Samsung_KernelSU_SUSFS/.github/workflows/main.yml

name: Build Kernels

permissions:
  contents: write
  actions: write

on:
  workflow_dispatch:
    inputs:
      release_type:
        description: "Choose Release Type"
        required: true
        type: choice
        options:
          - Actions
          - Pre-Release
          - Release
        default: Actions

      lto:
        description: "Choose LTO build"
        required: true
        type: choice
        options:
          - default
          - thin
          - full
        default: default

      commit_mode:
        description: "latest = branch tips, verified = audited pins, update = build latest then promote verified pins on success"
        required: false
        type: choice
        options:
          - latest
          - verified
          - update
        default: verified

      root_flavor:
        description: "Root Flavor"
        type: choice
        options:
          - KernelSU-Next
          - KernelSU
          - ReSukiSU
          - All
        default: All

      device:
        description: "Branch - All or comma list e.g. SM-S938B-Oneui8.5,SM-S928B-Oneui8 - branches: https://github.com/WildKernels/Samsung_Kernels/branches"
        required: false
        type: string
        default: All

      susfs:
        description: "SUSFS"
        required: false
        type: boolean
        default: true

      zeromount:
        description: "Zeromount"
        required: false
        type: boolean
        default: false

      nomount:
        description: "NoMount"
        required: false
        type: boolean
        default: true

      bbg:
        description: "BBG"
        required: false
        type: boolean
        default: true

      unicodefix:
        description: "Unicode fix"
        required: false
        type: boolean
        default: true

      droidspace:
        description: "Droidspaces"
        required: false
        type: boolean
        default: true

      ntsync:
        description: "NTsync"
        required: false
        type: boolean
        default: true
        
      bbrv3:
        description: "bbrv3"
        required: false
        type: boolean
        default: true

      ipv6_nat:
       description: "IPv6_NAT & IP-SET"
       required: false
       default: true
       type: boolean

      optimization:
       description: "optimization patches"
       required: false
       default: true
       type: boolean

      ttl:
       description: "TTL support"
       required: false
       default: true
       type: boolean

      cache:
        description: "CCache"
        required: false
        default: true
        type: boolean

      kpm:
        description: "kpm"
        required: false
        default: true
        type: boolean

jobs:

  resolve-sources:
    runs-on: ubuntu-latest
    outputs:
      nomount_commit: ${{ steps.resolve.outputs.nomount_commit }}
      kernelsu_commit: ${{ steps.resolve.outputs.kernelsu_commit }}
      kernelsu_branch: ${{ steps.resolve.outputs.kernelsu_branch }}
      root_flavor: ${{ steps.resolve.outputs.root_flavor }}
      root_commit: ${{ steps.resolve.outputs.root_commit }}
      root_matrix: ${{ steps.resolve.outputs.root_matrix }}
      susfs_commit_android12_5_10: ${{ steps.resolve.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ steps.resolve.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ steps.resolve.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ steps.resolve.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ steps.resolve.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ steps.resolve.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ steps.resolve.outputs.susfs_commit_android16_6_12 }}
      susfs_commit_android12_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android12_5_10_resukisu }}
      susfs_commit_android13_5_10_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_10_resukisu }}
      susfs_commit_android13_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android13_5_15_resukisu }}
      susfs_commit_android14_5_15_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_5_15_resukisu }}
      susfs_commit_android14_6_1_resukisu: ${{ steps.resolve.outputs.susfs_commit_android14_6_1_resukisu }}
      susfs_commit_android15_6_6_resukisu: ${{ steps.resolve.outputs.susfs_commit_android15_6_6_resukisu }}
      susfs_commit_android16_6_12_resukisu: ${{ steps.resolve.outputs.susfs_commit_android16_6_12_resukisu }}
      ksu_commit: ${{ steps.resolve.outputs.ksu_commit }}
      resukisu_commit: ${{ steps.resolve.outputs.resukisu_commit }}
    steps:
      - name: Resolve pinned component commits
        id: resolve
        shell: bash
        run: |
          set -euo pipefail
          COMMIT_MODE="${{ inputs.commit_mode }}"
          echo "commit_mode=${COMMIT_MODE}"
          retry() {
            local n=0
            until [ "$n" -ge 5 ]; do
              "$@" && return 0
              n=$((n+1))
              echo "retry $n/5 failed for: $*" >&2
              sleep 5
            done
            return 1
          }
          resolve_sha() { retry git ls-remote "$1" "$2" | awk '{print $1; exit}'; }
          emit() {
            if [ -z "$2" ] || ! [[ "$2" =~ ^[0-9a-f]{40}$ ]]; then
              echo "Failed to resolve $1 (got: ${2:-empty})" >&2
              exit 1
            fi
            echo "$1=$2" >> "$GITHUB_OUTPUT"
          }
          # Audited pins - kept in sync with GKI_KernelSU_SUSFS dev
          PIN_NOMOUNT="9a1431782f390453de54610fb91bdad03eab5b43"
          PIN_KERNELSU="e38512f1255ea454d34cc2008d2ef7932547fad6"
          PIN_RESUKISU="0b5efe9e0102c43ca5c41174d500f5a7080cd0c7"
          declare -A PIN_SUSFS=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )
          declare -A PIN_SUSFS_RESUKISU=(
            [susfs_commit_android12_5_10]="ec785f47d49f7b3871ca9356f450411020af7017"
            [susfs_commit_android13_5_10]="ed3d6d9c9a2652e1c70f153f5358701e996d646c"
            [susfs_commit_android13_5_15]="bca0d2333c1a7d717e7278b019d7af7ba1d16005"
            [susfs_commit_android14_5_15]="d54b51724afa912c4c99bb99731354ce934d1889"
            [susfs_commit_android14_6_1]="4fc9c1898ea66f51847cdbc0d1473ea4ef525a70"
            [susfs_commit_android15_6_6]="937215cb3a1b1f333d764c366c7a49972fa8e7a0"
            [susfs_commit_android16_6_12]="7d91da2d2ce056d1abf378d9199aaf1072d37ab0"
          )
          pick() {
            local pinned="$1" repo="$2" ref="$3"
            if [ "$COMMIT_MODE" = "verified" ] && [ -n "$pinned" ]; then
              echo "$pinned"
            else
              resolve_sha "$repo" "$ref"
            fi
          }
          emit nomount_commit "$(pick "$PIN_NOMOUNT" https://github.com/maxsteeel/nomount.git refs/heads/dev)"
          emit kernelsu_commit "$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          echo "kernelsu_branch=dev" >> "$GITHUB_OUTPUT"
          KERNELSU_COMMIT="$(pick "$PIN_KERNELSU" https://github.com/tiann/KernelSU.git refs/heads/main)"
          RESUKISU_COMMIT="$(pick "$PIN_RESUKISU" https://github.com/ReSukiSU/ReSukiSU.git refs/heads/main)"
          emit ksu_commit "$KERNELSU_COMMIT"
          emit resukisu_commit "$RESUKISU_COMMIT"
          if [ "${{ inputs.susfs }}" = "true" ]; then
            NEXT_COMMIT="$(resolve_sha https://github.com/pershoot/KernelSU-Next.git refs/heads/dev-susfs)"
          else
            NEXT_COMMIT="$(resolve_sha https://github.com/KernelSU-Next/KernelSU-Next.git refs/heads/dev)"
          fi
          mk_entry() { printf '{"root_flavor":"%s","variant":"%s","root_commit":"%s"}' "$1" "$2" "$3"; }
          case "${{ inputs.root_flavor }}" in
            KernelSU)
              echo "root_flavor=kernelsu" >> "$GITHUB_OUTPUT"
              emit root_commit "$KERNELSU_COMMIT"
              ROOT_MATRIX="[$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT")]"
              ;;
            KernelSU-Next)
              echo "root_flavor=next" >> "$GITHUB_OUTPUT"
              emit root_commit "$NEXT_COMMIT"
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT")]"
              ;;
            ReSukiSU)
              echo "root_flavor=resukisu" >> "$GITHUB_OUTPUT"
              emit root_commit "$RESUKISU_COMMIT"
              ROOT_MATRIX="[$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              ;;
            All)
              ROOT_MATRIX="[$(mk_entry next KernelSU-Next "$NEXT_COMMIT"),$(mk_entry kernelsu KernelSU "$KERNELSU_COMMIT"),$(mk_entry resukisu ReSukiSU "$RESUKISU_COMMIT")]"
              echo "root_flavor=" >> "$GITHUB_OUTPUT"
              echo "root_commit=" >> "$GITHUB_OUTPUT"
              ;;
            *) echo "ERROR: unknown root_flavor '${{ inputs.root_flavor }}'" >&2; exit 1 ;;
          esac
          echo "root_matrix=$ROOT_MATRIX" >> "$GITHUB_OUTPUT"
          declare -A SUSFS_BRANCHES=(
            [susfs_commit_android12_5_10]="gki-android12-5.10"
            [susfs_commit_android13_5_10]="gki-android13-5.10"
            [susfs_commit_android13_5_15]="gki-android13-5.15"
            [susfs_commit_android14_5_15]="gki-android14-5.15"
            [susfs_commit_android14_6_1]="gki-android14-6.1"
            [susfs_commit_android15_6_6]="gki-android15-6.6"
            [susfs_commit_android16_6_12]="gki-android16-6.12"
          )
          for key in "${!SUSFS_BRANCHES[@]}"; do
            emit "$key" "$(pick "${PIN_SUSFS[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
            emit "${key}_resukisu" "$(pick "${PIN_SUSFS_RESUKISU[$key]}" https://gitlab.com/simonpunk/susfs4ksu.git refs/heads/${SUSFS_BRANCHES[$key]})"
          done
          echo "Resolved:"
          env | grep -E '^(nomount_commit|kernelsu_commit|root_commit|susfs_commit_)' | sort || true

  build-samsung:
    needs: resolve-sources
    strategy:
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.resolve-sources.outputs.root_matrix) }}
    uses: ./.github/workflows/kernel-samsung.yml
    secrets: inherit
    with:
      device: ${{ inputs.device }}
      root_flavor: ${{ matrix.root_flavor }}
      root_commit: ${{ matrix.root_commit }}
      variant: ${{ matrix.variant }}
      susfs_commit: ${{ matrix.root_flavor == 'resukisu' && needs.resolve-sources.outputs.susfs_commit_android14_6_1_resukisu || needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android12_5_10: ${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}
      susfs_commit_android13_5_10: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_10 }}
      susfs_commit_android13_5_15: ${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}
      susfs_commit_android14_5_15: ${{ needs.resolve-sources.outputs.susfs_commit_android14_5_15 }}
      susfs_commit_android14_6_1: ${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}
      susfs_commit_android15_6_6: ${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}
      susfs_commit_android16_6_12: ${{ needs.resolve-sources.outputs.susfs_commit_android16_6_12 }}
      nomount_commit: ${{ needs.resolve-sources.outputs.nomount_commit }}
      susfs: ${{ inputs.susfs }}
      bbg: ${{ inputs.bbg }}
      unicodefix: ${{ inputs.unicodefix }}
      zeromount: ${{ inputs.zeromount }}
      nomount: ${{ inputs.nomount }}
      droidspace: ${{ inputs.droidspace }}
      ntsync: ${{ inputs.ntsync }}
      bbrv3: ${{ inputs.bbrv3 }}
      ipv6_nat: ${{ inputs.ipv6_nat }}
      optimization: ${{ inputs.optimization }}
      ttl: ${{ inputs.ttl }}
      cache: ${{ inputs.cache }}
      lto: ${{ inputs.lto }}
      kpm: ${{ inputs.kpm }}

  release:
    runs-on: ubuntu-latest
    if: inputs.release_type != 'Actions'
    needs:
      - build-samsung
      - resolve-sources

    env:
      GH_TOKEN: ${{ github.token }}
      RELEASE_NAME: "Samsung Kernels With SUSFS v2.3.0"
      RELEASE_BODY: ""
    steps:
      - name: Free Disk Space
        if: true
        uses: endersonmenezes/free-disk-space@v3
        with:
          remove_android: true
          remove_dotnet: true
          remove_haskell: true
          remove_tool_cache: true
          remove_swap: true
          remove_packages: "azure-cli google-cloud-cli microsoft-edge-stable google-chrome-stable firefox postgresql* temurin-* *llvm* mysql* dotnet-sdk-*"
          remove_packages_one_command: true
          remove_folders: "/usr/share/swift /usr/share/miniconda /usr/share/az* /usr/local/lib/node_modules /usr/local/share/chromium /usr/local/share/powershell /usr/local/julia /usr/local/aws-cli /usr/local/aws-sam-cli /usr/share/gradle"
          rm_cmd: "rmz"
          rmz_version: "3.1.1"
          testing: false
      
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Generate New Tag
        if: inputs.release_type != 'Actions'
        run: |
            LATEST_TAG=$(gh api repos/${{ github.repository }}/tags --jq '.[0].name' 2>/dev/null || echo "")
            if [ -z "$LATEST_TAG" ]; then
              LATEST_TAG="v2.3.0-r0"
            fi
            
            NEW_TAG=$(echo "$LATEST_TAG" | awk -F'-r' '{suffix=$2; if (!suffix) suffix=0; suffix++; printf "%s-r%d", $1, suffix}')
    
            echo "New tag: $NEW_TAG"
            echo "NEW_TAG=${NEW_TAG}" >> $GITHUB_ENV

      - name: Download Artifacts
        uses: actions/download-artifact@v8
        with:
          path: ./downloaded-artifacts
          pattern: '*-AnyKernel3'

      - name: get commit hashes
        run: |
         echo "SUSFS_510=${{ needs.resolve-sources.outputs.susfs_commit_android12_5_10 }}" >> $GITHUB_ENV
         echo "SUSFS_515=${{ needs.resolve-sources.outputs.susfs_commit_android13_5_15 }}" >> $GITHUB_ENV
         echo "SUSFS_61=${{ needs.resolve-sources.outputs.susfs_commit_android14_6_1 }}" >> $GITHUB_ENV
         echo "SUSFS_66=${{ needs.resolve-sources.outputs.susfs_commit_android15_6_6 }}" >> $GITHUB_ENV
         echo "KSU_COMMIT=${{ needs.resolve-sources.outputs.ksu_commit }}" >> $GITHUB_ENV
         echo "KSUN_COMMIT=${{ needs.resolve-sources.outputs.kernelsu_commit }}" >> $GITHUB_ENV
         echo "RESUKI_COMMIT=${{ needs.resolve-sources.outputs.resukisu_commit }}" >> $GITHUB_ENV
         echo "NM_HASH=${{ needs.resolve-sources.outputs.nomount_commit }}" >> $GITHUB_ENV

      - name: Set release body
        run: |
          cat << 'EOF' > release_body.md
      
          **IMPORTANT DISCLAIMER**
          This software is provided for testing and educational purposes only. Use at your own risk.
          The developers are not responsible for any damage, data loss, or issues that may occur.
          Please ensure you have proper backups before installation.

          Features:
          EOF

          cat <<EOF >> release_body.md
          -> Root: ${{ inputs.root_flavor }} (commit_mode: ${{ inputs.commit_mode }})
          EOF

          if [ "${{ inputs.susfs }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> SUSFS v2.3.0 - https://gitlab.com/simonpunk/susfs4ksu
          -> SUSFS Inline hooks
          EOF
          fi

          if [ "${{ inputs.bbg }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> BBG - https://github.com/vc-teahouse/Baseband-guard
          EOF
          fi

          if [ "${{ inputs.unicodefix }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> unicode fix - Prevent path traversal and other detections using non-printable Unicode codepoints
          EOF
          fi

          if [ "${{ inputs.zeromount }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> Zeromount - https://github.com/Enginex0/zeromount
          EOF
          fi

          if [ "${{ inputs.nomount }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> NoMount - https://github.com/maxsteeel/nomount
          EOF
          fi

          if [ "${{ inputs.droidspace }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> droidspaces support - https://github.com/ravindu644/Droidspaces-OSS
          EOF
          fi

          if [ "${{ inputs.ntsync }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> NTSync - Provide high-performance, low-latency synchronization primitives compatible with the Windows NT kernel API
          EOF
          fi

          if [ "${{ inputs.bbrv3 }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> TCP BBRV3 (better TCP congestion and faster internet)
          -> CAKE and PIE qdisc Support - Better Net Schedulers
          EOF
          fi

          if [ "${{ inputs.ipv6_nat }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> IP Set & IPv6 NAT Support - Advanced firewall capabilities and IPv6 NAT Support
          EOF
          fi

          if [ "${{ inputs.ttl }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> TTL Target Support - Network packet manipulation
          EOF
          fi

          if [ "${{ inputs.optimization }}" = "true" ]; then
          cat <<'EOF' >> release_body.md
          -> Kernel Optimization - Memory, I/O, CPU scheduler, network and other general tunings
          -> Patches for optimizations can be found here - https://github.com/WildKernels/kernel_patches/tree/main/common
          EOF
          fi

          echo "-> Built using LTO: ${{ inputs.lto }}" >> release_body.md

          cat <<'EOF' >> release_body.md
          
          Notes:
          - Currently kpm ONLY works for S24U and S25U.
          
          Module: 
          -> https://github.com/sidex15/ksu_module_susfs
          -> https://github.com/rrr333nnn333/BRENE

          Pinned Commits (verified mode):
          EOF
          cat <<EOF >> release_body.md
          KernelSU: ${{ env.KSU_COMMIT }}
          KernelSU-Next: ${{ env.KSUN_COMMIT }}
          ReSukiSU: ${{ env.RESUKI_COMMIT }}
          SUSFS 5.10: ${{ env.SUSFS_510 }}
          SUSFS 6.1: ${{ env.SUSFS_61 }}
          SUSFS 6.6: ${{ env.SUSFS_66 }}
          NoMount: ${{ env.NM_HASH }}
          EOF

      - name: Create GitHub Release
        uses: softprops/action-gh-release@v3
        with:
          tag_name: ${{ env.NEW_TAG }}
          prerelease: ${{ inputs.release_type == 'Pre-Release' }}
          files: ""
          name: ${{ env.RELEASE_NAME }}
          body_path: release_body.md

      - name: Upload Release Assets
        run: |
          shopt -s nullglob
          anykernel_dirs=(./downloaded-artifacts/*/)
          if [ ${#anykernel_dirs[@]} -eq 0 ]; then
            echo "No artifact directories found under ./downloaded-artifacts; skipping upload."
          else
            for dir in "${anykernel_dirs[@]}"; do
              if [[ "$(basename "$dir")" == *"-AnyKernel3" ]]; then
                artifact_name=$(basename "$dir")
                echo "Creating ZIP for $artifact_name..."
                cd "$dir"
                zip -r -9 "../../${artifact_name}.zip" ./*
                cd - > /dev/null
                echo "Uploading ${artifact_name}.zip..."
                gh release upload ${{ env.NEW_TAG }} "${artifact_name}.zip"
              fi
            done
          fi