GKI_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Release Type"
        type: choice
        options:
          - Action
          - Pre-Release
          - Release
        default: Action
      kernel_build_version:
        description: "Kernel Version"
        type: choice
        options:
          - All
          - android12-5.10
          - android13-5.10
          - android13-5.15
          - android14-5.15
          - android14-6.1
          - android15-6.6
          - android16-6.12
        default: All
      brand_name:
        description: "Kernel Branding"
        type: string
        default: Wild
      root_flavor:
        description: "Root Flavor"
        type: choice
        options:
          - none
          - KernelSU-Next
          - KernelSU
          - ReSukiSU
        default: KernelSU-Next
      use_susfs:
        description: "SUSFS"
        type: boolean
        default: true
      use_nomount:
        description: "NoMount"
        type: boolean
        default: true
      use_bbg:
        description: "Baseband Guard"
        type: boolean
        default: true
      use_net:
        description: "Networking"
        type: boolean
        default: true
      use_ds:
        description: "DroidSpaces"
        type: boolean
        default: true
      use_ntsync:
        description: "NTSync"
        type: boolean
        default: true
      use_ptrace:
        description: "Ptrace Patch"
        type: boolean
        default: true
      use_unicode:
        description: "Unicode Fix"
        type: boolean
        default: true
      use_bpf:
        description: "BPF Stack (BTF + eBPF + FUSE-BPF)"
        type: boolean
        default: true
      use_perf:
        description: "Performance"
        type: boolean
        default: false

jobs:
  prepare-ccache:
    name: Prepare ccache binary (download once)
    runs-on: ubuntu-latest
    steps:
      - name: Download custom ccache once
        if: false
        run: |
          set -uo pipefail
          echo "::group::Download ccache"
          url="https://raw.githubusercontent.com/WildKernels/kernel_patches/refs/heads/main/ccache/ccache-x86-64"
          ok=0
          for attempt in 1 2 3 4 5 6; do
            if curl -LfsS --connect-timeout 30 --max-time 120 -H "User-Agent: Mozilla/5.0" "$url" -o ccache && [ -s ccache ]; then
              ok=1; break
            fi
            echo "attempt $attempt failed (GitHub raw 504/throttle); backing off..."
            sleep $(( attempt * 5 + RANDOM % 6 ))
          done
          if [ "$ok" = 1 ]; then
            echo "✅ downloaded ccache once for all matrix jobs"
          else
            echo "::warning::custom ccache download failed; matrix jobs will fall back to the apt ccache"
            rm -f ccache
          fi
          echo "::endgroup::"
      - name: Upload ccache artifact
        if: false
        uses: actions/upload-artifact@v7
        with:
          name: ccache-binary
          path: ccache
          retention-days: 1
          if-no-files-found: warn

  resolve-sources:
    runs-on: ubuntu-latest
    outputs:
      nomount_commit: ${{ steps.resolve.outputs.nomount_commit }}
      kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }}
      kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }}
      root_flavor: ${{ steps.resolve.outputs.root_flavor }}
      root_commit: ${{ steps.resolve.outputs.root_commit }}
      susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }}
      kernel_patches_commit: ${{ steps.resolve.outputs.kernel_patches_commit }}
      anykernel3_commit: ${{ steps.resolve.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ steps.resolve.outputs.droidspaces_commit }}
      feature_set: ${{ steps.features.outputs.feature_set }}
    steps:
      - name: Resolve latest component commits
        id: resolve
        shell: bash
        run: |
          set -euo pipefail

          retry() {
            local n=0
            until [ "$n" -ge 5 ]; do
              "$@" && return 0
              n=$((n+1))
              echo "retry $n/5 failed for: $*" >&2
              sleep 5
            done
            return 1
          }

          resolve_sha() { # repo ref
            retry git ls-remote "$1" "$2" | awk '{print $1; exit}'
          }

          emit() { # key value
            if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then
              echo "Failed to resolve $1 (got: ${2:-empty})" >&2
              exit 1
            fi
            echo "$1=$2" >> "$GITHUB_OUTPUT"
          }

          # NoMount (dev tip)
          emit nomount_commit "$(resolve_sha https://github.com/maxsteeel/nomount.git refs/heads/dev)"

          # KernelSU-Next manager — always built from the official repo's dev branch.
          # pershoot's fork is used only for the kernel SUSFS integration (root_commit below),
          # never for the manager.
          emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT"

          # Selected root implementation at its branch tip. Maps the human-facing
          # choice (KernelSU-Next / KernelSU / ReSukiSU) to the internal root-setup
          # flavor (next / classic / resukisu). 'none' leaves both empty so build.yml
          # falls back to its legacy KernelSU-Next path.
          case "${{ inputs.root_flavor }}" in
            KernelSU)
              emit root_flavor "classic"
              emit root_commit "$(resolve_sha https://github.com/tiann/KernelSU.git refs/heads/main)"
              ;;
            KernelSU-Next)
              emit root_flavor "next"
              if [ "${{ inputs.use_susfs }}" = "true" ]; then
                # SUSFS on: kernel source from pershoot's dev-susfs fork
                emit root_commit "$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)"
              else
                # SUSFS off: plain KernelSU-Next official dev
                emit root_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
              fi
              ;;
            ReSukiSU)
              emit root_flavor "resukisu"
              emit root_commit "$(resolve_sha https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)"
              ;;
            *)
              echo "root_flavor=" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ;;
          esac

          # SUSFS per supported Android/kernel branch (gitlab simonpunk/susfs4ksu)
          declare -A SUSFS_BRANCHES=(
            [susfs_commit_android12_5_10]="gki-android12-5.10"
            [susfs_commit_android13_5_10]="gki-android13-5.10"
            [susfs_commit_android13_5_15]="gki-android13-5.15"
            [susfs_commit_android14_5_15]="gki-android14-5.15"
            [susfs_commit_android14_6_1]="gki-android14-6.1"
            [susfs_commit_android15_6_6]="gki-android15-6.6"
            [susfs_commit_android16_6_12]="gki-android16-6.12"
          )
          for key in "${!SUSFS_BRANCHES[@]}"; do
            emit "$key" "$(resolve_sha https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
          done

          # Tracked build helpers (resolved automatically, before the run)
          emit kernel_patches_commit "$(resolve_sha https://github.com/WildKernels/kernel_patches.git refs/heads/main)"
          emit anykernel3_commit   "$(resolve_sha https://github.com/WildKernels/AnyKernel3.git refs/heads/gki-2.0)"
          emit droidspaces_commit  "$(resolve_sha https://github.com/ravindu644/Droidspaces-OSS.git refs/heads/main)"

          echo "Resolved:"
          env | grep -E '^(nomount_commit|kernelsu_commit|kernelsu_branch|root_commit|susfs_commit_|kernel_patches_commit|anykernel3_commit|droidspaces_commit)' | sort

      - name: Validate release manager build exists
        if: ${{ inputs.release_type != 'Action' }}
        shell: bash
        run: |
          set -euo pipefail

          # A Release/Pre-Release must link to the EXACT KernelSU-Next manager build
          # for the stock commit this fork's branch is synced with. If that exact run
          # can't be found, fail NOW (before any kernel is built) — a release without
          # a matching manager is not shippable.
          KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
          OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git"

          git clone --depth=1 --branch dev-susfs "$KSU_REPO" /tmp/ksu-manager-check
          cd /tmp/ksu-manager-check
          git remote add official "$OFFICIAL_KSU_REPO" || true
          git fetch --depth=1 official dev
          STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD)
          echo "Stock (sync) commit for manager: $STOCK_COMMIT"

          MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
            "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" \
            | jq -r '.workflow_runs[0].id // empty')

          if [[ -z "${MANAGER_RUN_ID:-}" ]]; then
            echo "ERROR: no KernelSU-Next manager build exists for stock commit ${STOCK_COMMIT}" >&2
            echo "A Release/Pre-Release must link to the exact matching manager build." >&2
            echo "Wait for the official build-manager-ci run for this commit, or use Type 'Action'." >&2
            exit 1
          fi

          echo "Exact manager build found: run ${MANAGER_RUN_ID} for ${STOCK_COMMIT}"

      - name: Compose requested feature set
        id: features
        shell: bash
        run: |
          set -euo pipefail

          # SUSFS needs a root implementation (KernelSU / KernelSU-Next / ReSukiSU)
          # to hook into. Without one the kernel wouldn't actually exercise the
          # SUSFS root-hiding patches, so fail fast instead of building a useless kernel.
          if [ "${{ inputs.use_susfs }}" = "true" ] && [ "${{ inputs.root_flavor }}" = "none" ]; then
            echo "ERROR: SUSFS requires a root implementation, but root_flavor is 'none'." >&2
            echo "Pick KernelSU-Next, KernelSU, or ReSukiSU in the Root Implementation box" >&2
            echo "(SUSFS patches SUSFS's root-hiding on top of the root solution)." >&2
            exit 1
          fi

          # A Release/Pre-Release always links the KernelSU-Next manager built on the
          # official repo (build-manager-ci). If a different root was selected, the
          # release notes would reference a manager link that doesn't match the
          # kernel's actual root implementation.
          if { [ "${{ inputs.release_type }}" = "Release" ] || [ "${{ inputs.release_type }}" = "Pre-Release" ]; } && [ "${{ inputs.root_flavor }}" != "KernelSU-Next" ]; then
            echo "ERROR: Release/Pre-Release requires Root Implementation 'KernelSU-Next'." >&2
            echo "Releases link the official KernelSU-Next manager; select KernelSU-Next" >&2
            echo "(or use Release Type 'Action' for other root flavors)." >&2
            exit 1
          fi

          FEATURES=""
          [ "${{ inputs.use_susfs }}" = "true" ] && FEATURES="${FEATURES}SUSFS+"
          [ "${{ inputs.use_nomount }}" = "true" ] && FEATURES="${FEATURES}NoMount+"
          [ "${{ inputs.use_bbg }}" = "true" ] && FEATURES="${FEATURES}BBG+"
          [ "${{ inputs.use_net }}" = "true" ] && FEATURES="${FEATURES}NET+"
          [ "${{ inputs.use_ds }}" = "true" ] && FEATURES="${FEATURES}DS+"
          [ "${{ inputs.use_ntsync }}" = "true" ] && FEATURES="${FEATURES}NTSync+"
          [ "${{ inputs.use_ptrace }}" = "true" ] && FEATURES="${FEATURES}Ptrace+"
          [ "${{ inputs.use_unicode }}" = "true" ] && FEATURES="${FEATURES}Unicode+"
          [ "${{ inputs.use_bpf }}" = "true" ] && FEATURES="${FEATURES}BPF+"
          [ "${{ inputs.use_perf }}" = "true" ] && FEATURES="${FEATURES}Perf+"
          echo "feature_set=${FEATURES%+}" >> "$GITHUB_OUTPUT"

      - name: Clone shared source repos once
        if: ${{ inputs.use_nomount }}
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p sources

          # NoMount kernel sources at the resolved dev tip
          git clone --depth=1 --branch dev https://github.com/maxsteeel/nomount.git sources/nomount
          [ "$(git -C sources/nomount rev-parse HEAD)" = "${{ steps.resolve.outputs.nomount_commit }}" ] || \
            { echo "NoMount clone HEAD mismatch" >&2; exit 1; }

          echo "sources_dir=$PWD/sources" >> "$GITHUB_ENV"

      - name: Upload sources artifact
        if: ${{ inputs.use_nomount }}
        uses: actions/upload-artifact@v7
        with:
          name: sources
          path: sources
          retention-days: 1
          if-no-files-found: error
          compression-level: 9

  build-nomount-module:
    needs: resolve-sources
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        if: ${{ inputs.use_nomount }}

      - name: Build NoMount metamodule
        id: nomount-metamodule
        if: ${{ inputs.use_nomount }}
        uses: ./.github/actions/nomount-metamodule
        with:
          commit: ${{ needs.resolve-sources.outputs.nomount_commit }}

      - name: Upload NoMount metamodule
        if: ${{ inputs.use_nomount }}
        uses: actions/upload-artifact@v7
        with:
          name: NoMount-Metamodule
          path: ${{ steps.nomount-metamodule.outputs.module_path }}
          if-no-files-found: error
          compression-level: 0

  build-fuse-bpf:
    needs: resolve-sources
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        if: ${{ inputs.use_bpf }}

      - name: Sparse-checkout FUSE-BPF source from kernel/common (android16-6.12-lts)
        if: ${{ inputs.use_bpf }}
        shell: bash
        run: |
          set -euo pipefail
          # Only the daemon source + the headers it compiles against are needed,
          # NOT the full ~16GB kernel tree (which includes ~12GB of prebuilts).
          git clone --depth 1 --filter=blob:none --sparse \
            --branch android16-6.12-lts \
            https://android.googlesource.com/kernel/common \
            "${{ github.workspace }}/kernel/common"
          cd "${{ github.workspace }}/kernel/common"
          git sparse-checkout set \
            tools/testing/selftests/filesystems/fuse \
            include \
            arch/arm64/include \
            tools/testing/selftests

      - name: Build FUSE-BPF Userspace Daemon (Issue #211)
        if: ${{ inputs.use_bpf }}
        uses: ./.github/actions/fuse-bpf
        with:
          version: android16-6.12
          kernel_version: 6.12
          android_version: android16

  build-android12-5-10:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android12-5.10') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android12-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android13-5-10:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.10') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.10.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android13-5-15:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android13-5.15') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android13-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android14-5-15:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-5.15') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-5.15.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android14-6-1:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android14-6.1') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android14-6.1.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android15-6-6:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android15-6.6') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android15-6.6.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  build-android16-6-12:
    needs:
    - prepare-ccache
    - resolve-sources
    if: ${{ !inputs.test_release_notes && (inputs.kernel_build_version == 'All' || inputs.kernel_build_version == 'android16-6.12') }}
    uses: ./.github/workflows/prepare.yml
    with:
      config_file: .github/config/android16-6.12.json
      feature_set: ${{ needs.resolve-sources.outputs.feature_set }}
      susfs_commit: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      kernel_patches_commit: ${{ needs.resolve-sources.outputs.kernel_patches_commit }}
      root_flavor: ${{ needs.resolve-sources.outputs.root_flavor }}
      root_commit: ${{ needs.resolve-sources.outputs.root_commit }}
      ksu_branch: ${{ needs.resolve-sources.outputs.kernelsu_commit }}
      anykernel3_commit: ${{ needs.resolve-sources.outputs.anykernel3_commit }}
      droidspaces_commit: ${{ needs.resolve-sources.outputs.droidspaces_commit }}
      brand_name: ${{ inputs.brand_name }}
    secrets: inherit

  rej:
    if: ${{ !inputs.test_release_notes && always() }}
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12

    steps:
    - name: Download Misc Artifacts
      uses: actions/download-artifact@v7
      with:
        path: ./downloaded-artifacts
        pattern: '*-Rejects'
        merge-multiple: false

    - name: Process Reject Artifacts
      run: |
        mkdir -p aio-rejects

        # Iterate over Rejects artifacts in downloaded-artifacts
        for dir in ./downloaded-artifacts/*-Rejects; do
            [ -d "$dir" ] || continue

            dirname=$(basename "$dir")
            original_name=${dirname%-Rejects}
            source_dir="$dir"

            if [ -d "$dir/patch-rejects" ]; then
              source_dir="$dir/patch-rejects"
            fi

            mapfile -t rej_files < <(find "$source_dir" -type f -name '*.rej' | sort)
            filtered_rej_files=()
            for rej_file in "${rej_files[@]}"; do
              rel_rej="${rej_file#${source_dir}/}"
              rel_name="$(basename "$rel_rej")"
              if [ "$rel_rej" = "common/mm/rmap.c.rej" ] || [ "$rel_name" = "i2c-nomadik.c.rej" ]; then
                echo "Skipping $rel_rej because it is an ignored reject file"
                continue
              fi
              filtered_rej_files+=("$rej_file")
            done

            if [ "${#filtered_rej_files[@]}" -eq 0 ]; then
              echo "Skipping $dirname because it only contains ignored reject files"
              continue
            fi

            mkdir -p "aio-rejects/$original_name"

            if [ -d "$dir/patch-rejects" ]; then
              cp -r "$dir/patch-rejects/." "aio-rejects/$original_name/"
            else
              cp -r "$dir/." "aio-rejects/$original_name/"
            fi

            find "aio-rejects/$original_name" -type f -name 'i2c-nomadik.c.rej' -delete
        done

        if [ "$(ls -A aio-rejects)" ]; then
            cd aio-rejects
            zip -r -q -9 ../AIO-REJ.zip .
            cd ..
        else
            echo "No rejects found to upload."
        fi

    - name: Rejects Summary
      run: |
        echo "Reject artifacts were collected locally only and are not uploaded." >> "$GITHUB_STEP_SUMMARY"

    - name: Upload AIO-REJ Artifact
      uses: actions/upload-artifact@v7
      with:
        name: AIO-REJ
        path: AIO-REJ.zip
        if-no-files-found: ignore

  summary:
    if: ${{ !inputs.test_release_notes && always() }}
    runs-on: ubuntu-latest
    permissions:
      actions: write
      contents: read
    needs:
    - resolve-sources
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12

    steps:
    - name: Download All Build Summaries
      uses: actions/download-artifact@v7
      with:
        path: ./summaries
        pattern: '*-Summary'
        merge-multiple: true

    - name: 📋 Workflow Build Summary
      run: |
        {
          echo "# 📋 Build Summary — $(date -u '+%Y-%m-%d %H:%M UTC')"
          echo
          echo "**Feature Set:** ${{ needs.resolve-sources.outputs.feature_set }}"
          echo "**Root Flavor:** ${{ inputs.root_flavor || 'none' }}"
          echo "**Brand:** ${{ inputs.brand_name || 'Wild' }}"
          echo
          
          # Count successes and failures
          SUCCESS_COUNT=0
          FAIL_COUNT=0
          
          # Sort summaries so they appear in a consistent order
          for f in ./summaries/*.md; do
            [ -f "$f" ] || continue
            if grep -q "✅ Success" "$f"; then
              SUCCESS_COUNT=$((SUCCESS_COUNT + 1))
            else
              FAIL_COUNT=$((FAIL_COUNT + 1))
            fi
          done
          
          TOTAL=$((SUCCESS_COUNT + FAIL_COUNT))
          echo "**Results:** ${SUCCESS_COUNT}/${TOTAL} succeeded"
          if [ "$FAIL_COUNT" -gt 0 ]; then
            echo "  - ❌ ${FAIL_COUNT} failed"
          fi
          echo
          echo "---"
          echo
          
          # Output each summary
          for f in ./summaries/*.md; do
            [ -f "$f" ] || continue
            cat "$f"
            echo
            echo "---"
            echo
          done
          
          echo
          echo "> **SUSFS Commits:**"
          echo "> - android12-5.10: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}"
          echo "> - android13-5.10: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}"
          echo "> - android13-5.15: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}"
          echo "> - android14-5.15: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}"
          echo "> - android14-6.1: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}"
          echo "> - android15-6.6: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}"
          echo "> - android16-6.12: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}"
        } >> "$GITHUB_STEP_SUMMARY"

    - name: 🧹 Cleanup Summary Files
      if: ${{ always() }}
      run: rm -rf ./summaries

    - name: 🧹 Delete Summary Artifacts
      if: ${{ always() }}
      env:
        GH_TOKEN: ${{ github.token }}
      run: |
        # Delete all *-Summary artifacts from this run since they're now consolidated
        RUN_ID="${{ github.run_id }}"
        ARTIFACTS=$(gh api "repos/${{ github.repository }}/actions/runs/${RUN_ID}/artifacts" --jq '.artifacts[] | select(.name | endswith("-Summary")) | .id')
        for id in $ARTIFACTS; do
          echo "Deleting summary artifact id=$id"
          gh api -X DELETE "repos/${{ github.repository }}/actions/artifacts/${id}" || true
        done

  release:
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' && !inputs.test_release_notes && (inputs.release_type == 'Pre-Release' || inputs.release_type == 'Release') }}
    permissions:
      contents: write
    needs:
    - build-android12-5-10
    - build-android13-5-10
    - build-android13-5-15
    - build-android14-5-15
    - build-android14-6-1
    - build-android15-6-6
    - build-android16-6-12
    - build-nomount-module

    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_NOTES: .github/config/RELEASE_NOTES.md
    outputs:
      new_tag: ${{ steps.tag.outputs.new_tag }}
    steps:
    - name: Validate Selected Builds
      run: |
        set -euo pipefail

        failed=0
        current_type="${{ inputs.kernel_build_version }}"

        check_selected() {
          local target="$1"
          local job_name="$2"
          local result="$3"
          
          if [[ "$current_type" == "all" || "$current_type" == "$target" ]]; then
            if [[ "$result" != "success" ]]; then
              echo "Required job $job_name did not succeed (result: $result)"
              failed=1
            fi
          fi
        }

        check_selected "android12-5.10" "build-android12-5-10" "${{ needs.build-android12-5-10.result }}"
        check_selected "android13-5.10" "build-android13-5-10" "${{ needs.build-android13-5-10.result }}"
        check_selected "android13-5.15" "build-android13-5-15" "${{ needs.build-android13-5-15.result }}"
        check_selected "android14-5.15" "build-android14-5-15" "${{ needs.build-android14-5-15.result }}"
        check_selected "android14-6.1" "build-android14-6-1" "${{ needs.build-android14-6-1.result }}"
        check_selected "android15-6.6" "build-android15-6-6" "${{ needs.build-android15-6-6.result }}"
        check_selected "android16-6.12" "build-android16-6-12" "${{ needs.build-android16-6-12.result }}"

        if [[ "$failed" -ne 0 ]]; then
          exit 1
        fi

    - name: Free Disk Space
      if: true
      uses: endersonmenezes/free-disk-space@v3  # Use @main for latest, @v3 for stable
      with:
        remove_android: true
        remove_dotnet: true
        remove_haskell: true
        remove_tool_cache: true
        remove_swap: true
        remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
        remove_packages_one_command: true
        remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
        rm_cmd: "rmz"  # Use 'rmz' for faster deletion (default: 'rm')
        rmz_version: "3.1.1"  # Required when rm_cmd is 'rmz'
        testing: false

    - name: Checkout code
      uses: actions/checkout@v7

    - name: Generate New Tag
      id: tag
      if: inputs.release_type != 'Action'
      run: |
        mapfile -t RELEASE_TAGS < <(gh api --paginate "repos/${{ github.repository }}/tags?per_page=100" --jq '.[].name' 2>/dev/null | grep -E '^r[0-9]+$' || true)

        LATEST_REV=0
        for TAG in "${RELEASE_TAGS[@]}"; do
          REV="${TAG#r}"
          if [[ "$REV" =~ ^[0-9]+$ && "$REV" -gt "$LATEST_REV" ]]; then
            LATEST_REV="$REV"
          fi
        done

        if [[ "$LATEST_REV" -gt 0 ]]; then
          NEW_TAG="r$((LATEST_REV + 1))"
        else
          NEW_TAG="r1"
        fi

        if [[ ${#RELEASE_TAGS[@]} -gt 0 ]]; then
          echo "Latest r-tag: r${LATEST_REV}"
        else
          echo "No existing r-tags found; starting at r1"
        fi
        echo "New tag: $NEW_TAG"
        echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV
        echo "new_tag=$NEW_TAG" >> $GITHUB_OUTPUT

    - name: Set Release Title
      id: release_meta
      run: |
        set -euo pipefail

        # Format release title: convert rN -> Release N
        if [[ "${NEW_TAG}" =~ ^r([0-9]+)$ ]]; then
          REV_NUM="${BASH_REMATCH[1]}"
          release_title="Release ${REV_NUM}"
        else
          release_title="Release ${NEW_TAG}"
        fi

        echo "release_title=$release_title" >> "$GITHUB_OUTPUT"

    - name: Extract KernelSU Version Info
      id: ksu_version
      run: |
        set -euo pipefail

        KSU_REPO="https://github.com/pershoot/KernelSU-Next.git"
        KSU_INPUT="dev-susfs"

        # Try as branch first, fall back to commit
        if git ls-remote --heads "$KSU_REPO" "$KSU_INPUT" | grep -q .; then
          echo "Cloning KernelSU-Next from branch: $KSU_INPUT"
          git clone --branch "$KSU_INPUT" "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          KSUN_COMMIT=$(git rev-parse HEAD)
        else
          echo "Cloning KernelSU-Next from dev-susfs branch, then checking out commit: $KSU_INPUT"
          git clone --branch dev-susfs "$KSU_REPO" /tmp/kernelsu-next
          cd /tmp/kernelsu-next
          git fetch --depth=50 origin "$KSU_INPUT"
          git checkout "$KSU_INPUT"
          KSUN_COMMIT="$KSU_INPUT"
        fi

        # The manager is built on the OFFICIAL KernelSU-Next repo
        # (pershoot's workflows are all disabled). Find the official dev
        # commit this fork's branch is synced with (merge-base of our
        # branch vs official dev), then link the manager build run for
        # that commit. pershoot's own dev branch is intentionally ignored.
        retry() {
          local n=0
          until [ "$n" -ge 5 ]; do
            "$@" && return 0
            n=$((n+1))
            echo "retry $n/5 failed for: $*" >&2
            sleep 5
          done
          return 1
        }

        OFFICIAL_KSU_REPO="https://github.com/KernelSU-Next/KernelSU-Next.git"
        retry git fetch "$OFFICIAL_KSU_REPO" dev
        STOCK_COMMIT=$(git merge-base HEAD FETCH_HEAD)
        echo "KSU Stock Commit (official sync point): $STOCK_COMMIT"

        # Extract version info — anchored to the official sync point
        # (STOCK_COMMIT), i.e. the commit the linked manager is built from.
        # Mirrors pershoot c0a2c5fd: count the merge-base with origin, not
        # the fork's extra commits, so the version shown in the release
        # notes matches what the kernel reports and the manager displays.
        COMMITS_COUNT=$(git rev-list --count "$STOCK_COMMIT")
        BASE_VERSION=30000
        KSU_VERSION=$(expr $COMMITS_COUNT "+" $BASE_VERSION)

        # Extract git tag at the sync point
        KSU_GIT_TAG=$(git describe --tags --abbrev=0 "$STOCK_COMMIT" 2>/dev/null || echo "no-tag")

        MANAGER_RUN_ID=$(curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/workflows/build-manager-ci.yml/runs?head_sha=${STOCK_COMMIT}" | jq -r '.workflow_runs[0].id // empty')
        if [[ -n "${MANAGER_RUN_ID:-}" ]]; then
          KSU_MANAGER="https://github.com/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}"
          KSU_MANAGER_NOTE="built from stock dev commit ${STOCK_COMMIT:0:12} (exact match)"
        else
          # Validated up-front in resolve-sources; a release cannot proceed without
          # the exact manager run. Fail rather than link a mismatched manager.
          echo "ERROR: exact manager build no longer available for ${STOCK_COMMIT}" >&2
          exit 1
        fi

        echo "Commits count: $COMMITS_COUNT"
        echo "KSU Version: $KSU_VERSION"
        echo "KSU Git Tag: $KSU_GIT_TAG"
        echo "KSU Manager: $KSU_MANAGER"

        # Export as environment for next step
        echo "KSUN_BRANCH=$KSU_INPUT" >> $GITHUB_ENV
        echo "KSUN_COMMIT=$KSUN_COMMIT" >> $GITHUB_ENV
        echo "KSU_COMMITS_COUNT=$COMMITS_COUNT" >> $GITHUB_ENV
        echo "KSU_VERSION=$KSU_VERSION" >> $GITHUB_ENV
        echo "KSU_GIT_TAG=$KSU_GIT_TAG" >> $GITHUB_ENV
        echo "KSU_MANAGER=$KSU_MANAGER" >> $GITHUB_ENV
        echo "KSU_MANAGER_NOTE=${KSU_MANAGER_NOTE:-}" >> $GITHUB_ENV
        echo "MANAGER_RUN_ID=$MANAGER_RUN_ID" >> $GITHUB_ENV

    - name: Set release body
      run: |
        set -e

        RELEASE_NOTES_PATH="$RELEASE_NOTES"
        : > release_body.md

        python3 .github/scripts/render_release_body.py "$RELEASE_NOTES_PATH" > release_body.md

    - name: Publish release notes preview
      run: |
        {
          echo "## Release Notes Preview"
          echo
          cat release_body.md
        } >> "$GITHUB_STEP_SUMMARY"

    - name: Download KernelSU-Next Manager APK
      run: |
        set -euo pipefail
        echo "Downloading manager artifacts from run ${MANAGER_RUN_ID}"
        mkdir -p release-assets/manager
        # Official KernelSU-Next repo is public: list the build's artifacts,
        # download each zip, and include any APK as a release asset.
        curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
          "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/runs/${MANAGER_RUN_ID}/artifacts" \
          | jq -r '.artifacts[]? | .id + " " + (.name|gsub(" "; "_"))' > /tmp/mgr_arts.txt
        if [[ ! -s /tmp/mgr_arts.txt ]]; then
          echo "ERROR: no artifacts found on manager run ${MANAGER_RUN_ID}" >&2
          exit 1
        fi
        while read -r ART_ID ART_NAME; do
          echo "-- downloading ${ART_NAME}
          curl -fsSL --retry 5 --retry-delay 5 --retry-all-errors \
            -L "https://api.github.com/repos/KernelSU-Next/KernelSU-Next/actions/artifacts/${ART_ID}/zip" \
            -o "/tmp/${ART_NAME}.zip"
          unzip -o -q "/tmp/${ART_NAME}.zip" -d "release-assets/manager/${ART_NAME}" || true
        done < /tmp/mgr_arts.txt
        # Normalize APKs so gh-release picks them up via *.apk glob
        find release-assets/manager -iname '*.apk' -exec cp -f {} release-assets/ \; 
        find release-assets -maxdepth 1 -iname '*.apk' -printf 'staged: %f\n'

    - name: Download AnyKernel3 Artifacts
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*-AnyKernel3'
        merge-multiple: false

    - name: Download NoMount metamodule
      uses: actions/download-artifact@v7
      with:
        path: release-assets
        pattern: '*NoMount-Metamodule'
        merge-multiple: false
        if-no-files-found: ignore

    - name: Zip AnyKernel3 for Release
      run: |
        set -e
        shopt -s nullglob

        for dir in release-assets/*-AnyKernel3; do
          zip_name="${dir}.zip"
          rm -f "$zip_name"
          cd "$dir"
          zip -r -q -9 "../$(basename "$zip_name")" .
          cd - >/dev/null
        done

    - name: Create Release
      uses: softprops/action-gh-release@v1
      with:
        tag_name: ${{ steps.tag.outputs.new_tag }}
        name: ${{ steps.release_meta.outputs.release_title }}
        body_path: release_body.md
        draft: false
        prerelease: ${{ inputs.release_type == 'Pre-Release' }}
        files: |
          release-assets/**/*.zip
          release-assets/**/*-boot*.img
          release-assets/*.apk