feat(git): add support for SSH-based commit signing

[sisp]

Changes

I've added support for SSH-based commit signing.

Context

Closes #18197.

The implementation includes a workaround for a quirk in ssh-keygen which requires the public SSH key to exist for signing even when the private key is provided directly, which is technically not necessary (see #18197 (comment)).

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[sisp]

I'm not sure what to do about the type error. 🤔 Any advice?

[rarkins]

Try refactoring the existing part first (separate PR, to be merged first). This is our preferred approach to such changes regardless of any type challenges

[sisp]

I think the problem is caused by @types/jest-when: DefinitelyTyped/DefinitelyTyped#68605 (comment)

[viceice]

I would prefer to not use jest when and stick to current test dependencies

[sisp]

Okay, I noticed that jest-mock-extended also has a calledWith() extension, so I'll try to modify the tests to use it instead.

[sisp]

I've refactored the tests to use jest-mock-extended instead of jest-when. Rewriting the tests also revealed a bug which I've fixed, too. If the CI checks pass, I think this PR is ready for a proper review.

[sisp]

@viceice I've updated this PR to include the factored out preparatory work from #29875 and addressed your review feedback. WDYT?

[sisp]

Thanks for the thorough and valuable feedback, @viceice! 🙇 I've addressed your remarks. WDYT? 🙂

[viceice]

Please don't force-push. Just merge main if required, should only be required on conflicts

[sisp]

I didn't force-push to rebase onto the latest state of main but only amended and force-pushed the most recent commit before your subsequent review because it caused the CI pipeline to fail. But if you prefer, I can push new commits for such iterations between reviews.

[viceice]

yes, please just push new changes. we squash merge PRs, so don't worry about git history

[sisp]

I've merged main into here and fixed the temporary directory path like in 1f0ce9a. WDYT, @viceice?

[github-actions]

Hi there,

You are using done comments which cause a lot of noise/notifications. Instead, please use GitHub's web interface to request another review. Please read our contributing guidelines to reduce noise.

Good luck,

The Renovate team

[renovate-release]

🎉 This issue has been resolved in version 38.46.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)
• 38.46.0

Your semantic-release bot 📦🚀

[candrews]

I believe this change is causing Renovate to not work with opengpg commit signing.

I'm seeing this error using Renovate 38.46.0:

         "message": "error: invalid value for 'gpg.format': 'opengpg'\nfatal: bad config variable 'gpg.format' in file '.git/config' at line 24\n",
         "stack": "Error: error: invalid value for 'gpg.format': 'opengpg'\nfatal: bad config variable 'gpg.format' in file '.git/config' at line 24\n\n    at Object.action (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/src/lib/plugins/error-detection.plugin.ts:42:29)\n    at PluginStore.exec (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/src/lib/plugins/plugin-store.ts:54:29)\n    at /usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:124:42\n    at new Promise (<anonymous>)\n    at GitExecutorChain.handleTaskData (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:121:14)\n    at GitExecutorChain.<anonymous> (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/src/lib/runners/git-executor-chain.ts:97:40)\n    at Generator.next (<anonymous>)\n    at fulfilled (/usr/local/renovate/node_modules/.pnpm/[email protected]/node_modules/simple-git/dist/cjs/index.js:52:24)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"

My configuration is just setting gitPrivateKey to the gpg private key string.

[philippe-granet]

Hi @sisp , I try to use your feature, but I can't make it work, see #30999
Can you help us understand what's the problem?

[sisp]

It's a bug indeed. 🙇 See #30999 (reply in thread) and #31005.