feat(android): let callers choose the JDK of the APK release job

.github/workflows/build-test-publish.yml

@@ -403,6 +403,7 @@ jobs:
       app_root: ${{ inputs.app_root }}
       artifact_path: ${{ inputs.artifact_path }}
       tool: ${{ inputs.tool }}
+      java_version: ${{ inputs.java_version }}
     secrets:
       ANDROID_STOREPASS: ${{ secrets.ANDROID_STOREPASS }}
       ANDROID_KEYSTORE: ${{ secrets.ANDROID_KEYSTORE }}

.github/workflows/release-android-apk.yml

@@ -29,6 +29,11 @@ on:
         default: "none"
         required: false
         type: string
+      java_version:
+        description: "Java version to use"
+        default: "25"
+        required: false
+        type: string
 
 jobs:
   release_android_apk:
@@ -84,7 +89,7 @@ jobs:
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "temurin"
-          java-version: "25"
+          java-version: ${{ inputs.java_version }}
 
       # The keystore comes from a secret and is never generated here. It used
       # to live only in the Actions cache, which GitHub evicts after 7 days

CLAUDE.md

@@ -473,16 +473,17 @@ Renovate's custom managers track:
   on the active LTS line rather than jumping to an odd/current release.
 - **npm CLI** — the `npm install -g npm@<major>` pin; minor/patch updates are
   disabled since the pin only expresses a major.
-- **Java** — the `java-version:` pin in `release-android-apk.yml` and the
-  `java_version` input default in `test-and-build.yml` / `build-test-publish.yml` /
-  `publish-maven-central.yml`.
-  The pins differ on purpose (25 generic, 24 android) and a caller may ask for
-  another major through `java_version`, so a major update is never opened on
-  its own: it waits as a checkbox in the Dependency Dashboard
-  (`dependencyDashboardApproval`) until someone asks for the PR. Changing a
-  default major is a deliberate, tested change — the android pin stays on 24
-  until every `app_root` caller runs Gradle 9.1+, the first Gradle that runs on
-  JDK 25. The pins express a major
+- **Java** — the `java_version` input default in `test-and-build.yml` /
+  `build-test-publish.yml` / `publish-maven-central.yml` /
+  `release-android-apk.yml`.
+  All defaults are the same major (25) and a caller may ask for another one
+  through `java_version`, which the orchestrator also passes to the Android
+  release job. A major update is never opened on its own: it waits as a
+  checkbox in the Dependency Dashboard (`dependencyDashboardApproval`) until
+  someone asks for the PR. Changing the default major is a deliberate, tested
+  change — JDK 25 needs Gradle 9.1+, so an `app_root` caller with an older
+  Gradle wrapper has to pass a `java_version` its wrapper supports. The pins
+  express a major
   only, so `extractVersionTemplate` cuts the datasource's full versions
   (`21.0.12+101.0.LTS`) down to the major — without it Renovate tries to write
   the full version into the pin and the branch fails with "update failure".

README.md

@@ -105,7 +105,7 @@ _Python, Rust, Firefox, Android, GitHub releases_
 | Input | Default | Description |
 |---|---|---|
 | `publish_python_libraries` | `false` | Validate build + tag for PyPI release (requires `tool: uv`; upload is parked, see §5) |
-| `java_version` | `25` | JDK major version for `tool: ./gradlew` or `mvn` (Temurin). JDK 25 needs Gradle 9.1+; with an older wrapper pass `java_version: "21"` |
+| `java_version` | `25` | JDK major version (Temurin) for `tool: ./gradlew` or `mvn`, and for the Android APK release job (`app_root`). JDK 25 needs Gradle 9.1+; with an older wrapper pass `java_version: "21"` |
 | `go_version` | `""` | Go version for `tool: go`; empty reads it from `go.mod` |
 | `rust_version` | `stable` | Rust toolchain version |
 | `enable_clippy` | `true` | Run Clippy |
@@ -327,6 +327,7 @@ Builds and releases Android APK files.
 
 **Features:**
 - ✅ Signing keystore from the `ANDROID_KEYSTORE` secret; never generated, so every release is signed with the same key
+- ✅ JDK chosen by the caller through `java_version` (default 25); an app whose Gradle wrapper is older than 9.1 has to pass a JDK that wrapper supports
 - ✅ APK signing and alignment
 - ✅ GitHub releases integration
 - ✅ Timeout protection (30 minutes)

renovate.json

@@ -136,7 +136,7 @@
       "groupName": "python security tools"
     },
     {
-      "description": "Java pins are chosen per job (25 generic default, 24 android) and callers override via java_version; majors are a deliberate, tested change, so they wait for approval in the Dependency Dashboard",
+      "description": "Java defaults are one major for all jobs and callers override via java_version; majors are a deliberate, tested change, so they wait for approval in the Dependency Dashboard",
       "matchDepNames": [
         "java"
       ],