feat(ci): pre-built Android builder image + sccache

Replaces the 5 per-run tool-install steps (~2m 30s) with a pre-built
container image (git.aleshym.co/funman300/android-builder) that ships
Ubuntu 22.04 + Java 17 + Android SDK/NDK + Rust stable + aarch64 target
+ cargo-ndk + sccache. android-release.yml now runs inside the container
and adds two cache steps instead: Cargo registry and sccache directory.

sccache (RUSTC_WRAPPER) caches at the translation-unit level so partial
hits survive Cargo.lock changes — far more resilient than caching the
full target/ directory.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/android-release.yml

@@ -6,10 +6,6 @@ on:
       - 'v*'
 
 env:
-  ANDROID_HOME: /opt/android-sdk
-  NDK_VERSION: 30.0.14904198
-  BUILD_TOOLS_VERSION: "36.1.0"
-  PLATFORM: android-34
   APK_OUT: target/release/apk/ferrous-solitaire.apk
   GITEA_URL: https://git.aleshym.co
   REPO: funman300/Ferrous-Solitaire
@@ -17,64 +13,42 @@ env:
 jobs:
   build-apk:
     runs-on: ubuntu-latest
+    container:
+      image: git.aleshym.co/funman300/android-builder:latest
+      credentials:
+        username: ${{ gitea.actor }}
+        password: ${{ secrets.CI_TOKEN }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Set up Java 17
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: '17'
-
-      - name: Cache Android SDK
-        uses: actions/cache@v4
-        id: android-cache
-        with:
-          path: /opt/android-sdk
-          key: android-sdk-${{ env.NDK_VERSION }}-${{ env.BUILD_TOOLS_VERSION }}
-
-      - name: Install Android SDK + NDK
-        if: steps.android-cache.outputs.cache-hit != 'true'
-        run: |
-          mkdir -p $ANDROID_HOME/cmdline-tools
-          wget -q https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip \
-               -O /tmp/cmdtools.zip
-          unzip -q /tmp/cmdtools.zip -d $ANDROID_HOME/cmdline-tools
-          mv $ANDROID_HOME/cmdline-tools/cmdline-tools $ANDROID_HOME/cmdline-tools/latest
-          yes | $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager --licenses >/dev/null || true
-          $ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager \
-            "ndk;$NDK_VERSION" \
-            "build-tools;$BUILD_TOOLS_VERSION" \
-            "platforms;$PLATFORM"
-
-      - name: Set up Rust (stable + aarch64-android)
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: aarch64-linux-android
-
-      - name: Cache Cargo
+      - name: Cache Cargo registry
         uses: actions/cache@v4
         with:
           path: |
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-            ~/.cargo/bin/cargo-ndk
-            target/aarch64-linux-android
-          key: cargo-android-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: cargo-android-
+            /usr/local/cargo/registry/index
+            /usr/local/cargo/registry/cache
+            /usr/local/cargo/git/db
+          key: cargo-registry-android-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: cargo-registry-android-
 
-      - name: Install cargo-ndk
-        run: cargo-ndk --version 2>/dev/null || cargo install cargo-ndk --version 4.1.2 --locked
+      - name: Cache sccache
+        uses: actions/cache@v4
+        with:
+          path: /root/.cache/sccache
+          key: sccache-android-aarch64-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: sccache-android-aarch64-
+
+      - name: Get tag name
+        id: tag
+        run: echo "name=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
 
       - name: Decode release keystore
         run: echo "${{ secrets.RELEASE_KEYSTORE_B64 }}" | base64 -d > release.jks
 
       - name: Build release APK
         env:
-          ANDROID_NDK_HOME: /opt/android-sdk/ndk/${{ env.NDK_VERSION }}
           PROFILE: release
           ABIS: arm64-v8a
           KEYSTORE: ./release.jks
@@ -82,11 +56,13 @@ jobs:
           KEY_ALIAS: release
           KEY_PASS: ${{ secrets.RELEASE_KEYSTORE_PASS }}
           VERSION_NAME: ${{ steps.tag.outputs.name }}
+          RUSTC_WRAPPER: sccache
+          SCCACHE_DIR: /root/.cache/sccache
         run: bash scripts/build_android_apk.sh
 
-      - name: Get tag name
-        id: tag
-        run: echo "name=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+      - name: sccache stats
+        if: always()
+        run: sccache --show-stats
 
       - name: Create or get Gitea release
         id: release
@@ -95,7 +71,6 @@ jobs:
           BASE="${{ env.GITEA_URL }}/api/v1/repos/${{ env.REPO }}"
           AUTH="Authorization: token ${{ secrets.CI_TOKEN }}"
 
-          # Re-use an existing release for this tag (e.g. created manually).
           ID=$(curl -sf -H "$AUTH" "$BASE/releases/tags/$TAG" \
                | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" \
                2>/dev/null || true)

.gitea/workflows/builder-image.yml

@@ -0,0 +1,41 @@
+name: Build Android Builder Image
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - 'docker/android-builder.Dockerfile'
+      - '.gitea/workflows/builder-image.yml'
+
+env:
+  IMAGE: git.aleshym.co/funman300/android-builder
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Log in to Gitea registry
+        uses: docker/login-action@v3
+        with:
+          registry: git.aleshym.co
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.CI_TOKEN }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: network=host
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/android-builder.Dockerfile
+          push: true
+          tags: ${{ env.IMAGE }}:latest
+          cache-from: type=registry,ref=${{ env.IMAGE }}:buildcache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:buildcache,mode=max