fix: pin official Magisk to avbroot compatibility baseline

[0cwa]

Summary

Stop floating rooted builds to the highest Magisk tag. Keep official topjohnwu/Magisk, but pin the default compatibility baseline to v30.7 until a newer version is deliberately validated on-device.

Upstream basis

• chenxiaolong/avbroot 3.34.0 explicitly added Magisk 31000 support, and ModOS uses avbroot 3.34.1, so v31 is not rejected as an unknown patch format.
• avbroot's own documentation requires Magisk updates to be performed by repatching the OTA and warns against Direct install.
• the current rooted-GrapheneOS reference build pins Magisk v30.7 alongside avbroot 3.34.1 rather than floating to the highest Magisk tag.

Changes

• Add typed MAGISK_VERSION, defaulting to v30.7.
• Honor an explicit/pinned Magisk version and only fall back to tag discovery when it is intentionally unset.
• Include Magisk version in the rooted selection fingerprint; rootless identity remains independent of Magisk.
• Keep official topjohnwu/Magisk as the source.
• Document avbroot's OTA-based Magisk update lifecycle and distinguish patch-format support from target-device runtime validation.
• Add regression tests for the pin and for repository/version-sensitive rooted identities.

This deliberately treats v30.7 as the production baseline and v31+ as an explicit compatibility test until runtime root is confirmed on shiba.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 041b3425-3939-470d-bcfc-f1989b85d426

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}