ci: add NetworkManager integration test harness

.github/workflows/ci.yml

@@ -60,7 +60,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-clippy-
 
-      - run: cargo clippy --all-targets --all-features -- -D warnings
+      - run: cargo clippy --locked --all-targets --all-features -- -D warnings
 
   test:
     name: Unit Tests
@@ -87,11 +87,37 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-test-
 
+      - name: Build release artifact
+        run: cargo build --locked --release --package nmrs
+
       - name: Run unit tests
-        run: cargo test --lib --all-features --workspace
+        run: cargo test --locked --lib --all-features --workspace
 
       - name: Run doc tests
-        run: cargo test --doc --all-features --workspace
+        run: cargo test --locked --doc --all-features --workspace
+
+  integration:
+    name: NetworkManager WiFi Integration
+    runs-on: [self-hosted, linux, x64]
+    # Pull requests wait for a maintainer to approve this environment.
+    environment:
+      name: ${{ github.event_name == 'pull_request' && 'self-hosted-pr-integration' || 'self-hosted-integration' }}
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Load virtual WiFi radios
+        run: |
+          sudo -n modprobe -r mac80211_hwsim || true
+          sudo -n modprobe mac80211_hwsim radios=2
+          udevadm settle --timeout=10
+
+      - name: Run integration tests with NetworkManager and virtual WiFi
+        run: docker compose run --build --rm test-wifi-integration
+
+      - name: Unload virtual WiFi radios
+        if: always()
+        run: sudo -n modprobe -r mac80211_hwsim || true
 
   semver:
     name: Semantic Versioning Check
@@ -118,16 +144,8 @@ jobs:
         run: cargo semver-checks check-release -p nmrs
 
   build:
-    name: Build (${{ matrix.target }})
+    name: Build (aarch64-unknown-linux-gnu)
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - target: x86_64-unknown-linux-gnu
-            packages: nmrs
-          - target: aarch64-unknown-linux-gnu
-            packages: nmrs
     steps:
       - uses: actions/checkout@v7
 
@@ -139,29 +157,24 @@ jobs:
             libdbus-1-dev
 
       - name: Install cross-compilation tools
-        if: matrix.target == 'aarch64-unknown-linux-gnu'
         run: sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
 
       - uses: dtolnay/rust-toolchain@stable
         with:
-          targets: ${{ matrix.target }}
+          targets: aarch64-unknown-linux-gnu
 
       - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             target
-          key: ${{ runner.os }}-build-${{ matrix.target }}-${{ hashFiles('**/Cargo.lock') }}
+          key: ${{ runner.os }}-build-aarch64-unknown-linux-gnu-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: |
-            ${{ runner.os }}-build-${{ matrix.target }}-
+            ${{ runner.os }}-build-aarch64-unknown-linux-gnu-
 
-      - name: Build ${{ matrix.packages }}
-        run: |
-          for package in ${{ matrix.packages }}; do
-            echo "Building $package for ${{ matrix.target }}"
-            cargo build --release --target ${{ matrix.target }} --package $package
-          done
+      - name: Build nmrs
+        run: cargo build --locked --release --target aarch64-unknown-linux-gnu --package nmrs
         env:
           CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
           PKG_CONFIG_ALLOW_CROSS: 1

.gitignore

@@ -10,4 +10,3 @@ vendor/
 /pkg/
 /src/
 *.pkg.tar.zst
-Cargo.lock

AGENTS.md

@@ -37,6 +37,7 @@ cargo test -p nmrs --lib --all-features                   # unit tests only
 cargo test --doc --all-features --workspace               # doc tests
 cargo test --all-features --workspace                     # unit + integration (needs NM + wifi hardware)
 cargo test --test integration_test --all-features         # integration only
+docker compose run --build --rm test-wifi-integration     # CI-equivalent virtual WiFi tests (Linux)
 ```
 
 Integration tests require wifi hardware or `mac80211_hwsim`:
@@ -81,4 +82,3 @@ Sections: `Added`, `Changed`, `Fixed`. Link PRs/issues in parentheses.
 ## Things to watch out for
 
 - The `VpnCredentials` type is deprecated — prefer `WireGuardConfig` for new WireGuard code.
-

CONTRIBUTING.md

@@ -25,9 +25,12 @@ docker build -t nmrs-lib .
 **To run tests:**
 
 ```bash
-docker compose run test
+docker compose run --rm test
 ```
 
+This starts an isolated system D-Bus and NetworkManager instance, waits for it
+to be ready, and requires integration tests to connect to it.
+
 **To run an interactive shell:**
 
 ```bash
@@ -97,6 +100,14 @@ cargo test --test integration_test --all-features
 sudo modprobe -r mac80211_hwsim
 ```
 
+For the same virtual-radio setup used in CI, on a Linux host with Docker:
+
+```bash
+sudo modprobe mac80211_hwsim radios=2
+docker compose run --build --rm test-wifi-integration
+sudo modprobe -r mac80211_hwsim
+```
+
 > [!NOTE]
 >
 > This method only works on linux