ci: update Android SDK setup action

[abelonogov-ld]

Requirements

• I have added test coverage for new or changed functionality — workflow-only change
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions — CI will validate the configured API level

Related issues

Unblocks #397. Its CI fails during Android SDK setup.

Describe the solution you've provided

Upgrade android-actions/setup-android from v3 to v4. Licenses are already accepted successfully; the failure happens afterward because v3 invokes sdkmanager tools, and Google no longer publishes that obsolete package. Version 4 removes tools from its default package list while continuing to install command-line/platform tools and accept SDK licenses.

Describe alternatives you've considered

Retrying cannot fix a package removed from Google's repository. Adding a separate license-acceptance step would duplicate behavior and would not address the failing sdkmanager tools invocation inside v3.

Additional context

Observed error: Warning: Failed to find package 'tools'. The upstream v4 change explicitly fixes this failure.

---

Note

Overview
Fixes CI Android SDK setup by upgrading the shared composite CI action from android-actions/setup-android@v3 to v4.0.4 (pinned to commit be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd).

v3 fails after license acceptance because it still runs sdkmanager tools, a package Google removed from the repository (Failed to find package 'tools'). v4 stops requesting that obsolete package while still installing the command-line/platform tooling needed for ./gradlew builds and the rest of the workflow.

^{Reviewed by Cursor Bugbot for commit d6a3b7e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d6a3b7e. Configure here.}

[abelonogov-ld]

False positive — both claims are incorrect, and CI on this commit disproves them.

v4.0.4 is a published release. Not a draft, not a prerelease, published 2026-09-17T18:45:06Z.

The SHA is a real commit. be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd, committed 2026-09-17T18:37:30Z. Raw git, independent of the API, resolves both tags to it:

$ git ls-remote https://github.com/android-actions/setup-android v4.0.4 v4
be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd	refs/tags/v4
be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd	refs/tags/v4.0.4

Actions resolved the step and CI passed. The finding says "GitHub Actions cannot resolve this step, so Android CI never starts." The run for this exact commit (d6a3b7ea) completed successfully — build, unit tests, contract tests and emulator instrumented tests:

Download action repository 'android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd' (SHA:be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd)
Setup Android SDK ... Accepting Android SDK licenses
Accept? (y/N): All SDK package licenses accepted
outcome=success;conclusion=success;duration_ms=10310

Likely cause: v4.0.4 shipped one day before this PR, so a model without current data would not know the tag or commit exists.

The pin also resolves the Semgrep finding third-party-action-not-pinned-to-commit-sha, and matches how this repo already pins third-party actions (googleapis/release-please-action@45996ed1 # v5.0.0, reactivecircus/android-emulator-runner@6b0df4b0 #2.30.1). Semgrep now passes. Keeping the pin as is.