build(android): upgrade AGP from 8.x to 9.4.0

[jpnurmi]

💡 FOSSA blocks releases on AGP 8.7.3's internal test dependencies: com.google.testing.platform artifacts at 0.0.9-alpha02 use the Android SDK license and aren't classified as test-only by FOSSA. AGP 9.4.0 uses com.android.tools.utp:gradle-work-action:32.4.0, whose POM declares Apache 2.0.

Match sentry-java: Gradle 9.7.1, Kotlin 2.3.21, Maven Publish 0.30.0, Dokka 2.0.0, Spotless 8.8.0, Detekt 1.23.8, Develocity 4.5.0, and API 37. Add the VERSION_AGP override.

Gradle 9 removed VersionNumber, breaking the old publishing and native-bundle plugins. Upgrade publishing, apply it before DSL finalization, and copy legacy headers directly into the AAR. Update Craft's source/Javadoc paths and regenerate the wrapper.

Keep Java 8, NDK 27.0.12077973, AAR minCompileSdk=1, and no implicit library targetSdk to preserve hotfix compatibility. Retain the legacy DSL, external Kotlin plugin, and pipeline signing.

Close: #2093

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.86%. Comparing base (0a136fc) to head (6d32545).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2111      +/-   ##
==========================================
+ Coverage   74.68%   74.86%   +0.18%     
==========================================
  Files         103      103              
  Lines       27449    27449              
  Branches     4966     4966              
==========================================
+ Hits        20500    20551      +51     
+ Misses       5601     5548      -53     
- Partials     1348     1350       +2     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

Cross-cutting build and publication changes require CI and human validation of final release artifacts.

Pull request overview

Upgrades the Android build stack to AGP 9.4.0 to resolve FOSSA license failures while preserving legacy compatibility.

Changes:

• Upgrades Gradle, AGP, Kotlin, publishing, linting, and API levels.
• Updates publishing and AAR header packaging for Gradle 9.
• Preserves Java 8, NDK, SDK, and legacy DSL behavior.

File summaries

File	Description
ndk/settings.gradle	Upgrades Develocity.
ndk/sample/build.gradle.kts	Targets Android API 37.
ndk/lib/build.gradle.kts	Updates Android configuration and AAR packaging.
ndk/gradlew.bat	Regenerates the Windows Gradle wrapper script.
ndk/gradlew	Regenerates the POSIX Gradle wrapper script.
ndk/gradle/wrapper/gradle-wrapper.properties	Upgrades the Gradle distribution.
ndk/gradle.properties	Retains legacy Android DSL and SDK behavior.
ndk/build.gradle.kts	Upgrades plugins and revises publication packaging.

Review details

• Files reviewed: 8/9 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[runningcode]

This doesn't seem the right way to fix an issue related to a specific version of a dependency. Gradle has a million ways to change the way dependencies are resolved. See here for more details. https://docs.gradle.org/current/userguide/resolution_rules.html

But as your resident Gradle expert I do suggest that you update to the latest Gradle version!

[runningcode]

i'm sad that the bad practices from sentry-java are being copied here. we should try to remove this or move it to a build-logic plugin (docs)

I understand why this is needed from a compatibilty perspective though as Google raised the default away from the deprecated java 8 to java 11. We should also follow google's pattern and raise it to java 11 because once google raises it, nobody else will need it.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8f243e2. Configure here.}

[runningcode]

where do we set the ANDROID_NDK env variable? or is that needed for local testing?

[jpnurmi]

Used by integration tests:

sentry-native/tests/build_config.py

Lines 20 to 35 in bc32ba9

	def get_android_config():
	"""
	Returns Android toolchain CMake options if ANDROID_API and ANDROID_NDK
	environment variables are set.
	"""
	if not (os.environ.get("ANDROID_API") and os.environ.get("ANDROID_NDK")):
	return {}
	toolchain = "{}/ndk/{}/build/cmake/android.toolchain.cmake".format(
	os.environ["ANDROID_HOME"], os.environ["ANDROID_NDK"]
	)
	return {
	"CMAKE_TOOLCHAIN_FILE": toolchain,
	"ANDROID_ABI": os.environ.get("ANDROID_ARCH") or "x86",
	"ANDROID_NATIVE_API_LEVEL": os.environ["ANDROID_API"],
	}

Locally and in the CI:

sentry-native/.github/workflows/ci.yml

Lines 223 to 248 in bc32ba9

	- name: Android (API 21, NDK 23)
	os: ubuntu-latest
	ANDROID_API: 21
	ANDROID_NDK: 23.2.8568313
	ANDROID_ARCH: x86_64
	- name: Android (API 26, NDK 27)
	os: ubuntu-latest
	ANDROID_API: 26
	ANDROID_NDK: 27.3.13750724
	ANDROID_ARCH: x86_64
	- name: Android (API 31, NDK 27)
	os: ubuntu-latest
	ANDROID_API: 31
	ANDROID_NDK: 27.3.13750724
	ANDROID_ARCH: x86_64
	- name: Android (API 35, NDK 29)
	os: macos-15-large
	ANDROID_API: 35
	ANDROID_NDK: 29.0.14206865
	ANDROID_ARCH: x86_64
	- name: Android (API 36, NDK 30 + asan)
	os: ubuntu-latest
	ANDROID_API: 36
	ANDROID_NDK: 30.0.16138531
	ANDROID_ARCH: x86_64
	RUN_ANALYZER: asan