Samsung_KernelSU_SUSFS/.github/actions/configs/action.yml

name: add configs
description: add configs and disabling securities
inputs:
 branch:
   description: 'which device kernel'
   required: true

runs:
 using: composite
 steps:
  - name: add mountify support
    shell: bash
    run: |
     cat >> "$GKI_DEFCONFIG" << 'EOF'
     # Mountify Support
     CONFIG_OVERLAY_FS=y
     CONFIG_TMPFS_XATTR=y
     CONFIG_TMPFS_POSIX_ACL=y
     EOF

  - name: add KPM support
    shell: bash
    run: |
     kpmconfig=(
     "CONFIG_KALLSYMS=y"
     "CONFIG_KALLSYMS_ALL=y"
     )

     for config in "${kpmconfig[@]}"; do
         key="${config%%=*}"

         if grep -qE "^(${key}=|# ${key} is not set$)" "$GKI_DEFCONFIG"; then
             sed -i -E \
                 -e "s/^${key}=.*/${config}/" \
                 -e "s/^# ${key} is not set\$/${config}/" \
                 "$GKI_DEFCONFIG"
         else
             echo "$config" >> "$GKI_DEFCONFIG"
         fi
     done
     
  - name: nuke securities for root access
    shell: bash
    run: |
     # 1. Determine which defconfig file needs to be patched based on the branch
     target_config=""
     
     if [[ ${{ inputs.branch }} == SM-S938B* || "${{ inputs.branch }}" == "SM-S931B-Oneui8" ]]; then
         echo "Nothing to see here, moving on..."
     elif [[ "${{ inputs.branch }}" == SM-S926B* ]]; then
         target_config="$COMMON/arch/arm64/configs/s5e9945-bazel_defconfig"
     elif [[ "${{ inputs.branch }}" == SM-A556* ]]; then
         target_config="$COMMON/arch/arm64/configs/s5e8845-bazel_defconfig"
     else
         target_config="$GKI_DEFCONFIG"
     fi
     
     # 2. Apply the nuke modifications exactly once if a target file was assigned
     if [ -n "$target_config" ]; then
      echo "Nuking Samsung Knox/Root protection in: $target_config"
         
     config=(
     "CONFIG_UH=n"
     "CONFIG_UH_RKP=n"
     "CONFIG_UH_LKMAUTH=n"
     "CONFIG_UH_LKM_BLOCK=n"
     "CONFIG_RKP_CFP_JOPP=n"
     "CONFIG_RKP_CFP_ROPP=n"
     "CONFIG_RKP_CFP=n"
     "CONFIG_SECURITY_DEFEX=n"
     "CONFIG_SECURITY_DEFEX_USER=n"
     "CONFIG_SECURITY_DEFEX_IMR=n"
     "CONFIG_SECURITY_DEFEX_DTM=n"
     "CONFIG_PROCA=n"
     "CONFIG_PROCA_S_OS=n"
     "CONFIG_PROCA_GKI_10=n"
     "CONFIG_PROCA_CERTIFICATES_XATTR=n"
     "CONFIG_PROCA_CERT_ENG=n"
     "CONFIG_PROCA_CERT_USER=n"
     "CONFIG_FIVE=n"
     "CONFIG_FIVE_GKI_10=n"
     "CONFIG_FIVE_TEE_DRIVER=n"
     "CONFIG_FIVE_PA_FEATURE=n"
     "CONFIG_FIVE_CERT_USER=n"
     "CONFIG_FIVE_DEFAULT_HASH=n"
     "CONFIG_RKP=n"
     "CONFIG_KDP_NS=n"
     "CONFIG_KDP=n"
     "CONFIG_KNOX_NCM=n"
     "CONFIG_DDAR=n"
     "CONFIG_GAF=n"
     "CONFIG_GAF_V6=n"
     )

     for config in "${configs[@]}"; do
         key="${config%%=*}"

         if grep -qE "^(${key}=|# ${key} is not set$)" "$target_config"; then
             sed -i -E \
                 -e "s/^${key}=.*/${config}/" \
                 -e "s/^# ${key} is not set\$/${config}/" \
                 "$target_config"
         else
             echo "$config" >> "$target_config"
         fi
     done
     fi

  - name: remove check_defconfig
    shell: bash
    run: |
     cd "$COMMON"
     # Remove check_defconfig
     sed -i 's/check_defconfig//' ./build.config.gki