feat: auto-generate CI jobs from flake checks

Add `checks` option and `config.autoChecks` to auto-generate a CI job
for each flake check derivation. Auto-generated jobs go through
`mkJobPatched` for proper Nix setup, cache, and environment handling.

The `checks` option is automatically wired to `config.checks` in
flake-parts. System is inferred from `pkgs.system` and set via the new
`system` option. User-defined jobs with the same name always take
precedence.

New tests cover both flake-parts and direct API entry points.

MT-14138

lib/impl/modules/pipeline.nix

@@ -24,6 +24,9 @@
     name,
     config,
     rootConfig,
+    rootChecks ? {},
+    rootAutoChecks ? {},
+    system,
     ...
   }: let
     #
@@ -211,10 +214,31 @@
       // gitlabOptions;
     config = let
       attrsToKeep = builtins.attrNames gitlabOptions;
+      autoNixConfig = {
+        enable = config.nix.nixJobsByDefault;
+        enableRunnerCache = false;
+      };
+      autoJobs = lib.optionalAttrs (rootAutoChecks.enable && name == rootAutoChecks.pipeline) (
+        builtins.mapAttrs (checkName: _:
+          cilib.mkJobPatched {
+            key = "auto:${checkName}";
+            pipelineName = name;
+            nixConfig = autoNixConfig;
+            job = {
+              image = "$NIX_CI_IMAGE";
+              stage = rootAutoChecks.stage;
+              script = ["nix build .#checks.\"${system}\".${checkName}"];
+            } // lib.optionalAttrs (rootAutoChecks.tags != []) {tags = rootAutoChecks.tags;};
+          }
+        ) (
+          builtins.removeAttrs rootChecks (builtins.attrNames config.jobs)
+        )
+      );
     in {
       finalConfig =
         (filterUnset (filterAttrs (n: _v: builtins.elem n attrsToKeep) config))
-        // mapAttrs (_name: value: value.finalConfig) config.jobs;
+        // mapAttrs (_name: value: value.finalConfig) config.jobs
+        // autoJobs;
       packages =
         {
           "gitlab-ci:pipeline:${name}" = toYaml "gitlab-ci-config.json" config.finalConfig;

lib/impl/modules/root.nix

@@ -6,6 +6,41 @@
 }: let
   inherit (lib) mkOption types foldr;
 in rec {
+  autoChecksSubmodule = {
+    options = {
+      enable = mkOption {
+        description = ''
+          Auto-generate CI jobs from [`checks`](#checks).
+
+          Each check becomes a job that runs `nix build .#checks.<system>.<name>`.
+        '';
+        type = types.bool;
+        default = false;
+      };
+      stage = mkOption {
+        description = ''
+          Stage to assign to auto-generated check jobs.
+        '';
+        type = types.str;
+        default = "test";
+      };
+      tags = mkOption {
+        description = ''
+          Tags to assign to auto-generated check jobs.
+        '';
+        type = types.listOf types.str;
+        default = [];
+      };
+      pipeline = mkOption {
+        description = ''
+          Name of the pipeline to add auto-generated check jobs to.
+        '';
+        type = types.str;
+        default = "default";
+      };
+    };
+  };
+
   configSubmodule = {
     options = {
       soonix = mkOption {
@@ -24,11 +59,40 @@ in rec {
         type = types.bool;
         default = true;
       };
+      autoChecks = mkOption {
+        description = ''
+          Auto-generate CI jobs from flake checks.
+
+          See [`config.autoChecks`](#configautochecks) for configuration options.
+        '';
+        type = types.submodule autoChecksSubmodule;
+        default = {};
+      };
     };
   };
 
-  nixCiSubmodule = {config, ...}: {
+  nixCiSubmodule = {config, ...}: let
+    system = config.system;
+  in {
     options = {
+      system = mkOption {
+        description = ''
+          System identifier (e.g. `"x86_64-linux"`).
+          Used when building checks with `nix build .#checks.<system>.<name>`.
+          Set automatically by `flakeModule` or `cilib.mkCI`.
+        '';
+        type = types.str;
+      };
+      checks = mkOption {
+        description = ''
+          Nix flake checks to optionally auto-generate CI jobs from.
+
+          Each attribute must be a derivation. The attribute name becomes the CI job name.
+          Requires [`config.autoChecks.enable`](#configautochecksenable) to take effect.
+        '';
+        type = types.attrsOf types.package;
+        default = {};
+      };
       config = mkOption {
         description = ''
           Configuration of Nix-GitLab-CI itself.
@@ -42,7 +106,12 @@ in rec {
         '';
         type = types.attrsOf (types.submoduleWith {
           modules = [pipelineSubmodule];
-          specialArgs.rootConfig = config.config;
+          specialArgs = {
+            rootConfig = config.config;
+            rootChecks = config.checks;
+            rootAutoChecks = config.config.autoChecks;
+            inherit system;
+          };
         });
         default = {};
       };