ci: install checksum-pinned Android tools with native Windows extraction

.gitea/workflows/android.yml

@@ -19,16 +19,8 @@ jobs:
           distribution: temurin
           java-version: '21'
       - name: Set up Android SDK
-        # v4's Windows extraction invokes Expand-Archive without a .zip suffix.
-        # v3 extracts correctly on this runner; pin modern tools explicitly.
-        uses: android-actions/setup-android@v3
-        env:
-          ANDROID_HOME: ${{ runner.temp }}/android-sdk
-          ANDROID_SDK_ROOT: ${{ runner.temp }}/android-sdk
-        with:
-          cmdline-tools-version: '15859902'
-          packages: 'platform-tools platforms;android-37.0 build-tools;37.0.0'
-          log-accepted-android-sdk-licenses: false
+        shell: powershell
+        run: ./scripts/setup-android-ci.ps1
       - name: Test and build exact commit
         shell: powershell
         run: |

scripts/setup-android-ci.ps1

@@ -0,0 +1,34 @@
+$ErrorActionPreference = 'Stop'
+$ProgressPreference = 'SilentlyContinue'
+# Official Windows command-line tools 22.0; checksum from developer.android.com/studio.
+# Explicit .zip avoids tool-cache's extensionless archive bug on Windows PowerShell.
+$sdkRoot = Join-Path $env:RUNNER_TEMP 'android-sdk'
+$archive = Join-Path $env:RUNNER_TEMP 'commandlinetools-win-15859902.zip'
+$unpack = Join-Path $env:RUNNER_TEMP 'android-tools-extracted'
+$expected = '90ae805d20434428bffcb699c290860f19bb5f66a67e6b330067e3de801fb04a'
+Invoke-WebRequest 'https://dl.google.com/android/repository/commandlinetools-win-15859902_latest.zip' -OutFile $archive -UseBasicParsing
+if ((Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant() -ne $expected) {
+    throw 'Android command-line tools checksum mismatch'
+}
+Expand-Archive -LiteralPath $archive -DestinationPath $unpack
+$toolsRoot = Join-Path $sdkRoot 'cmdline-tools'
+New-Item -ItemType Directory -Path $toolsRoot -Force | Out-Null
+# Both absolute paths are bounded to the runner's fresh temporary directory.
+$source = [IO.Path]::GetFullPath((Join-Path $unpack 'cmdline-tools'))
+$destination = [IO.Path]::GetFullPath((Join-Path $toolsRoot 'latest'))
+$boundary = [IO.Path]::GetFullPath($env:RUNNER_TEMP).TrimEnd('\') + '\'
+foreach ($candidate in @($source, $destination)) {
+    if (-not $candidate.StartsWith($boundary, [StringComparison]::OrdinalIgnoreCase)) {
+        throw 'SDK extraction path escaped runner temporary directory'
+    }
+}
+Move-Item -LiteralPath $source -Destination $destination
+$env:ANDROID_HOME = $sdkRoot
+$env:ANDROID_SDK_ROOT = $sdkRoot
+$manager = Join-Path $destination 'bin\sdkmanager.bat'
+1..100 | ForEach-Object { 'y' } | & $manager --licenses | Out-Null
+if ($LASTEXITCODE -ne 0) { throw 'Android SDK license setup failed' }
+& $manager 'platform-tools' 'platforms;android-37.0' 'build-tools;37.0.0'
+if ($LASTEXITCODE -ne 0) { throw 'Android SDK installation failed' }
+"ANDROID_HOME=$sdkRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+"ANDROID_SDK_ROOT=$sdkRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append