernel3') silently truncates: run 34015449465
    # downloaded only 495/591 artifacts, so r20 shipped 500/596 assets.
    - name: Download AnyKernel3 (5.10 android12)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '5.10.*-android12-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (5.10 android13)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '5.10.*-android13-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (5.15 android13)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '5.15.*-android13-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (5.15 android14)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '5.15.*-android14-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (6.1 android14)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '6.1.*-android14-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (6.6 android15)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '6.6.*-android15-*-AnyKernel3'
        merge-multiple: false

    - name: Download AnyKernel3 (6.12 android16)
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '6.12.*-android16-*-AnyKernel3'
        merge-multiple: false

    - name: Verify all AnyKernel3 artifacts downloaded
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        set -euo pipefail
        expected=$(gh api "repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/artifacts?per_page=100" --paginate --jq '.artifacts[].name' | grep -c '\-AnyKernel3$')
        got=$(ls -d release-assets/*-AnyKernel3 2>/dev/null | wc -l)
        echo "AnyKernel3 artifacts in run: $expected, downloaded: $got"
        if [ "$got" -ne "$expected" ]; then
          echo "ERROR: downloaded $got of $expected AnyKernel3 artifacts" >&2
          exit 1
        fi

    - name: Download NoMount metamodule
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*NoMount-Metamodule'
        merge-multiple: false
        if-no-files-found: ignore

    - name: Zip AnyKernel3 for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*-AnyKernel3; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Zip NoMount Metamodule for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*NoMount-Metamodule; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Verify NoMount metamodule zip
      if: inputs.use_nomount
      run: |
        set -euo pipefail
        # The metamodule silently missed r20 (artifact built fine, no zip
        # on the release). Fail loud instead of shipping without it.
        if ! ls release-assets/NoMount-Metamodule.zip >/dev/null 2>&1; then
          echo "ERROR: use_nomount is true but release-assets/NoMount-Metamodule.zip is missing" >&2
          ls release-assets/ >&2
          exit 1
        fi
        echo "NoMount metamodule zip OK"

    - name: Create Release
      env:
        GH_TOKEN: ${{ github.token }}
        TAG_NAME: ${{ steps.tag.outputs.new_tag }}
        RELEASE_TITLE: ${{ steps.release_meta.outputs.release_title }}
        IS_PRERELEASE: ${{ inputs.release_type == 'Pre-Release' }}
      run: |
        set -euo pipefail
        shopt -s nullglob globstar

        # Collect assets first so a glob miss fails fast instead of mid-release.
        files=(release-assets/**/*.zip release-assets/**/*.apk release-assets/**/*-boot*.img)
        if [ "${#files[@]}" -eq 0 ]; then
          echo "No release assets found" >&2
          exit 1
        fi
        echo "Uploading ${#files[@]} assets one at a time..."

        # The release may already exist (partial upload from a retried run,
        # or a concurrent run that computed the same tag). Refresh its notes
        # so a re-run heals stale bodies instead of leaving them behind.
        if gh release view "$TAG_NAME" >/dev/null 2>&1; then
          echo "Release $TAG_NAME already exists — refreshing notes and uploading into it."
          gh release edit "$TAG_NAME" --notes-file release_body.md
        else
          create_args=(--title "$RELEASE_TITLE" --notes-file release_body.md)
          if [ "$IS_PRERELEASE" = "true" ]; then
            create_args+=(--prerelease)
          fi
          gh release create "$TAG_NAME" "${create_args[@]}"
        fi

        # Sequential uploads: one asset at a time with per-file retries.
        # (The previous single-step bulk upload fired ~500 concurrent
        # uploads and got the runner killed twice at the same point.)
        failed=0
        for f in "${files[@]}"; do
          ok=false
          for attempt in 1 2 3; do
            if gh release upload "$TAG_NAME" "$f" --clobber; then
              ok=true
              break
            fi
            echo "Attempt $attempt/3 failed for: $f" >&2
            if [ "$attempt" -lt 3 ]; then
              sleep 10
            fi
          done
          if [ "$ok" = false ]; then
            echo "ERROR: giving up on $f" >&2
            failed=1
          fi
        done
        exit "$failed"

  nightly-release:
    if: always() && github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && inputs.release_type == 'Action'
    needs: [notes-preview]
    runs-on: ubuntu-latest
    concurrency:
      group: nightly-release-${{ github.ref }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v7

      - name: Download release notes preview
        uses: actions/download-artifact@v7
        with:
          name: release-notes-preview
          path: nightly
          if-no-files-found: error

      - name: Append nightly.link URL
        run: |
          {
            echo ""
            echo "- **Nightly artifacts:** https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}"
            echo "- **Note:** not every kernel version is necessarily built in a nightly run — the link above lists exactly what this run produced."
          } >> nightly/release_body.md
          cat nightly/release_body.md >> "$GITHUB_STEP_SUMMARY"

      - name: Replace nightly prerelease
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -e
          gh release delete nightly --cleanup-tag -y || true
          if git ls-remote --tags origin nightly | grep -q 'refs/tags/nightly'; then
            git push --delete origin nightly || true
          fi
          gh release create nightly \
            --target "${{ github.sha }}" \
            --prerelease \
            --title "Nightly (${{ github.ref_name }} $(date -u +%Y-%m-%d))" \
            --notes-file nightly/release_body.md

  notes-preview:
    if: always() && github.event_name == 'workflow_dispatch'
    needs: [resolve-sources, build-android12-5-10, build-android13-5-10, build-android13-5-15, build-android14-5-15, build-android14-6-1, build-android15-6-6, build-android16-6-12]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Render release notes preview (always)
        env:
          ROOT_FLAVOR: ${{ inputs.root_flavor }}
          FEATURE_SET: ${{ needs.resolve-sources.outputs.feature_set }}
          MANAGER_LIST: ${{ needs.resolve-sources.outputs.manager_list }}
          ROOT_MATRIX: ${{ needs.resolve-sources.outputs.root_matrix }}
          USE_SUSFS: ${{ inputs.use_susfs }}
          USE_NOMOUNT: ${{ inputs.use_nomount }}
          USE_BBG: ${{ inputs.use_bbg }}
          USE_DS: ${{ inputs.use_ds }}
          USE_NET: ${{ inputs.use_net }}
          USE_NTSYNC: ${{ inputs.use_ntsync }}
          USE_PTRACE: ${{ inputs.use_ptrace }}
          USE_UNICODE: ${{ inputs.use_unicode }}
          USE_BPF: ${{ inputs.use_bpf }}
          USE_PERF: ${{ inputs.use_perf }}
          USE_CACHE: ${{ inputs.use_cache }}
          KERNEL_BUILD_VERSION: ${{ inputs.kernel_build_version }}
          NOMOUNT_COMMIT: ${{ needs.resolve-sources.outputs.nomount_commit }}
          KSU_COMMIT: ${{ needs.resolve-sources.outputs.ksu_commit }}
          RESUKISU_COMMIT: ${{ needs.resolve-sources.outputs.resukisu_commit }}
          SUKISU_ULTRA_COMMIT: ${{ needs.resolve-sources.outputs.sukisu_ultra_commit }}
          KERNELSU_COMMIT: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
          KERNEL_PATCHES_COMMIT: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
          ANYKERNEL3_COMMIT: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
          DROIDSPACES_COMMIT: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
          SUSFS_ANDROID12_5_10: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
          SUSFS_ANDROID13_5_10: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
          SUSFS_ANDROID13_5_15: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
          SUSFS_ANDROID14_5_15: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
          SUSFS_ANDROID14_6_1: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
          SUSFS_ANDROID15_6_6: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
          SUSFS_ANDROID16_6_12: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
          SUSFS_ANDROID12_5_10_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10_resukisu }}
          SUSFS_ANDROID13_5_10_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10_resukisu }}
          SUSFS_ANDROID13_5_15_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15_resukisu }}
          SUSFS_ANDROID14_5_15_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15_resukisu }}
          SUSFS_ANDROID14_6_1_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu }}
          SUSFS_ANDROID15_6_6_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6_resukisu }}
          SUSFS_ANDROID16_6_12_RESUKISU: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12_resukisu }}
          # KSU version not computed here; render will show placeholder if release job skipped
        run: |
          set -e
            python3 - <<'PYEOF' > release_body.md
          import json, os
          def env(n,d=""): return os.environ.get(n,d).strip() or d
          def parse_managers(raw):
              try: return json.loads(raw) if raw.strip() else []
              except: return []
          root = env("ROOT_FLAVOR","All")
          feats=[]
          if env("USE_SUSFS","true")=="true": feats.append("SUSFS")
          if env("USE_NOMOUNT","true")=="true": feats.append("NoMount")
          if env("USE_BBG","true")=="true": feats.append("Baseband Guard")
          if env("USE_DS","true")=="true": feats.append("DroidSpaces-OSS")
          if env("USE_NET","true")=="true": feats.append("Networking")
          if env("USE_NTSYNC","true")=="true": feats.append("NTSync")
          if env("USE_PTRACE","true")=="true": feats.append("Ptrace Leak Fix")
          if env("USE_UNICODE","true")=="true": feats.append("Unicode Fix")
          if env("USE_BPF","true")=="true": feats.append("BTF / eBPF / FUSE-BPF")
          if env("USE_PERF","false")=="true": feats.append("Performance Tuning")
          lines=[]
          lines.append("# Wild Kernels for GKI2 Devices")
          lines.append("")
          lines.append("## Root")
          lines.append("")
          ksun_branch=env("KSUN_BRANCH","dev-susfs")
          ksun_commit=env("KSUN_COMMIT","")
          ksu_commit=env("KSU_COMMIT","")
          resukisu_commit=env("RESUKISU_COMMIT","")
          sukisu_ultra_commit=env("SUKISU_ULTRA_COMMIT","")
          kernelsu_commit=env("KERNELSU_COMMIT","")
          nm=env("NOMOUNT_COMMIT","")
          kp=env("KERNEL_PATCHES_COMMIT","")
          ak=env("ANYKERNEL3_COMMIT","")
          ds=env("DROIDSPACES_COMMIT","")
          _rmatrix={}
          try: _rmatrix={m.get("root_flavor",""):m.get("root_commit","") for m in json.loads(env("ROOT_MATRIX","[]")) if isinstance(m,dict)}
          except: pass
          if env("USE_SUSFS","true")=="true":
              _next_url="https://github.com/pershoot/KernelSU-Next/commit/"
          else:
              _next_url="https://github.com/KernelSU-Next/KernelSU-Next/commit/"
          _root_urls={"next":_next_url,"kernelsu":"https://github.com/tiann/KernelSU/commit/","resukisu":"https://github.com/ReSukiSU/ReSukiSU/commit/","sukisu-ultra":"https://github.com/SukiSU-Ultra/SukiSU-Ultra/commit/"}
          _root_commits={"next":_rmatrix.get("next","") or kernelsu_commit,"kernelsu":_rmatrix.get("kernelsu","") or ksu_commit,"resukisu":_rmatrix.get("resukisu","") or resukisu_commit,"sukisu-ultra":_rmatrix.get("sukisu-ultra","") or sukisu_ultra_commit}
          _flavors0=[m.get("flavor","") for m in parse_managers(env("MANAGER_LIST","")) if m.get("flavor","")]
          if not _flavors0:
              _flavors0={"KernelSU-Next":["next"],"KernelSU":["kernelsu"],"ReSukiSU":["resukisu"],"SukiSU-Ultra":["sukisu-ultra"],"No Root":[],"All":["next","kernelsu","resukisu"]}.get(root,["next","kernelsu","resukisu"])
          _labels0={"next":"KernelSU-Next","kernelsu":"KernelSU","resukisu":"ReSukiSU","sukisu-ultra":"SukiSU-Ultra"}
          _rc=[]
          for _fl0 in _flavors0:
              _c=_root_commits.get(_fl0,"")
              if _c and len(_c)==40: _rc.append(f"{_labels0.get(_fl0,_fl0)} [`{_c[:7]}`]({_root_urls[_fl0]}{_c})")
              elif _c: _rc.append(f"{_labels0.get(_fl0,_fl0)} `{_c}`")
          for _r in _rc: lines.append(f"- {_r}")
          lines.append("")
          lines.append("## Features")
          lines.append("")
          _kp_url="https://github.com/WildKernels/kernel_patches/commit/"
          _feat_commit={"NoMount":("https://github.com/maxsteeel/nomount/commit/",nm),"Baseband Guard":(_kp_url,kp),"DroidSpaces-OSS":("https://github.com/ravindu644/Droidspaces-OSS/commit/",ds)}
          for f in feats:
              _u,_c=_feat_commit.get(f,("",""))
              if _c and len(_c)==40: lines.append(f"- {f} [`{_c[:7]}`]({_u}{_c})")
              elif _c: lines.append(f"- {f} `{_c}`")
              else: lines.append(f"- {f}")
          if not feats: lines.append("- (none)")
          kp=env("KERNEL_PATCHES_COMMIT","")
          ak=env("ANYKERNEL3_COMMIT","")
          ds=env("DROIDSPACES_COMMIT","")
          lines.append("")
          lines.append("## SUSFS commits")
          lines.append("")
          all_variants=["android12-5.10","android13-5.10","android13-5.15","android14-5.15","android14-6.1","android15-6.6","android16-6.12"]
          def kbv_to_variant(kbv):
              if ".x-android" in kbv:
                  kv, av = kbv.split(".x-android", 1)
                  v = f"android{av}-{kv}"
                  return v if v in all_variants else ""
              return ""
          kbv=env("KERNEL_BUILD_VERSION","All")
          _sel=kbv_to_variant(kbv)
          variants=[_sel] if _sel else list(all_variants)
          sus_map={"android12-5.10":env("SUSFS_ANDROID12_5_10",""),"android13-5.10":env("SUSFS_ANDROID13_5_10",""),"android13-5.15":env("SUSFS_ANDROID13_5_15",""),"android14-5.15":env("SUSFS_ANDROID14_5_15",""),"android14-6.1":env("SUSFS_ANDROID14_6_1",""),"android15-6.6":env("SUSFS_ANDROID15_6_6",""),"android16-6.12":env("SUSFS_ANDROID16_6_12","")}
          sus_map_resukisu={"android12-5.10":env("SUSFS_ANDROID12_5_10_RESUKISU",""),"android13-5.10":env("SUSFS_ANDROID13_5_10_RESUKISU",""),"android13-5.15":env("SUSFS_ANDROID13_5_15_RESUKISU",""),"android14-5.15":env("SUSFS_ANDROID14_5_15_RESUKISU",""),"android14-6.1":env("SUSFS_ANDROID14_6_1_RESUKISU",""),"android15-6.6":env("SUSFS_ANDROID15_6_6_RESUKISU",""),"android16-6.12":env("SUSFS_ANDROID16_6_12_RESUKISU","")}
          _flavors=[m.get("flavor","") for m in parse_managers(env("MANAGER_LIST","")) if m.get("flavor","")]
          if not _flavors:
              _flavors={"KernelSU-Next":["next"],"KernelSU":["kernelsu"],"ReSukiSU":["resukisu"],"SukiSU-Ultra":["sukisu-ultra"],"No Root":[],"All":["next","kernelsu","resukisu"]}.get(root,["next","kernelsu","resukisu"])
          _labels={"next":"KernelSU-Next","kernelsu":"KernelSU","resukisu":"ReSukiSU","sukisu-ultra":"SukiSU-Ultra"}
          _susfs_url="https://gitlab.com/simonpunk/susfs4ksu"
          lines.append("| SUSFS branch |" + "".join(f" {_labels.get(_fl,_fl)} |" for _fl in _flavors))
          lines.append("|---" * (len(_flavors) + 1) + "|")
          for v in variants:
              _row=f"| gki-{v} |"
              for _fl in _flavors:
                  _sm=sus_map_resukisu if _fl=="resukisu" else sus_map
                  sha=_sm.get(v,"")
                  sha_s=f"[`{sha[:7]}`]({_susfs_url}/-/commit/{sha})" if sha else "_n/a_"
                  _row+=f" {sha_s} |"
              lines.append(_row)
          lines.append("")
          lines.append("")
          output="\n".join(lines)+"\n"
          print(output,end="")
          s=os.environ.get("GITHUB_STEP_SUMMARY")
          if s: open(s,"a").write(output)
          PYEOF
      - name: Upload release notes preview artifact
        uses: actions/upload-artifact@v7
        with:
          name: release-notes-preview
          path: release_body.md
          retention-days: 7
          if-no-files-found: warn