modules/homebrew: add onActivation.cleanup "check" mode

Closes #1032

Add `"check"` to the `onActivation.cleanup` enum. When set, nix-darwin runs
`brew bundle cleanup` during system checks to detect Homebrew packages that
are installed but not present in the generated Brewfile. If extra packages
are found, activation fails with a list of them and remediation steps.

Unlike `"uninstall"` and `"zap"`, the `"check"` mode never removes packages
-- it only reports. This runs during both `darwin-rebuild check` and
`darwin-rebuild switch`, matching the behavior of all other system checks.
This commit is contained in:
Malo Bourgon 2026-02-10 01:46:53 -08:00
parent ca6f8609c3
commit c68f5d1387
No known key found for this signature in database
4 changed files with 66 additions and 9 deletions

View file

@ -128,5 +128,8 @@ in
echo "checking that shell integration is absent by default" >&2
(! grep 'brew shellenv' ${config.out}/etc/zshrc)
echo "checking that cleanup check is absent by default" >&2
(! grep 'brew bundle cleanup --file=' ${config.out}/activate)
'';
}