SDK check: treat an empty <codename> as stable; tag images with build-tools

.github/workflows/check-sdk-updates.yml

@@ -75,8 +75,9 @@ jobs:
           # are listed too), which then break the unattended Docker build when
           # sdkmanager demands the separate Android SDK Preview license. The manifest
           # carries reliable preview markers, so we parse it with a real XML parser
-          # and skip any package that is obsolete, carries a <codename> element, or
-          # uses the android-sdk-preview-license.
+          # and skip any package that is obsolete, carries a non-empty <codename>, or
+          # uses the android-sdk-preview-license. Stable platforms since android-37.0
+          # carry an EMPTY <codename></codename>, so only a non-empty one marks a preview.
           if ! wget -q "https://dl.google.com/android/repository/repository2-3.xml" -O /tmp/android-repo.xml; then
             echo "Failed to download SDK repository manifest"
             echo "updated=false" >> $GITHUB_OUTPUT
@@ -94,7 +95,7 @@ jobs:
               if pkg.get('obsolete') == 'true':
                   return True
               for e in pkg.iter():
-                  if local(e.tag) == 'codename':
+                  if local(e.tag) == 'codename' and (e.text or '').strip():
                       return True
                   if local(e.tag) == 'uses-license' and e.get('ref') == 'android-sdk-preview-license':
                       return True

.github/workflows/deploy.yml

@@ -42,16 +42,18 @@ jobs:
           RUNNER_TAG=$(grep -m1 '^ARG VERSION=' Dockerfile | cut -d= -f2)
           RUNNER_VERSION=$(echo "$RUNNER_TAG" | cut -d- -f1)
           COMPILE_SDK=$(grep -m1 '^ARG COMPILE_SDK=' Dockerfile | cut -d= -f2)
+          BUILD_TOOLS=$(grep -m1 '^ARG BUILD_TOOLS=' Dockerfile | cut -d= -f2)
           NDK_VERSION=$(grep -m1 '^ARG NDK_VERSION=' Dockerfile | cut -d= -f2)
 
-          if [ -z "$RUNNER_TAG" ] || [ -z "$RUNNER_VERSION" ] || [ -z "$COMPILE_SDK" ] || [ -z "$NDK_VERSION" ]; then
+          if [ -z "$RUNNER_TAG" ] || [ -z "$RUNNER_VERSION" ] || [ -z "$COMPILE_SDK" ] || [ -z "$BUILD_TOOLS" ] || [ -z "$NDK_VERSION" ]; then
             echo "::error::Failed to extract versions from Dockerfile"
             exit 1
           fi
 
           echo "runner_tag=${RUNNER_TAG}" >> $GITHUB_OUTPUT
           echo "runner_version=${RUNNER_VERSION}" >> $GITHUB_OUTPUT
           echo "compile_sdk=${COMPILE_SDK}" >> $GITHUB_OUTPUT
+          echo "build_tools=${BUILD_TOOLS}" >> $GITHUB_OUTPUT
           echo "ndk_version=${NDK_VERSION}" >> $GITHUB_OUTPUT
 
       - name: Login to Docker Hub
@@ -83,6 +85,10 @@ jobs:
             # Same image, with the NDK it ships in the tag: consumers that pin an NDK (Android
             # Gradle ndkVersion) can let Renovate derive it from this tag so image and NDK move together.
             type=raw,value=${{ steps.versions.outputs.runner_version }}-jdk${{ matrix.java_version }}-sdk${{ steps.versions.outputs.compile_sdk }}-ndk${{ steps.versions.outputs.ndk_version }}
+            # Same image, with every Gradle-pinnable SDK component in the tag (compileSdk, build-tools,
+            # NDK), so consumers can let Renovate derive all three from one tag. The -sdk-ndk tag above
+            # stays for consumers already parsing it.
+            type=raw,value=${{ steps.versions.outputs.runner_version }}-jdk${{ matrix.java_version }}-sdk${{ steps.versions.outputs.compile_sdk }}-bt${{ steps.versions.outputs.build_tools }}-ndk${{ steps.versions.outputs.ndk_version }}
             type=raw,value=latest,enable=${{ matrix.is_default_jdk }}
 
       - name: Build and push

README.md

@@ -29,6 +29,12 @@ version, and Android SDK level. Tags let you choose how tightly to pin:
 | `latest` | `latest` | Nothing | Runner, JDK, and SDK all track latest |
 | `jdk<VERSION>` | `jdk21` | JDK major version | Runner and SDK track latest |
 | `<RUNNER>-jdk<JDK>-sdk<SDK>` | `2.332.0-jdk21-sdk36` | Everything | Nothing — fully pinned |
+| `<RUNNER>-jdk<JDK>-sdk<SDK>-ndk<NDK>` | `2.338.0-jdk21-sdk36.1-ndk30.0.16248370` | Same image, NDK spelled out | Nothing — fully pinned |
+| `<RUNNER>-jdk<JDK>-sdk<SDK>-bt<BUILD_TOOLS>-ndk<NDK>` | `2.338.0-jdk21-sdk36.1-bt37.0.0-ndk30.0.16248370` | Same image, build-tools and NDK spelled out | Nothing — fully pinned |
+
+The longer tags exist so a consumer can let Renovate derive its Gradle
+`compileSdk`, `buildToolsVersion` and `ndkVersion` from the image pin: when they
+match what the image ships, AGP doesn't download SDK components on every job.
 
 ### Which tag should I use?