ci: run the unit-test suite under the flatpak build's bounds-checked STL (#14709)

* ci(flatpak): run the unit suite in a separate job, mirroring the other arches

Alternative to the in-job step: split build and test like the Linux/Windows/
macOS legs. The flatpak build now builds the test binaries in-sandbox (the
action's run-tests fires the module's build-only test-commands), prunes the
kept build tree to the test binaries + CTest metadata + data, and uploads it
with /app as a test asset (size reported to the run summary).

A new unit_tests_flatpak matrix job downloads that asset on a native runner,
restores the module-build symlink, and runs the suite via flatpak-builder
--run (which bind-mounts /run/build so TEST_DATA_DIR resolves) against the
GNOME SDK's bounds-checked STL. Results feed publish_test_results.

Costs a per-arch asset upload/download + a runtime install on the test
runner; the trade-off vs the in-job step is a genuine separate graph box.

* ci(flatpak): run tests via `flatpak build` to avoid rofiles-fuse

`flatpak-builder --run` sets up a rofiles-fuse overlay that this CI container
rejects (Failure spawning rofiles-fuse, exit_status: 256), even in a fresh job
with a machine-id and the runtime installed, and --disable-rofiles-fuse is not
accepted in --run mode. `flatpak build` enters the sandbox via bwrap directly,
so it sidesteps rofiles-fuse; bind-mounting the build tree at /run/build gives
the same path the compiled-in TEST_DATA_DIR expects.

* ci(flatpak): slim the test asset (strip binaries, drop source tree)

The first cut shipped ~1 GB: the test exes carried debug info (the SDK builds
with -g and only the app gets stripped) and the packaged module dir included
the whole copied source tree the tests never read at runtime. Strip the test
binaries and keep only build_flatpak/tests, tests/ (TEST_DATA_DIR) and scripts/.
The irreducible remainder is /app, which the exes link against.

* ci(flatpak): extract the test run into a reusable unit_tests_flatpak workflow

Move the flatpak test job out of build_all.yml into a reusable
unit_tests_flatpak.yml, called once per arch (Flatpak x86_64 / aarch64) the
same way the other arches call unit_tests.yml. build_all.yml keeps only the
build + asset packaging; the reusable workflow downloads the asset, runs the
suite via `flatpak build`, and uploads results as test-results-<artifact> for
publish_test_results. Drops the now-unused manifest checkout (flatpak build
does not need it).

* ci(flatpak): trim comments to the non-obvious

No behavior change.

* ci(flatpak): drop redundant caller comment

* ci(flatpak): drop redundant trim comment

* ci(flatpak): drop size-report scaffolding and redundant if-guards

* ci(flatpak): force the app module to rebuild so the test asset always exists

flatpak-builder caches modules by content hash and skips a hit, producing no
build tree and no test asset, so a re-run of the same commit would leave the
separate test job with nothing to download. Inject a per-run cache-buster into
the OrcaSlicer module's build-options (part of its cache key) so it always
rebuilds, mirroring how the other arches cache only deps and always rebuild the
app and tests. The deps modules stay cached.

* ci(flatpak): trim cache-buster comment, fix stale step name

* fix: guard H2C per-filament array reads against short config arrays

The H2C tool-ordering, wipe-tower, and g-code export paths index per-filament
config arrays by filament/tool id. A config with fewer entries than the filament
count (partial or legacy projects, minimal test configs) makes these reads run
past the end of the vector: silent under a normal STL, but UB that aborts under
the flatpak build's bounds-checked STL (_GLIBCXX_ASSERTIONS).

Route the reads through the existing clamping accessors (get_at,
get_filament_category, is_in_same_extruder) and add a small clamp helper for
filament_change_length. The guards are no-ops when the arrays are sized to the
filament count, so correctly specified configs are unaffected.

* ci(flatpak): build filament_group_tests too

The suite landed on main after this branch was cut and arrived via a later merge,
so it was missing from the target list and ctest failed the leg with
filament_group_tests_NOT_BUILT.

Not tests/all, which build_linux.sh uses: that is a Ninja subdirectory target and
this build configures with the default Makefile generator, where it does not exist.

* ci(flatpak): give the embedded-interpreter tests a valid Python home

python_test_support.hpp sets PyConfig.home to <testdir>/python when that
path resolves. WIN32/APPLE populate it with a copied bundled runtime; the
flatpak leg had no such branch, so home resolved to a directory with no
stdlib and all 21 embedded plugin tests failed at "failed to get the
Python codec of the filesystem encoding".

Symlink <testdir>/python to the bundled /app/libpython that already ships
in the flatpak (the test exe links libpython3.12.so from there via rpath),
so the interpreter initializes without duplicating the runtime.

* ci(flatpak): sync the ToolOrdering guard mirror with #14789

Match #14709's build_filament_group_context guard to the version on
#14789 (size filament_info to filament_nums, truncate filament_ids)
so the folded guard is a byte-identical mirror that drops cleanly when
#14789 merges, instead of leaving a stale hunk that conflicts on rebase.

* fix: guard WipeTower per-filament array reads against short config arrays

The BambuStudio WipeTower sync reintroduced raw per-filament array
indexing that reads out of bounds when a config leaves an array shorter
than the filament count: m_physical_extruder_map in format_line_M104/M109
(indexed even when empty), and m_filament_categories in get_wall_skip_points
and get_wall_filament_for_all_layer. Silent on a normal STL, a hard abort
under the bounds-checked STL the Flatpak build uses.

Bounds-check the physical extruder map before indexing (omitting the T
token, as the existing -1 path already does), and route the two raw
m_filament_categories reads through the clamping get_filament_category()
accessor the surrounding code already uses. No change for correctly-sized
configs.

* fix: default-initialize WallToolPathsParams fields

min_length_factor and is_top_or_bottom_layer had no default initializers, and the FillConcentric/FillConcentricInternal callers never set them, so WallToolPaths::removeSmallLines() thresholded on stack garbage. Which short extrusion lines it dropped then depended on memory layout, so concentric solid-infill output was nondeterministic between runs and across machines. Give every member a default, matching the adjacent FillParams. The perimeter path was already fine because it builds the struct via make_paths_params().

* fix: bounds-check the toolchange flush-volume and HRC per-filament lookups

GCode::set_extruder's toolchange flush-volume lookup and
GCodeProcessor::update_slice_warnings's HRC check index per-filament and
per-extruder arrays (flush_volumes_matrix, the filament map, the nozzle list)
by filament/extruder id. When a config leaves one of those arrays shorter than
the filament count (partial or legacy multi-extruder projects, minimal
configs), the reads run off the end: silent on a normal STL, a hard abort under
_GLIBCXX_ASSERTIONS.

Route both reads through bounds checks: the flush lookup falls back to no flush,
matching the existing unknown-old-filament branch beside it, and the HRC check
skips an unmapped filament, mirroring the required_nozzle_HRC guard on the line
above. When the arrays are sized to the filament count the values are unchanged,
so correctly-specified configs are unaffected.

* ci: retrigger checks

* ci: name the flatpak rebuild token after the cache it defeats

Since #15650 the Flatpak job also has a compiler cache, so a bare
"cache-buster" no longer says which cache is meant. Call it
flatpak_builder_cache_buster, and name the build-dir trim step after
the flatpak-builder cache save it keeps lean.

* ci: ship resources/profiles and resources/printers in the flatpak test asset

Two slic3rutils tests added in 4aa0e1d60b read
resources/printers/bambu_filament_ids.json through PROFILES_DIR/.., and
the asset dropped resources/ entirely, so both failed parsing an empty
stream on each Flatpak leg. Keep the two subtrees the tests reach;
test_gcodewriter's shipped-profile case stops skipping on this leg too.

* ci: restore the CRLF line endings of build_all.yml

The last merge from upstream/main rewrote the file with LF endings, which
turns the 60-line change into a whole-file diff on GitHub. Upstream has had
this file as CRLF since it was created, so put it back.

* ci: trigger Build all on changes to the unit-test workflows

The path filters only matched build_*.yml, so an edit to unit_tests.yml or
unit_tests_flatpak.yml could merge without ever running.

* ci: put a timeout on the flatpak unit-test step

Matches the 20 minutes of the regular unit-test workflow; without it a hung
test holds the runner for the six-hour job default.

.github/workflows/build_all.yml

@@ -14,6 +14,7 @@ on:
      - 'localization/**'
      - 'resources/**'
      - ".github/workflows/build_*.yml"
+     - ".github/workflows/unit_tests*.yml"
      - 'scripts/build_preset_cache.*'
      - 'scripts/flatpak/**'
      - 'scripts/msix/**'
@@ -30,6 +31,7 @@ on:
      - '**/CMakeLists.txt'
      - 'version.inc'
      - ".github/workflows/build_*.yml"
+     - ".github/workflows/unit_tests*.yml"
      - 'build_linux.sh'
      - 'build_release_vs.bat'
      - 'build_release_vs2022.bat'
@@ -207,7 +209,7 @@ jobs:
           ./validator-bin/OrcaSlicer_profile_validator -p "${{ github.workspace }}/resources/profiles" -s -l 2
   publish_test_results:
     name: Publish Test Results
-    needs: [unit_tests_linux_x86_64, unit_tests_linux_aarch64, unit_tests_windows_x64, unit_tests_windows_arm64, unit_tests_macos_arm64]
+    needs: [unit_tests_linux_x86_64, unit_tests_linux_aarch64, unit_tests_windows_x64, unit_tests_windows_arm64, unit_tests_macos_arm64, unit_tests_flatpak_x86_64, unit_tests_flatpak_aarch64]
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest
     steps:
@@ -324,9 +326,16 @@ jobs:
         sed -i '/^build-options:/a\  no-debuginfo: true\n  strip: true' \
           scripts/flatpak/com.orcaslicer.OrcaSlicer.yml
       shell: bash
-    - name: Inject git commit hash into Flatpak manifest
+    # flatpak-builder reuses a module from its cache when the definition and
+    # sources are unchanged, so a re-run of the same commit would skip the
+    # OrcaSlicer module and ship no test asset. A per-run value in that module's
+    # env keeps it rebuilding; orca_deps stays cached, and the compiler cache
+    # still serves the rebuild.
+    - name: Inject commit hash and flatpak-builder cache buster into Flatpak manifest
+      env:
+        flatpak_builder_cache_buster: ${{ github.run_id }}-${{ github.run_attempt }}
       run: |
-        sed -i "/name: OrcaSlicer/{n;s|buildsystem: simple|buildsystem: simple\n    build-options:\n      env:\n        git_commit_hash: \"$git_commit_hash\"|}" \
+        sed -i "/name: OrcaSlicer/{n;s|buildsystem: simple|buildsystem: simple\n    build-options:\n      env:\n        flatpak_builder_cache_buster: \"$flatpak_builder_cache_buster\"\n        git_commit_hash: \"$git_commit_hash\"|}" \
           scripts/flatpak/com.orcaslicer.OrcaSlicer.yml
       shell: bash
     # flatpak-builder's --ccache only wraps cc and gcc, and the manifest builds
@@ -372,6 +381,10 @@ jobs:
         save-cache: false
         arch: ${{ matrix.variant.arch }}
         upload-artifact: false
+        # run-tests fires the module's build-only test-commands; keep-build-dirs
+        # retains the binaries for the packaging step below.
+        run-tests: true
+        keep-build-dirs: true
     # The build has just touched everything it can use, so an object untouched
     # for a week is dead, usually orphaned by a flag change.
     - name: Compiler cache statistics
@@ -425,3 +438,46 @@ jobs:
         asset_name: OrcaSlicer-Linux-flatpak_nightly${{ env.nightly_suffix }}_${{ matrix.variant.arch }}.flatpak
         asset_content_type: application/octet-stream
         max_releases: 1 # optional, if there are more releases than this matching the asset_name, the oldest ones are going to be deleted
+    # The asset is /app (the exes link it at runtime) plus the build tree
+    # slimmed to what ctest needs.
+    - name: Package flatpak test asset
+      shell: bash
+      run: |
+        d=$(ls -d .flatpak-builder/build/OrcaSlicer-* | tail -1)
+        find "$d/build_flatpak" -mindepth 1 -maxdepth 1 ! -name tests -exec rm -rf {} +
+        # Strip debug info (the SDK builds with -g, only the app gets stripped);
+        # the bounds checks are compiled in, so a stripped exe still catches them.
+        find "$d/build_flatpak/tests" -type f -perm -u+x -exec strip --strip-unneeded {} + 2>/dev/null || true
+        # At runtime the tests read tests/ (TEST_DATA_DIR), scripts/, and under
+        # resources/ the shipped profiles (PROFILES_DIR) and the printers/ maps.
+        find "$d" -mindepth 1 -maxdepth 1 -type d \
+          ! -name tests ! -name build_flatpak ! -name scripts ! -name resources -exec rm -rf {} +
+        find "$d/resources" -mindepth 1 -maxdepth 1 ! -name profiles ! -name printers -exec rm -rf {} +
+        tar -cf flatpak-test-asset.tar flatpak_app "$d"
+    - name: Upload flatpak test asset
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ github.sha }}-flatpak-tests-${{ matrix.variant.arch }}
+        path: flatpak-test-asset.tar
+        retention-days: 1
+    # keep-build-dirs would otherwise land in the flatpak-builder cache saved post-job.
+    - name: Drop the kept build dirs before the flatpak-builder cache saves
+      if: always()
+      shell: bash
+      run: rm -rf .flatpak-builder/build
+  unit_tests_flatpak_x86_64:
+    name: Flatpak x86_64
+    needs: flatpak
+    if: ${{ !cancelled() && success() }}
+    uses: ./.github/workflows/unit_tests_flatpak.yml
+    with:
+      os: ubuntu-24.04
+      artifact: ${{ github.sha }}-flatpak-tests-x86_64
+  unit_tests_flatpak_aarch64:
+    name: Flatpak aarch64
+    needs: flatpak
+    if: ${{ !cancelled() && success() }}
+    uses: ./.github/workflows/unit_tests_flatpak.yml
+    with:
+      os: ubuntu-24.04-arm
+      artifact: ${{ github.sha }}-flatpak-tests-aarch64

.github/workflows/unit_tests_flatpak.yml

@@ -0,0 +1,67 @@
+name: Flatpak Unit Tests
+
+# Run the flatpak build's test asset inside the sandbox, once per arch. The
+# GNOME SDK's _GLIBCXX_ASSERTIONS gives a bounds-checked STL that catches
+# out-of-bounds reads no other test leg does.
+on:
+  workflow_call:
+    inputs:
+      os:
+        required: true
+        type: string
+      artifact:
+        description: Test asset uploaded by the flatpak build leg
+        required: true
+        type: string
+
+jobs:
+  unit_tests_flatpak:
+    name: Flatpak Unit Tests
+    runs-on: ${{ inputs.os }}
+    container:
+      image: ghcr.io/flathub-infra/flatpak-github-actions:gnome-50
+      options: --privileged
+    steps:
+      - name: Restore test asset
+        uses: actions/download-artifact@v8
+        with:
+          name: ${{ inputs.artifact }}
+      - name: Run unit tests (bounds-checked sandbox)
+        timeout-minutes: 20
+        shell: bash
+        run: |
+          tar -xf flatpak-test-asset.tar
+          # Recreate the stable module symlink so /run/build/OrcaSlicer resolves.
+          d=$(ls -d .flatpak-builder/build/OrcaSlicer-* | tail -1)
+          ln -sfn "$(basename "$d")" .flatpak-builder/build/OrcaSlicer
+          # The runtime + SDK + the llvm extension the app metadata references,
+          # which `flatpak build` mounts; best-effort, the image may have them.
+          flatpak remote-add --if-not-exists --user flathub https://flathub.org/repo/flathub.flatpakrepo
+          flatpak install --user -y --noninteractive flathub \
+            org.gnome.Platform//50 org.gnome.Sdk//50 org.freedesktop.Sdk.Extension.llvm21//25.08 || true
+          # `flatpak build` uses bwrap (no rofiles-fuse, which this container
+          # rejects); bind-mount the build tree so the baked TEST_DATA_DIR resolves.
+          flatpak build --die-with-parent --share=network \
+            --bind-mount=/run/build="$PWD/.flatpak-builder/build" \
+            flatpak_app \
+            bash -c 'cd /run/build/OrcaSlicer && scripts/run_unit_tests.sh build_flatpak/tests'
+      - name: Collect test results
+        if: always()
+        shell: bash
+        run: |
+          d=$(ls -d .flatpak-builder/build/OrcaSlicer-* 2>/dev/null | tail -1 || true)
+          [ -n "$d" ] && [ -f "$d/ctest_results.xml" ] && cp "$d/ctest_results.xml" ctest_results.xml || true
+      - name: Upload Test Results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: test-results-${{ inputs.artifact }}
+          path: ctest_results.xml
+          retention-days: 5
+          if-no-files-found: warn
+      - name: Delete Test Asset
+        if: success()
+        uses: geekyeggo/delete-artifact@v6
+        with:
+          name: ${{ inputs.artifact }}
+          failOnError: false

scripts/flatpak/com.orcaslicer.OrcaSlicer.yml

@@ -378,6 +378,17 @@ modules:
       - cmake --build build_flatpak --target generate_system_cache -j$FLATPAK_BUILDER_N_JOBS
       - ./scripts/build_preset_cache.sh -n -b build_flatpak /app/share/OrcaSlicer/profiles
 
+    # Built (not run) here via the action's run-tests, then shipped to a separate
+    # test job. Only the test sources compile; nothing installs to /app.
+    test-commands:
+      - cmake . -B build_flatpak -DBUILD_TESTS=ON
+      # A suite missing from this list fails the leg loudly, since ctest registers a
+      # <target>_NOT_BUILT test for it. (tests/all is a Ninja subdirectory target and
+      # this build uses the default Makefile generator, so it is not available here.)
+      - cmake --build build_flatpak -j"${FLATPAK_BUILDER_N_JOBS:-$(nproc)}" --target
+          libslic3r_tests fff_print_tests sla_print_tests libnest2d_tests slic3rutils_tests
+          filament_group_tests
+
     cleanup:
       - /include
 
@@ -414,6 +425,10 @@ modules:
       - type: dir
         path: ../../localization
         dest: localization
+      # For the post-build unit-test step (BUILD_TESTS=ON); not built by the app.
+      - type: dir
+        path: ../../tests
+        dest: tests
 
       - type: file
         path: ../../CMakeLists.txt
@@ -427,6 +442,9 @@ modules:
       - type: file
         path: ../build_preset_cache.sh
         dest: scripts
+      - type: file
+        path: ../run_unit_tests.sh
+        dest: scripts
 
       # AppData metainfo for GNOME Software & Co.
       - type: file

tests/slic3rutils/CMakeLists.txt

@@ -55,6 +55,18 @@ elseif (APPLE)
         COMMENT "Copying Python runtime for macOS plugin host API tests"
         VERBATIM
     )
+elseif (FLATPAK)
+    # Same <testdir>/python home as WIN32/APPLE; symlink since /app/libpython
+    # already ships in the flatpak (the test exe links libpython3.12.so from it).
+    add_custom_command(TARGET ${_TEST_NAME}_tests POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E rm -rf
+            "$<TARGET_FILE_DIR:${_TEST_NAME}_tests>/python"
+        COMMAND ${CMAKE_COMMAND} -E create_symlink
+            "${CMAKE_PREFIX_PATH}/libpython"
+            "$<TARGET_FILE_DIR:${_TEST_NAME}_tests>/python"
+        COMMENT "Linking Python runtime for flatpak plugin host API tests"
+        VERBATIM
+    )
 endif()
 
 orcaslicer_discover_tests(${_TEST_NAME}_tests)