Testing & Quality Checks

Run these commands from the repository root with the Rust toolchain installed.

Host Checks

# Check formatting and run strict Clippy across all features
cargo lint

# Run default-feature unit and integration tests
cargo test

# Include the optional qBittorrent integration tests
cargo test --all-features

Host tests use pure logic, mocks, and isolated local responders. Tests that modify real NetworkManager profiles or firewall rules are ignored on the host.

Disposable System Sandbox

Requires Podman or Docker. The Cargo tasks start NetworkManager and firewalld in a disposable container with its own network namespace. Network and firewall changes stay inside that sandbox.

# Host tests across all features, then containerized system tests
cargo test-all

# Containerized system tests only
cargo test-system

# Select a system tier or rebuild the sandbox image
cargo test-system -- --nm
cargo test-system -- --firewall
cargo test-system -- --rebuild

# Firewall leak regression checks
cargo test-leaks

# Interactive sandbox for investigation
cargo xtask container-shell

Never run cargo test -- --ignored directly on the host or set NEUTRON_TEST_SANDBOX=1 there. The sandbox sets that marker for tests guarded by require_sandbox().

Coverage and Limits

• NetworkManager tests check profile import, policy properties, and real WireGuard activation, including idle on-demand tunnels.
• Firewall tests check rule acceptance, legacy-rule migration, surgical teardown, and established IPv4/IPv6 packet egress. The leak_* checks are also included in the firewall tier.
• The ignored library test interrupted_rebuild_stays_closed_after_reload_and_recovers exercises partial permanent rebuilds and recovery. It runs in the full system suite; --firewall selects only tests/system_firewall.rs.
• The default sandbox uses firewalld’s iptables backend. Its entrypoint also accepts NEUTRON_TEST_FIREWALL_BACKEND=nftables inside the container for cross-backend checks.
• Container reload checks do not establish persistence across an actual reboot.

Build the Documentation

cargo docs
cargo xtask docs --serve

mdBook writes the site to public/. See Implementation Notes for the behavior these tests protect.