Adds a commit signing indicator to the graph commit box

Surfaces the repo's signing status in the Commit Graph's working
changes (WIP) commit box — a key icon appears when commits will be
signed (repo `commit.gpgsign` or VS Code's `git.enableCommitSigning`),
with the signing format (GPG, SSH, X.509, or OpenPGP) shown on hover.

Delivers the status via the WIP payload (cached `getSigningConfig` read
during assembly) and keeps it fresh on `.git/config` edits (watcher) and
`git.enableCommitSigning` setting changes.

Author: ianhattendorf

CHANGELOG.md

@@ -10,6 +10,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
 
 - Adds ConfigCat-based feature flag service for A/B testing and experimentation support ([#5092](https://github.com/gitkraken/vscode-gitlens/issues/5092))
 - Adds an optional `avatar` URL template to custom remotes in the `gitlens.remotes` setting — enables corporate and self-hosted setups to resolve commit-author avatars via a templated URL with `${email}`, `${emailName}`, `${domain}`, and `${size}` tokens; identity values are component-encoded before interpolation to keep attacker-controllable commit emails from injecting URL-structural characters, and templates configured via workspace settings require explicit user approval on first use in a trusted workspace (revocable via _GitLens: Reset > Approved Avatar URL Templates..._) ([#302](https://github.com/gitkraken/vscode-gitlens/issues/302), [#5155](https://github.com/gitkraken/vscode-gitlens/pull/5155)) — thanks to [PR #1636](https://github.com/gitkraken/vscode-gitlens/pull/1636) by Tmk ([@tmkx](https://github.com/tmkx))
+- Adds a commit signing indicator to the _Commit Graph_'s working changes (WIP) commit box — a key icon appears when commits will be signed (via the repo's `commit.gpgsign` Git config or VS Code's `git.enableCommitSigning` setting), with the signing format (GPG, SSH, X.509, or OpenPGP) shown on hover
 
 ### Changed
 

src/webviews/apps/plus/graph/components/gl-commit-box.css.ts

@@ -29,6 +29,22 @@ export const commitBoxStyles = css`
 		justify-content: space-between;
 	}
 
+	.options-group {
+		display: flex;
+		align-items: center;
+		gap: 0.4rem;
+	}
+
+	.signing-indicator {
+		display: inline-flex;
+		color: var(--vscode-descriptionForeground);
+	}
+
+	.signing-indicator:focus-visible {
+		outline: 0.1rem solid var(--vscode-focusBorder);
+		outline-offset: 0.2rem;
+	}
+
 	.compose-icon {
 		color: var(--gl-agent-working-color);
 	}

src/webviews/apps/plus/graph/components/gl-commit-box.ts

@@ -1,6 +1,7 @@
 import { html, LitElement, nothing } from 'lit';
 import { customElement, property } from 'lit/decorators.js';
 import { isMac } from '@env/platform.js';
+import type { WipSigning } from '../../../../plus/graph/detailsProtocol.js';
 import { elementBase, scrollableBase } from '../../../shared/components/styles/lit/base.css.js';
 import { commitBoxStyles } from './gl-commit-box.css.js';
 import '../../../shared/components/button.js';
@@ -55,21 +56,40 @@ export class GlCommitBox extends LitElement {
 	@property()
 	commitError?: string;
 
+	@property({ type: Object })
+	signing?: WipSigning;
+
 	override render() {
 		return html`
 			<div class="options">
 				${this.renderAmendToggle()}
-				${this.aiEnabled
-					? html`<gl-button appearance="secondary" @click=${this.onCompose}>
-							<code-icon class="compose-icon" icon="wand" slot="prefix"></code-icon>
-							Compose
-						</gl-button>`
-					: nothing}
+				<div class="options-group">
+					${this.renderSigningIndicator()}
+					${this.aiEnabled
+						? html`<gl-button appearance="secondary" @click=${this.onCompose}>
+								<code-icon class="compose-icon" icon="wand" slot="prefix"></code-icon>
+								Compose
+							</gl-button>`
+						: nothing}
+				</div>
 			</div>
 			${this.renderTextarea()} ${this.renderActionBar()}
 		`;
 	}
 
+	private renderSigningIndicator() {
+		if (!this.signing?.enabled) return nothing;
+
+		const label = `Commits will be signed using ${getSigningFormatLabel(this.signing.format)}`;
+		return html`
+			<gl-tooltip content=${label} placement="bottom">
+				<span class="signing-indicator" tabindex="0" role="img" aria-label=${label}>
+					<code-icon icon="key"></code-icon>
+				</span>
+			</gl-tooltip>
+		`;
+	}
+
 	private renderAmendToggle() {
 		return html`
 			<gl-checkbox
@@ -227,6 +247,19 @@ export class GlCommitBox extends LitElement {
 	}
 }
 
+function getSigningFormatLabel(format: WipSigning['format']): string {
+	switch (format) {
+		case 'ssh':
+			return 'SSH';
+		case 'x509':
+			return 'X.509';
+		case 'openpgp':
+			return 'OpenPGP';
+		default:
+			return 'GPG';
+	}
+}
+
 declare global {
 	interface HTMLElementTagNameMap {
 		'gl-commit-box': GlCommitBox;

src/webviews/apps/plus/graph/components/gl-graph-details-panel.ts

@@ -1907,6 +1907,7 @@ export class GlGraphDetailsPanel extends SignalWatcher(LitElement) {
 										.disabledReason=${this._actions.canCommitReason()}
 										.aiEnabled=${this._state.preferences.get()?.aiEnabled ?? false}
 										.commitError=${this._state.commitError.get()}
+										.signing=${wip.signing}
 										@message-change=${this.handleCommitMessageChange}
 										@amend-change=${this.handleAmendChange}
 										@commit=${this.handleCommit}

src/webviews/commitDetails/protocol.ts

@@ -6,6 +6,7 @@ import type { GitPausedOperationStatus } from '@gitlens/git/models/pausedOperati
 import type { PullRequestShape } from '@gitlens/git/models/pullRequest.js';
 import type { GitBranchReference } from '@gitlens/git/models/reference.js';
 import type { GitCommitSearchContext } from '@gitlens/git/models/search.js';
+import type { SigningFormat } from '@gitlens/git/models/signature.js';
 import type { CurrentUserNameStyle } from '@gitlens/git/utils/commit.utils.js';
 import type { DateTimeFormat } from '@gitlens/utils/date.js';
 import type { Config, DateStyle } from '../../config.js';
@@ -112,6 +113,13 @@ export interface WipStats {
 	context?: string;
 }
 
+/** Repo-level commit-signing status for the WIP commit box — see {@link Wip.signing}. */
+export interface WipSigning {
+	/** Whether commits will be signed (repo `commit.gpgsign` or the host's `git.enableCommitSigning` override). */
+	enabled: boolean;
+	format: SigningFormat;
+}
+
 export interface Wip {
 	changes: WipChange | undefined;
 	repositoryCount: number;
@@ -133,6 +141,12 @@ export interface Wip {
 	 * rely on it in practice (guard with `?.` for the shared-type contract).
 	 */
 	stats?: WipStats;
+	/**
+	 * Commit-signing status for this wip's repo — drives the "will be signed" indicator in the
+	 * Graph's commit box. Optional for the same reason as {@link Wip.stats}: only the Graph's
+	 * `getWipForRepoAndStats` populates it.
+	 */
+	signing?: WipSigning;
 }
 
 export interface DraftState {

src/webviews/plus/graph/detailsProtocol.ts

@@ -17,6 +17,7 @@ export type {
 	Preferences,
 	State,
 	Wip,
+	WipSigning,
 	WipStats,
 	WorkingFileSorting,
 } from '../../commitDetails/protocol.js';

src/webviews/plus/graph/graphWebview.ts

@@ -3953,6 +3953,14 @@ export class GraphWebviewProvider implements WebviewProvider<State, State, Graph
 	}
 
 	private onWorkspaceConfigurationChanged(e: ConfigurationChangeEvent) {
+		// The host signing override feeds `wip.signing` (the commit box's "will be signed"
+		// indicator) via `getSigningConfig`, which reads the setting through a live getter — a
+		// WIP re-push is enough to refresh it. Secondary-worktree panels refresh on their next
+		// watcher tick instead; acceptable for a rare settings change.
+		if (e.affectsConfiguration('git.enableCommitSigning')) {
+			void this.notifyDidChangeWorkingTree();
+		}
+
 		if (!e.affectsConfiguration('git.autofetch') && !e.affectsConfiguration('git.autofetchPeriod')) return;
 
 		void this.notifyDidChangeConfiguration();
@@ -4076,11 +4084,13 @@ export class GraphWebviewProvider implements WebviewProvider<State, State, Graph
 		// Lightweight WIP refresh — covers staging/unstaging (`index` → stats), `.gitignore` edits
 		// (`ignores` → which untracked files appear in `git status`), secondary-worktree add/remove
 		// (`worktrees` → wipMetadataBySha; also falls through to the structural gate below as a
-		// backstop full-state push), and tracking changes (`head|heads|remotes` → wip.branch.upstream,
-		// which drives the "Publish" ↔ "Create PR" next-step row in the details panel). Unioned so the
-		// in-flight coalescer can't double-fire on a single multi-flag event (e.g. Pull's
+		// backstop full-state push), tracking changes (`head|heads|remotes` → wip.branch.upstream,
+		// which drives the "Publish" ↔ "Create PR" next-step row in the details panel), and
+		// `.git/config` edits (`config` → wip.signing; the watcher currently always pairs `config`
+		// with `remotes`, but don't rely on that classifier detail). Unioned so the in-flight
+		// coalescer can't double-fire on a single multi-flag event (e.g. Pull's
 		// `head, heads, remotes, index`).
-		if (e.changed('head', 'heads', 'index', 'ignores', 'remotes', 'worktrees')) {
+		if (e.changed('head', 'heads', 'index', 'ignores', 'remotes', 'worktrees', 'config')) {
 			void this.notifyDidChangeWorkingTree();
 		}
 
@@ -5040,7 +5050,7 @@ export class GraphWebviewProvider implements WebviewProvider<State, State, Graph
 					// `head`/`heads`/`remotes`) so the secondary panel stays reactive to those same
 					// changes.
 					watcher.onDidChange(e => {
-						if (!e.changed('index', 'ignores', 'pausedOp', 'head', 'heads', 'remotes')) return;
+						if (!e.changed('index', 'ignores', 'pausedOp', 'head', 'heads', 'remotes', 'config')) return;
 
 						this._wipStatusCache.invalidate(path);
 						this.queueWipRefetch(sha, repo);
@@ -7908,18 +7918,21 @@ export class GraphWebviewProvider implements WebviewProvider<State, State, Graph
 					(_cacheable, factorySignal) => svc.status.getStatus(undefined, factorySignal),
 					{ cancellation: signal },
 				);
-		const [statusResult, pausedOpStatusResult] = await Promise.allSettled([
+		const [statusResult, pausedOpStatusResult, signingConfigResult] = await Promise.allSettled([
 			statusFetch,
 			// `force` so a missed `'pausedOp'` FS-watcher tick (common on secondary worktrees
 			// whose `GlRepository` is closed) can't leave the WIP row stuck on a stale indicator.
 			svc.pausedOps?.getPausedOperationStatus?.({ force: true }, signal),
+			// Cached config read — drives the "will be signed" indicator in the commit box.
+			svc.config.getSigningConfig?.(),
 		]);
 		const status = getSettledValue(statusResult);
 		if (status == null) return undefined;
 
 		signal?.throwIfAborted();
 
 		const pausedOpStatus = getSettledValue(pausedOpStatusResult);
+		const signingConfig = getSettledValue(signingConfigResult);
 
 		const conflictMarkerCounts = new Map<string, number>();
 		if (status.hasConflicts) {
@@ -8034,6 +8047,10 @@ export class GraphWebviewProvider implements WebviewProvider<State, State, Graph
 							: undefined,
 				},
 				stats: stats,
+				signing:
+					signingConfig != null
+						? { enabled: signingConfig.enabled, format: signingConfig.format }
+						: undefined,
 			},
 		};
 	}