Tests for this are surprisingly non-trivial:
- This flake demonstrates its utility best in a situation where you run
nixos-rebuild test - NixOS tests make it pretty hard to run
nixos-rebuild(build or test) - you have to download 22GB of build deps, and then the rebuild takes ages anyway.
So, instead of the straightforward way, the tests follow this pattern:
- Define a bootable, working VM with attributes that exercise the check
- Boot the VM and run the check, expecting it to succeed
- Alter the VM such that the attribute is no longer safe (in the case of filesystems, delete the block device)
- Re-run the check, expecting it to fail.