Use native candidate actions and harden frontend resource loading

scripts/build.sh

@@ -55,6 +55,15 @@ fetch_commit https://git.oeo.one/justme/libmonet.git "$work/libmonet" "$monet_co
 [ -z "${FETCH_ONLY:-}" ] || { echo ">> sources are in place"; exit 0; }
 
 echo ">> overlaying m3ui"
+echo ">> applying icon cache hardening"
+cache_patch="$root/patches/fcitx5-icon-cache.patch"
+if git -C "$srcdir" apply --check "$cache_patch"; then
+    git -C "$srcdir" apply "$cache_patch"
+elif git -C "$srcdir" apply --reverse --check "$cache_patch"; then
+    echo ">> icon cache hardening already applied"
+else
+    die "icon cache patch does not match Fcitx5 $version; refusing a partial build"
+fi
 rm -rf "$srcdir/src/ui/m3ui"
 cp -r "$root/src" "$srcdir/src/ui/m3ui"
 if ! grep -q 'add_subdirectory(m3ui)' "$srcdir/src/ui/CMakeLists.txt"; then

scripts/test.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Run the regression tests against an already built, patched Fcitx5 tree.
+set -euo pipefail
+ulimit -c 0
+root=$(cd "$(dirname "$0")/.." && pwd)
+work=${WORK_DIR:-$root/build}
+version=${FCITX_VERSION:-$(pkg-config --modversion Fcitx5Core)}
+srcdir=${FCITX_SOURCE_DIR:-$work/fcitx5-$version}
+builddir=${FCITX_BUILD_DIR:-$work/cmake}
+out=$(mktemp -d "${TMPDIR:-/tmp}/m3ui-tests-XXXXXX")
+trap 'rm -f "$out/testm3uicandidatemenu" "$out/testiconthemecache" "$out/testm3uiresourceguard" "$out/testm3uiimageloader"; rmdir "$out"' EXIT
+
+flags=(-std=c++20 -Wall -Wextra -I"$srcdir/src/lib" -I"$builddir/src/lib")
+libs=(-L"$builddir/bin" -Wl,-rpath,"$builddir/bin" -lFcitx5Core -lFcitx5Config -lFcitx5Utils)
+for name in testm3uicandidatemenu testiconthemecache testm3uiresourceguard; do
+    "${CXX:-c++}" "${flags[@]}" "$root/tests/$name.cpp" "${libs[@]}" -o "$out/$name"
+done
+read -r -a image_flags <<< "$(pkg-config --cflags --libs cairo gdk-pixbuf-2.0 librsvg-2.0)"
+"${CXX:-c++}" "${flags[@]}" "$root/tests/testm3uiimageloader.cpp" \
+    "$root/src/imageloader.cpp" "${image_flags[@]}" "${libs[@]}" -o "$out/testm3uiimageloader"
+for name in testm3uicandidatemenu testiconthemecache testm3uiresourceguard testm3uiimageloader; do
+    echo ">> $name"
+    timeout 15 "$out/$name"
+done