[firewall] build the nftables backend in CI

Nothing in CI configured -DOTBR_NFTABLES=ON, so the libnftnl/libmnl
backend was never compiled there. Only the FirewallManager policy layer
and its tests were covered, because those targets are built
unconditionally; nftables_impl.cpp was not.

Add a check job that builds with the backend enabled and runs the test
suite, so the netlink code is compiled and the firewall tests run in the
configuration they describe. script/bootstrap already installs
libnftnl/libmnl, so no bootstrap change is needed.

Assisted-By: Claude Opus 4.8

Author: LorbusChris

.github/workflows/build.yml

@@ -98,6 +98,32 @@ jobs:
     - name: Codecov
       uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
 
+  nftables-check:
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        build_type: ["Debug", "Release"]
+    env:
+      BUILD_TARGET: check
+      OTBR_BUILD_TYPE: ${{ matrix.build_type }}
+      OTBR_MDNS: openthread
+      OTBR_OPTIONS: "-DOTBR_NFTABLES=ON -DOT_FIREWALL=OFF -DBUILD_TESTING=ON"
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        submodules: recursive
+    - name: Bootstrap
+      run: tests/scripts/bootstrap.sh
+    # Build only: this compiles nftables_impl.cpp, which no other job does.
+    - name: Build
+      run: script/test build
+    # The firewall unit tests mock the backend, so they need no privileges. The
+    # rest of the suite launches otbr-agent, which cannot install nftables rules
+    # without CAP_NET_ADMIN and a usable nf_tables, so it is not run here.
+    - name: Firewall unit tests
+      run: CTEST_OUTPUT_ON_FAILURE=1 ctest --test-dir build/otbr -R Firewall
+
   script-check:
     runs-on: ubuntu-22.04
     env:

tests/scripts/bootstrap.sh

@@ -63,7 +63,9 @@ install_common_dependencies()
         coreutils \
         git \
         libprotobuf-dev \
-        protobuf-compiler
+        protobuf-compiler \
+        libnftnl-dev \
+        libmnl-dev
 }
 
 install_openthread_binraries()