Add experimental Remesh & Bake workflow and a shared 3D canvas

.claude/skills/repo-conventions/SKILL.md

@@ -31,7 +31,8 @@ Canonical conventions for the `UnityMeshLab` repository. This file overrides `_s
 Located under `.github/workflows/`:
 
 - `build-native.yml` — builds native plugin binaries (platform-specific).
-- `meta-check.yml` — verifies `.meta` file coverage.
+- `meta-check.yml` — *Unity Package Checks*: `.meta` file coverage, `package.json`, the CS0103 identifier heuristic, and the licence-free C# compile of `Editor/` + `Tests/` (`Tools~/compile_check.py`, .NET SDK against the NuGet Unity reference assemblies, both FBX define variants).
+- `sonar-static-analysis.yml` — *SonarQube*: the compile-check build analysed with `dotnet-sonarscanner` on the self-hosted server (Community edition): `main` into the project itself with the quality gate enforced, a PR into a per-run throwaway project whose issues `Tools~/sonar-pr-check.mjs` filters to the PR's changed lines (any new finding reds the check, except the advisory rules S3776/S3267/S3358/S1075, reported only; S125/S1104/S107/S1168 are off in the begin step with their reasons). `sonar-backlog-report.yml` is the manual read-only triage report; `Tools~/sonar-mcp.sh` the read-only MCP server. Needs the `SONAR_TOKEN` secret; skips with a notice without it. Runbook: `the Sonar runbook in SashaRX/Space (docs/sonar-autofix.md; here the tools live in Tools~/ and the config in ~/.config/meshlab/)`.
 - `version-bump.yml` — automates `package.json` version bumps.
 - `test.yml` — EditMode test run on Unity 6000.0. License-gated: skips cleanly when no `UNITY_LICENSE`/`UNITY_SERIAL` secrets are configured. **This repository is on Unity Personal (free) tier**, and Unity disabled manual `.alf`→`.ulf` activation for Personal seats in 2024, so the test job is currently always **skipped** on GitHub-hosted runners. Local Test Runner remains the canonical pre-commit verification path. See `unity-ci-validation/SKILL.md` §License activation for the recipe and the path forward (self-hosted runner or Plus/Pro upgrade).
 - `release.yml` — tag-triggered GitHub Release; verifies `v<version>` tag matches `package.json` and extracts the matching section from `CHANGELOG.md`.

.github/workflows/build-native.yml

@@ -44,11 +44,14 @@ jobs:
           persist-credentials: false
 
       - name: Configure CMake
-        run: cmake -S 'Native~' -B build ${{ matrix.cmake_args }} -DCMAKE_BUILD_TYPE=Release
+        run: cmake -S 'Native~' -B build ${{ matrix.cmake_args }} -DCMAKE_BUILD_TYPE=Release -DMESHLAB_BUILD_TESTS=ON
 
       - name: Build
         run: cmake --build build --config Release
 
+      - name: Test remesh bridge
+        run: ctest --test-dir build -C Release --output-on-failure
+
       - name: Upload artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:

.github/workflows/meta-check.yml

@@ -24,6 +24,9 @@ on:
       - 'Tools~/**'
       - '*.md'
       - 'package.json'
+  # Manual re-run on any branch (a GITHUB_TOKEN push by a workflow starts no
+  # pull_request run of its own, so a bot commit needs this to get its checks).
+  workflow_dispatch:
 
 jobs:
   meta-files:
@@ -55,10 +58,18 @@ jobs:
               EXIT=1
             fi
           done
-          # Check all tracked files in Editor/, Plugins/, Shaders/ that need .meta.
-          # Native~/ and Documentation~/ are hidden from Unity by the ~ suffix
-          # and do NOT need .meta files.
-          for f in $(find Editor Plugins Shaders -type f \
+          # Any other tracked file at the package root is imported too (a stray
+          # screenshot once shipped this way); dotfiles are the only exception.
+          for f in $(git ls-files | grep -v '/' | grep -v '\.meta$' | grep -v '^\.'); do
+            if [ ! -f "${f}.meta" ]; then
+              echo "::error::Missing .meta file for package-root file: ${f}"
+              EXIT=1
+            fi
+          done
+          # Check all tracked files in Editor/, Plugins/, Shaders/, Tests/ that
+          # need .meta. Native~/, Documentation~/ and Tools~/ are hidden from
+          # Unity by the ~ suffix and do NOT need .meta files.
+          for f in $(find Editor Plugins Shaders Tests -type f \
             ! -name '*.meta' \
             ! -name '.gitkeep' \
             ! -name '.DS_Store' \
@@ -69,7 +80,7 @@ jobs:
             fi
           done
           # Check for orphaned .meta files (no matching file/dir)
-          for m in $(find Editor Plugins Shaders -name '*.meta' 2>/dev/null); do
+          for m in $(find Editor Plugins Shaders Tests -name '*.meta' 2>/dev/null); do
             target="${m%.meta}"
             if [ ! -e "$target" ]; then
               echo "::warning::Orphaned .meta file (no matching file/dir): ${m}"
@@ -136,3 +147,30 @@ jobs:
 
       - name: Check for identifiers used but never declared
         run: python3 'Tools~/check_undeclared_identifiers.py' Editor Tests
+
+  csharp-compile:
+    name: Compile C# against Unity reference assemblies
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '8.0.x'
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('Tools~/compile_check.py') }}
+
+      # The whole package type-checks here with the .NET SDK — no Unity licence —
+      # against the UnityEngine/UnityEditor reference assemblies from NuGet, once
+      # without and once with LIGHTMAP_UV_TOOL_FBX_EXPORTER. This is what the
+      # identifier heuristic above approximates; a real CS error of any kind fails
+      # the job with a file/line annotation. The four 2021-era API gaps the
+      # references have are bridged on copied sources (see the script header).
+      - name: Build Editor and Tests (both FBX define variants)
+        run: python3 'Tools~/compile_check.py'

.github/workflows/sonar-backlog-report.yml

@@ -0,0 +1,47 @@
+# Sonar Backlog Report — a READ-ONLY snapshot of the main project on the self-hosted
+# SonarQube: every open issue grouped by rule, the security hotspots still to review,
+# and how many issues are already Accepted / False positive. It is the triage input
+# for deciding, rule by rule, fix / exclude in configuration / Accept / False positive.
+# Nothing on the server or in the repo is changed: the job only reads the web API
+# (Tools~/sonar-pr-check.mjs report) and uploads report.md + the full JSON lists.
+# Modelled on SashaRX/Space's sonar-backlog-report.yml; the Sonar runbook in SashaRX/Space (docs/sonar-autofix.md; here the tools live in Tools~/ and the config in ~/.config/meshlab/)
+# is the runbook.
+
+name: Sonar Backlog Report
+
+# Manual dispatch only: the job holds the Sonar user token, so it runs when someone with
+# write access starts it, never because a branch was pushed.
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL || vars.SONAR_HOST_URL || 'http://178.104.156.174:9000' }}
+  SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY || 'SashaRX_UnityMeshLab' }}
+
+jobs:
+  report:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Read the open issues and hotspots
+        env:
+          # Web API reads need a USER token — see Tools~/sonar-pr-check.mjs.
+          SONAR_TOKEN: ${{ secrets.SONAR_API_TOKEN || secrets.SONAR_TOKEN }}
+        run: |
+          node Tools~/sonar-pr-check.mjs report --project "$SONAR_PROJECT_KEY" \
+            --out-dir "$RUNNER_TEMP/sonar-backlog-report"
+
+      - name: Upload the report
+        uses: actions/upload-artifact@v4
+        with:
+          name: sonar-backlog-report
+          path: ${{ runner.temp }}/sonar-backlog-report
+          retention-days: 14