ci: Update android-actions/setup-android to v4

[gdaegeun539]

Please check if the PR fulfills these requirements

• The commit message follows our guidelines

What kind of change does this PR introduce?

• CI/CD update

What is the current behavior?

.github/workflows/android-ci.yml uses android-actions/setup-android@v3, which triggers the following Node.js 20 deprecation warning in GitHub Actions:

Node.js 20 actions are deprecated... The following actions are running on Node.js 20... android-actions/setup-android@v3

See: https://github.blog/changelog/2025-09-19/deprecation-of-node-20-on-github-actions-runners/

What is the new behavior (if this is a feature change)?

Bumps android-actions/setup-android from v3 to v4.
v4 is the latest release of the action and runs on Node.js 24, removing the deprecation warning and keeping the workflow aligned with GitHub's runner roadmap.

Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)

No. The action input interface is unchanged between v3 and v4, so no workflow or application changes are required.

ScreenShots (If needed)

Not applicable — CI workflow change only.

Other information:

• Branch naming: ci/update-android-actions-v4 was chosen because this change has no associated Jira ticket and only touches CI configuration. The ci/ prefix follows the common convention for workflow/infrastructure-only changes, and the descriptive suffix indicates the exact dependency being updated.
• Related changelog: https://github.blog/changelog/2025-09-19/deprecation-of-node-20-on-github-actions-runners/
• Action release page: https://github.com/android-actions/setup-android/releases/tag/v4.0.1

Summary by CodeRabbit

• Chores
  • Updated Android build infrastructure to use the latest version of Android SDK setup tooling.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Android CI workflow's build job updates the Android SDK setup step to use android-actions/setup-android@v4 instead of @v3, a straightforward dependency version upgrade in the continuous integration configuration.

Changes

Android CI Workflow Update

Layer / File(s)	Summary
Android SDK setup action version bump .github/workflows/android-ci.yml	The build job's "Set up Android SDK" step updates android-actions/setup-android from v3 to v4.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 The rabbit hops with glee,
V3 to V4, we decree!
Android SDK shines so bright,
Our CI now runs just right!
A simple hop, a workflow's leap—
This update runs deep! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately describes the main change: updating the android-actions/setup-android action from v3 to v4 in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gdaegeun539]

이번 PR 본문은 @sisyphus-dev-ai 의 영혼을 담은 Kimi K2.6이 써줬어요

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/android-ci.yml (1)

74-74: ⚡ Quick win

Consider pinning GitHub Actions to commit hashes for supply-chain security.

While this is a pre-existing pattern in the workflow (all actions use tags, not commit hashes), GitHub security best practice recommends pinning actions to full commit SHA hashes instead of version tags. The v4 release incremented the major version to safeguard against potential breaks from the Node.js upgrade, which is a sound design, but using a commit hash (rather than a mutable tag like v4) would prevent accidental or malicious updates to the tag after merge.

This is not a blocker for this PR, but worth addressing across the workflow holistically.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/android-ci.yml at line 74, The workflow uses the mutable
tag "android-actions/setup-android@v4" which should be pinned to a full commit
SHA for supply-chain security; update the uses entry for
android-actions/setup-android to reference the action's immutable commit SHA
(e.g., android-actions/setup-android@<full-commit-sha>) by looking up the action
repository's latest v4 commit and replacing the tag with that SHA so the
workflow pulls an exact revision.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/android-ci.yml:
- Line 74: The workflow uses the mutable tag "android-actions/setup-android@v4"
which should be pinned to a full commit SHA for supply-chain security; update
the uses entry for android-actions/setup-android to reference the action's
immutable commit SHA (e.g., android-actions/setup-android@<full-commit-sha>) by
looking up the action repository's latest v4 commit and replacing the tag with
that SHA so the workflow pulls an exact revision.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 230ba92a-0a29-4320-9914-adf6f4fb299f

📥 Commits

Reviewing files that changed from the base of the PR and between f62fbb6 and ec43ec3.

📒 Files selected for processing (1)

• .github/workflows/android-ci.yml

[gdaegeun539]

Build check CI도 통과했으므로 병합하겠습니다.

Coderabbit nitpick에서 나온 공급망 공격은 CI에서 Dev, QA 키만 사용해서 일단은 따로 관리하지는 않을게요.