feat: read root config from env.toml

Add `ROOT` and `MAGISK_PREINIT` as plain env.toml keys, mapped to the
internal variables in check_toml_env. The values only apply when the
keys are present in the file, ambient environment variables with the
same names do not leak in.

Scheduled runs now honor them: the env.toml step exports both, and
every root-aware workflow step resolves `inputs || env`, so manual
inputs keep precedence and forks can schedule rooted builds. The
preinit guard moves after the env.toml read to fail early on
schedule as well. Rootless stays the default everywhere.

Requested in #351.

Assisted-by: Claude Fable 5
Signed-off-by: PiX <69745008+pixincreate@users.noreply.github.com>

Author: pixincreate

.github/workflows/release.yml

@@ -68,18 +68,6 @@ jobs:
     permissions: write-all
 
     steps:
-      - name: Check if `magisk-preinit-device` is set when `root` is true
-        run: |
-          # Convert inputs to proper boolean values
-          root="${{ inputs.root }}"
-          magisk_preinit_device="${{ inputs.magisk-preinit-device }}"
-
-          # Ensure that the boolean comparison is correctly handled
-          if [ "$root" == "true" ] && [ -z "$magisk_preinit_device" ]; then
-            echo -e "::error:: magisk-preinit-device is required when root is true."
-            exit 1
-          fi
-
       - name: Checkout code
         uses: actions/checkout@v7
         with:
@@ -95,6 +83,21 @@ jobs:
           echo "DEVICE_NAME=${DEVICE_NAME}" >> $GITHUB_ENV
           echo "GRAPHENEOS_UPDATE_CHANNEL=${GRAPHENEOS[UPDATE_CHANNEL]}" >> $GITHUB_ENV
           echo "FORCE_UPDATE=${FORCE_UPDATE:-false}" >> $GITHUB_ENV
+          # Let scheduled runs build rooted OTAs when env.toml enables it
+          echo "ROOT=${ADDITIONALS[ROOT]}" >> $GITHUB_ENV
+          echo "MAGISK_PREINIT=${MAGISK[PREINIT]}" >> $GITHUB_ENV
+
+      - name: Check if `magisk-preinit-device` is set when `root` is true
+        run: |
+          # Inputs win on manual runs, env.toml supplies the values on schedule
+          root="${{ inputs.root || env.ROOT }}"
+          magisk_preinit_device="${{ inputs.magisk-preinit-device || env.MAGISK_PREINIT }}"
+
+          # Ensure that the boolean comparison is correctly handled
+          if [ "$root" == "true" ] && [ -z "$magisk_preinit_device" ]; then
+            echo -e "::error:: magisk-preinit-device is required when root is true."
+            exit 1
+          fi
 
       - name: Set GrapheneOS version
         shell: bash
@@ -114,7 +117,7 @@ jobs:
         if: github.event_name == 'schedule' || inputs.release-type == 'default'
         env:
           REPOSITORY: ${{ github.repository }}
-          ROOT: ${{ inputs.root }}
+          ROOT: ${{ inputs.root || env.ROOT }}
         run: src/ci/check_existing_build.sh
 
       - name: Setup Git
@@ -150,9 +153,9 @@ jobs:
       - name: Patch OTA
         shell: bash
         env:
-          ADDITIONALS_ROOT: ${{ inputs.root }}
+          ADDITIONALS_ROOT: ${{ inputs.root || env.ROOT }}
           CLEANUP: true
-          MAGISK_PREINIT: ${{ inputs.magisk-preinit-device }}
+          MAGISK_PREINIT: ${{ inputs.magisk-preinit-device || env.MAGISK_PREINIT }}
           PASSPHRASE_AVB: ${{ secrets.PASSPHRASE_AVB }}
           PASSPHRASE_OTA: ${{ secrets.PASSPHRASE_OTA }}
         run: |
@@ -189,13 +192,13 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
-          ROOT: ${{ inputs.root }}
+          ROOT: ${{ inputs.root || env.ROOT }}
         run: src/ci/remove_superseded_assets.sh
 
       - name: Publish OTA to server
         shell: bash
         if: inputs.release-type != 'build-only'
         env:
           RELEASE_TYPE: ${{ inputs.release-type }}
-          ROOT: ${{ inputs.root }}
+          ROOT: ${{ inputs.root || env.ROOT }}
         run: src/ci/publish_ota.sh

README.md

@@ -273,6 +273,7 @@ Configuration is layered.
 In CI, `env.toml` is read only on scheduled runs.
 Manual runs take all values from the workflow inputs.
 Forks set `GITHUB_USER` and `GITHUB_REPO` in `env.toml` so `src/declarations.sh` stays untouched.
+Scheduled runs also read `ROOT` and `MAGISK_PREINIT` from `env.toml`, so a fork can build rooted OTAs on schedule.
 
 To make the patched OTA available to the device, it needs to be hosted on the server. PixeneOS uses GitHub for pushing updates, handled by [release.yml](.github/workflows/release.yml).
 

env.toml

@@ -11,6 +11,10 @@ FORCE_UPDATE = "false"
 # ARCH = "x86_64-unknown-linux-gnu"
 # Disable a bundled module, for example BCR
 # 'ADDITIONALS[BCR]' = "false"
+# Add root to local and scheduled builds. Requires MAGISK_PREINIT
+# ROOT = "true"
+# Magisk preinit device for your device, for example "sda8"
+# MAGISK_PREINIT = "sda8"
 
 [github]
 # Set these when running a fork, used for the OTA server URL

src/util_functions.sh

@@ -486,6 +486,14 @@ function check_toml_env() {
         # printf -v keeps values with spaces or commas intact, eval would split them
         printf -v "${key}" '%s' "${config_vars[$key]}"
       done
+
+      # `ROOT` and `MAGISK_PREINIT` are friendly aliases for the internal variables
+      if [[ -n "${config_vars[ROOT]:-}" ]]; then
+        ADDITIONALS[ROOT]="${config_vars[ROOT]}"
+      fi
+      if [[ -n "${config_vars[MAGISK_PREINIT]:-}" ]]; then
+        MAGISK[PREINIT]="${config_vars[MAGISK_PREINIT]}"
+      fi
     else
       error "Failed to find the required variables in \`${toml_file}\`.\n"
       exit 1