From 3094fc8cf09e8dfa1f9d48e1524a92410bec4fe9 Mon Sep 17 00:00:00 2001
From: justinzeus <justinfvisser@gmail.com>
Date: Thu, 22 Oct 2026 12:58:38 +0200
Subject: [PATCH] Pin platform tools and use the upstream debug unit task

---
 Makefile          |  2 +-
 docker/Dockerfile |  7 +++++++
 docker/README.md  | 17 ++++++++++++-----
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/Makefile b/Makefile
index 0f2d2017..df6bd824 100644
--- a/Makefile
+++ b/Makefile
@@ -15,7 +15,7 @@ apk-debug: build-image
 	@bash docker/gradle.sh debug assembleDefaultDebug
 
 test: build-image
-	@bash docker/gradle.sh release testDefaultReleaseUnitTest
+	@bash docker/gradle.sh debug testDefaultDebugUnitTest
 
 release-tag:
 	@bash docker/release-tag.sh
diff --git a/docker/Dockerfile b/docker/Dockerfile
index bae48a77..ce7d039f 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -12,6 +12,13 @@ RUN curl -fsSL https://dl.google.com/android/repository/commandlinetools-linux-1
     && rm -rf /tmp/tools.zip /tmp/android-tools \
     && yes | sdkmanager --licenses >/dev/null \
     && sdkmanager 'platforms;android-37.0' 'build-tools;36.0.0' \
+    && while IFS='=' read -r name value; do \
+        if [ "$name" = Pkg.Revision ]; then test "$value" = 2 || exit 1; fi; \
+    done < "$ANDROID_HOME/platforms/android-37.0/source.properties" \
+    && curl -fsSL https://dl.google.com/android/repository/platform-tools_r37.0.1-linux.zip -o /tmp/platform-tools.zip \
+    && echo '477254aa5f903c15cf51001717bdf347fb6b53e0  /tmp/platform-tools.zip' | sha1sum -c - \
+    && unzip -q /tmp/platform-tools.zip -d "$ANDROID_HOME" \
+    && rm /tmp/platform-tools.zip \
     && mkdir -m 1777 /gradle
 ENV GRADLE_USER_HOME=/gradle HOME=/tmp
 COPY signing.init.gradle /opt/wolfskin/signing.init.gradle
diff --git a/docker/README.md b/docker/README.md
index 5b56071c..353a716f 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -6,7 +6,7 @@ host needs Docker, GNU Make, Bash, and Git, not Java or the Android SDK.
 ```sh
 git fetch origin --tags
 make apk        # clean, signed default release: three ABI splits + universal
-make test       # upstream testDefaultReleaseUnitTest in the same image
+make test       # upstream testDefaultDebugUnitTest in the same image, no secrets
 make apk-debug  # default debug, no secrets; MPV stub and no extra codec decoders
 ```
 
@@ -17,12 +17,19 @@ use the catalog's exact Wholphin extension version (currently `0.2.4`). Do not
 place local extension AARs in `app/libs`: upstream prefers them over the pinned
 GitHub Packages dependencies.
 
+Upstream enables JVM unit tests only for debug variants; there is no
+`testDefaultReleaseUnitTest` task. `make test` uses the closest default-flavor
+task without changing upstream's test configuration.
+
 ## Toolchain and disk use
 
-`Dockerfile` pins Temurin JDK `21.0.11+10` by image digest, Android command-line
-tools `23.0` by archive and checksum, SDK platform `37.0`, and build-tools
-`36.0.0`. Gradle comes from the committed wrapper. The image is built for
-`linux/amd64`; the default local image tag is `wolfskin-build:sdk37-jdk21`.
+`Dockerfile` pins Temurin JDK `21.0.11+10` by image digest, command-line tools
+`23.0` and platform-tools `37.0.1` by archive and checksum, and build-tools
+`36.0.0` by SDK package version. The SDK manager registers platform `37.0` and
+its licenses; the build rejects any platform revision other than 2. An SDK
+revision upgrade therefore requires a deliberate Dockerfile update.
+Gradle comes from the committed wrapper. The image is built for `linux/amd64`;
+the default local image tag is `wolfskin-build:sdk37-jdk21`.
 Upstream's build timestamp means APKs are not byte-for-byte reproducible.
 
 Gradle downloads and caches live in the named volume `wolfskin-gradle`, not