ci: fetch the prebuilt V8 and build against NDK r29

CI invokes gradle directly rather than build.sh, so nothing installed the
V8 libraries and every ABI failed with "libv8_monolith.a ... missing and
no known rule to make it". Both workflows now run ./download_v8.sh before
the first gradle invocation.

NDK_VERSION also moves r27d -> r29. V8 14.9 uses std::atomic_ref, which
r27d's libc++ 18 does not implement, and the runtime compiles that header
because v8_inspector vendors V8 internals.

download_v8.sh picks sha256sum or shasum depending on what the host has;
it was written on macOS, where only the latter exists.

Author: edusperoni

.github/workflows/npm_release.yml

@@ -15,7 +15,7 @@ on:
 env:
   NPM_TAG: "next"
   EMULATOR_NAME: "runtime-emu"
-  NDK_VERSION: r27d
+  NDK_VERSION: r29
   ANDROID_API: 33
   ANDROID_ABI: x86_64
   NDK_ARCH: linux
@@ -93,6 +93,8 @@ jobs:
           NPM_TAG=$(node ./scripts/get-npm-tag.js)
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
           echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
+      - name: Fetch prebuilt V8
+        run: ./download_v8.sh
       - name: Build npm package
         run: ./gradlew -PgitCommitVersion=${{ github.sha }} -PnoCCache --stacktrace
       - name: Upload npm package artifact
@@ -144,6 +146,8 @@ jobs:
         run: |
           npm install
           npm install --prefix ./test-app/tools
+      - name: Fetch prebuilt V8
+        run: ./download_v8.sh
       - name: SBG tests
         run: ./gradlew runSbgTests --stacktrace
       - name: Enable KVM

.github/workflows/pull_request.yml

@@ -5,7 +5,7 @@ on:
 env:
   NPM_TAG: "pr"
   EMULATOR_NAME: "runtime-emu"
-  NDK_VERSION: r27d
+  NDK_VERSION: r29
   ANDROID_API: 33
   ANDROID_ABI: x86_64
   NDK_ARCH: linux
@@ -67,6 +67,8 @@ jobs:
           NPM_TAG=$(node ./scripts/get-npm-tag.js)
           echo NPM_VERSION=$NPM_VERSION >> $GITHUB_OUTPUT
           echo NPM_TAG=$NPM_TAG >> $GITHUB_OUTPUT
+      - name: Fetch prebuilt V8
+        run: ./download_v8.sh
       - name: Build npm package
         run: ./gradlew -PgitCommitVersion=${{ github.sha }} -PnoCCache --stacktrace
       - name: Upload npm package artifact
@@ -112,6 +114,8 @@ jobs:
         run: |
           npm install
           npm install --prefix ./test-app/tools
+      - name: Fetch prebuilt V8
+        run: ./download_v8.sh
       - name: SBG tests
         run: ./gradlew runSbgTests --stacktrace
       - name: Enable KVM

download_v8.sh

@@ -100,8 +100,15 @@ done
 
 # Verify before unpacking anything. A release is only trustworthy because the
 # archive matches the checksum published with it.
+#
+# Linux has sha256sum, macOS has shasum; neither has both reliably.
+if command -v sha256sum > /dev/null 2>&1; then
+    SHA256_CHECK="sha256sum -c -"
+else
+    SHA256_CHECK="shasum -a 256 -c -"
+fi
 echo "Verifying checksums"
-( cd "$DL" && grep -E "$(printf '%s|' "${ASSETS[@]}" | sed 's/|$//')" SHA256SUMS | shasum -a 256 -c - ) \
+( cd "$DL" && grep -E "$(printf '%s|' "${ASSETS[@]}" | sed 's/|$//')" SHA256SUMS | $SHA256_CHECK ) \
     || { echo "Checksum verification FAILED for $RELEASE" >&2; exit 1; }
 
 STAGE="$(mktemp -d)"