fix(nix): the test checks inherited doCheck=false and ran zero tests (#77)

commonArgs sets doCheck=false (correct for package builds); crane's
cargoNextest/cargoTest default it to true only when unset, so nextest and
lambda-tests have been compiling nothing and testing nothing since #53 —
green, silent, and invisible because nix prints derivation logs only on
failure. Locally the lane now runs 699 tests (699 passed).

__darwinAllowLocalNetworking on both checks: the darwin sandbox denies
even loopback binds, and the abcdn handler tests serve mock HTTP on
127.0.0.1; linux sandboxes allow loopback in their private netns.

ci/nix-checks.sh now asserts a green test check's log shows a nonzero
test count, so this class of no-op can never be green again.

Author: eordano

ci/nix-checks.sh

@@ -19,3 +19,20 @@ printf '  %s\n' "${attrs[@]}"
 
 nix build --keep-going --no-link --log-format raw "${attrs[@]}" \
   || nix build --keep-going --no-link --print-build-logs "${attrs[@]}"
+
+# A test check that executed zero tests is a silent no-op (doCheck=false
+# reached the derivation once and nobody noticed for weeks) — make that
+# state red forever: the built check's log must show a nonzero test count.
+assert_ran_tests() {
+  local attr="$1" pattern="$2"
+  grep -qE "$pattern" <(nix log "$attr") \
+    || { echo "$attr built green but ran no tests ($pattern not in its log)" >&2; exit 1; }
+}
+while IFS= read -r name; do
+  case "$name" in
+    nextest) assert_ran_tests ".#checks.${system}.${name}" \
+      'Summary \[.*\] +[1-9][0-9]* tests run' ;;
+    lambda-tests) assert_ran_tests ".#checks.${system}.${name}" \
+      'test result: ok\. [1-9]' ;;
+  esac
+done <<<"$names"

nix/checks.nix

@@ -26,12 +26,16 @@ let
 
   archDependent = {
     nextest = craneLib.cargoNextest (withArtifacts // {
+      doCheck = true;
+      __darwinAllowLocalNetworking = true;
       cargoExtraArgs = "--locked";
       cargoNextestExtraArgs = "--workspace";
       preCheck = abgenRoot;
     });
 
     lambda-tests = craneLib.cargoTest (withArtifacts // {
+      doCheck = true;
+      __darwinAllowLocalNetworking = true;
       pname = "abgen-lambda-tests";
       cargoExtraArgs = "--locked";
       cargoTestExtraArgs = "-p abgen-lambda -p abgen-native --tests";