ci: add HM activation tests

Add a Linux nixosTest for Home Manager activation and a macOS CI workflow to run the activation script.

Wire the new Linux check into flake checks and Garnix.

Tests: not run (CI wiring).

.github/workflows/hm-activation-macos.yml

@@ -0,0 +1,27 @@
+name: HM Activation (macOS)
+
+on:
+  pull_request:
+  push:
+    branches: [ main ]
+  workflow_run:
+    workflows: [ "Yolo Update Pins" ]
+    types: [ completed ]
+
+jobs:
+  hm-activation-macos:
+    if: ${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main') }}
+    runs-on: macos-14
+    env:
+      TARGET_SHA: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ env.TARGET_SHA }}
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v13
+
+      - name: Run HM activation
+        run: scripts/hm-activation-macos.sh

flake.nix

@@ -55,6 +55,10 @@
           config-options = pkgs.callPackage ./nix/checks/openclaw-config-options.nix {
             sourceInfo = sourceInfoStable;
           };
+          hm-activation = import ./nix/checks/openclaw-hm-activation.nix {
+            inherit pkgs home-manager;
+            lib = pkgs.lib;
+          };
         } else {});
 
         devShells.default = pkgs.mkShell {

garnix.yaml

@@ -11,3 +11,4 @@ builds:
     - "checks.x86_64-linux.gateway"
     - "checks.x86_64-linux.gateway-tests"
     - "checks.x86_64-linux.config-options"
+    - "checks.x86_64-linux.hm-activation"

nix/checks/openclaw-hm-activation.nix

@@ -0,0 +1,50 @@
+{ lib, pkgs, home-manager }:
+
+let
+  openclawModule = ../modules/home-manager/openclaw.nix;
+  testScript = builtins.readFile ../tests/hm-activation.py;
+
+in
+lib.nixosTest {
+  name = "openclaw-hm-activation";
+
+  nodes.machine = { ... }:
+    {
+      imports = [ home-manager.nixosModules.home-manager ];
+
+      networking.firewall.allowedTCPPorts = [ 18999 ];
+
+      users.users.alice = {
+        isNormalUser = true;
+        home = "/home/alice";
+        extraGroups = [ "wheel" ];
+      };
+
+      home-manager = {
+        useGlobalPkgs = true;
+        useUserPackages = true;
+        users.alice = { ... }:
+          {
+            imports = [ openclawModule ];
+
+            home = {
+              username = "alice";
+              homeDirectory = "/home/alice";
+              stateVersion = "23.11";
+            };
+
+            programs.openclaw = {
+              enable = true;
+              installApp = false;
+              launchd.enable = false;
+              instances.default = {
+                gatewayPort = 18999;
+                config = {};
+              };
+            };
+          };
+      };
+    };
+
+  testScript = testScript;
+}

nix/tests/hm-activation-macos/flake.nix

@@ -0,0 +1,42 @@
+{
+  description = "nix-openclaw macOS Home Manager activation test";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    home-manager.url = "github:nix-community/home-manager";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    nix-openclaw.url = "github:openclaw/nix-openclaw";
+  };
+
+  outputs = { nixpkgs, home-manager, nix-openclaw, ... }:
+    let
+      system = "aarch64-darwin";
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ nix-openclaw.overlays.default ];
+      };
+    in {
+      homeConfigurations.hm-test = home-manager.lib.homeManagerConfiguration {
+        inherit pkgs;
+        modules = [
+          nix-openclaw.homeManagerModules.openclaw
+          ({ ... }: {
+            home = {
+              username = "runner";
+              homeDirectory = "/tmp/hm-activation-home";
+              stateVersion = "23.11";
+            };
+
+            programs.openclaw = {
+              enable = true;
+              installApp = false;
+              instances.default = {
+                gatewayPort = 18999;
+                config = {};
+              };
+            };
+          })
+        ];
+      };
+    };
+}

nix/tests/hm-activation.py

@@ -0,0 +1,16 @@
+start_all()
+
+machine.wait_for_unit("home-manager-alice.service")
+
+uid = machine.succeed("id -u alice").strip()
+machine.succeed("loginctl enable-linger alice")
+machine.succeed(f"systemctl start user@{uid}.service")
+machine.wait_for_unit(f"user@{uid}.service")
+
+machine.succeed("su - alice -c 'systemctl --user daemon-reload'")
+machine.succeed("su - alice -c 'systemctl --user start openclaw-gateway.service'")
+machine.wait_for_unit("openclaw-gateway.service", user="alice")
+
+machine.wait_for_open_port(18999)
+
+machine.succeed("test -f /home/alice/.openclaw/openclaw.json")

scripts/hm-activation-macos.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+test_dir="$repo_root/nix/tests/hm-activation-macos"
+home_dir="/tmp/hm-activation-home"
+
+rm -rf "$home_dir"
+mkdir -p "$home_dir"
+
+export HOME="$home_dir"
+export USER="${USER:-runner}"
+export LOGNAME="$USER"
+
+cd "$test_dir"
+
+nix build --accept-flake-config --impure \
+  --override-input nix-openclaw "path:$repo_root" \
+  .#homeConfigurations.hm-test.activationPackage
+
+./result/activate
+
+test -f "$HOME/.openclaw/openclaw.json"
+
+if command -v launchctl >/dev/null 2>&1; then
+  launchctl print "gui/$UID/com.steipete.openclaw.gateway" >/dev/null 2>&1
+fi