Changes graph commits to honor VS Code's commit signing setting

Adds an explicit `-S` to the commit operation when the host-level
signing override (`git.enableCommitSigning`) is enabled, matching the
built-in Source Control commit behavior — previously only the repo's
`commit.gpgsign` Git config was respected. Fires the `onSigned` hook on
explicitly-signed commits (parity with the patch provider) and threads
a `graph` telemetry source through the commit RPC.

Author: ianhattendorf

CHANGELOG.md

@@ -25,6 +25,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p
   - Format string examples are rendered by the real formatter, so the preview always matches what GitLens displays
   - Adds _Cloud Integrations_ and _AI_ categories — view and connect hosting and issue service integrations, and manage the AI provider and model, GitKraken MCP, default coding agent, and Claude Code hooks
   - Shows connection-aware cues in the category rail — a connected/total count for _Cloud Integrations_ and a rule count for _Autolinks_
+- Changes commits created from the _Commit Graph_'s working changes (WIP) commit box to honor VS Code's `git.enableCommitSigning` setting — matching the built-in Source Control commit behavior; previously only the repo's `commit.gpgsign` Git config was respected
 
 ### Fixed
 

packages/git-cli/src/providers/__tests__/integration/helpers.ts

@@ -10,7 +10,7 @@ import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, statSync, wr
 import { readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type { FileSystemProvider, GitServiceContext, GitServiceHooks } from '@gitlens/git/context.js';
+import type { FileSystemProvider, GitServiceConfig, GitServiceContext, GitServiceHooks } from '@gitlens/git/context.js';
 import { Logger } from '@gitlens/utils/logger.js';
 import { toFsPath } from '@gitlens/utils/uri.js';
 import { CliGitProvider } from '../../../cliGitProvider.js';
@@ -61,10 +61,11 @@ function ensureLogger() {
 	});
 }
 
-function createMinimalContext(hooks?: GitServiceHooks): GitServiceContext {
+function createMinimalContext(hooks?: GitServiceHooks, config?: GitServiceConfig): GitServiceContext {
 	return {
 		fs: createNodeFs(),
 		hooks: hooks,
+		config: config,
 	};
 }
 
@@ -99,7 +100,11 @@ function createNodeFs(): FileSystemProvider {
  *
  * Call `cleanup()` in your `teardown()` / `suiteTeardown()`.
  */
-export function createTestRepo(options?: { hooks?: GitServiceHooks; gitOptions?: GitOptions }): TestRepo {
+export function createTestRepo(options?: {
+	hooks?: GitServiceHooks;
+	gitOptions?: GitOptions;
+	config?: GitServiceConfig;
+}): TestRepo {
 	ensureLogger();
 
 	const dir = mkdtempSync(join(tmpdir(), 'gitlens-test-'));
@@ -123,7 +128,7 @@ export function createTestRepo(options?: { hooks?: GitServiceHooks; gitOptions?:
 		env: { ...process.env, GIT_COMMITTER_DATE: '2024-01-01T00:00:00Z', GIT_AUTHOR_DATE: '2024-01-01T00:00:00Z' },
 	});
 
-	const context = createMinimalContext(options?.hooks);
+	const context = createMinimalContext(options?.hooks, options?.config);
 	const provider = new CliGitProvider({
 		context: context,
 		locator: getGitLocation,

packages/git-cli/src/providers/__tests__/integration/operations.test.ts

@@ -254,6 +254,80 @@ suite('OperationsGitSubProvider signing', () => {
 			r.cleanup();
 		}
 	});
+
+	test('host signing override adds -S even when commit.gpgsign is false', async () => {
+		const failedCalls: Array<{ reason: SigningErrorReason; format: SigningFormat }> = [];
+		const signedCalls: unknown[] = [];
+		const r = createTestRepo({
+			config: { commits: {}, signing: { enabled: true } },
+			hooks: {
+				commits: {
+					onSigned: (...args) => signedCalls.push(args),
+					onSigningFailed: (reason, format) => failedCalls.push({ reason: reason, format: format }),
+				},
+			},
+		});
+		try {
+			// The helper leaves `commit.gpgsign=false` — without an explicit `-S` from the host
+			// override, git would never invoke the (broken) gpg program and the commit would
+			// succeed. A SigningError here is the proof that `-S` was passed.
+			execFileSync('git', ['config', 'gpg.format', 'openpgp'], { cwd: r.path, stdio: 'pipe' });
+			execFileSync('git', ['config', 'gpg.program', 'node --eval process.exit(1)'], {
+				cwd: r.path,
+				stdio: 'pipe',
+			});
+
+			writeFileSync(join(r.path, 'override.txt'), 'content\n');
+			execFileSync('git', ['add', 'override.txt'], { cwd: r.path, stdio: 'pipe' });
+
+			await assert.rejects(
+				() => r.provider.ops.commit(r.path, 'should attempt to sign via override'),
+				ex => SigningError.is(ex),
+				'Expected a SigningError — the override should force `-S` despite commit.gpgsign=false',
+			);
+
+			assert.strictEqual(failedCalls.length, 1, 'Expected onSigningFailed hook to fire exactly once');
+			assert.strictEqual(failedCalls[0].format, 'openpgp');
+			assert.strictEqual(signedCalls.length, 0, 'onSigned must not fire when signing fails');
+		} finally {
+			r.cleanup();
+		}
+	});
+
+	test('without the host override, broken signer config does not affect commits', async () => {
+		const calls: unknown[] = [];
+		const r = createTestRepo({
+			config: { commits: {}, signing: { enabled: false } },
+			hooks: {
+				commits: {
+					onSigned: (...args) => calls.push(args),
+					onSigningFailed: (...args) => calls.push(args),
+				},
+			},
+		});
+		try {
+			// Same broken gpg program as above, but no override and `commit.gpgsign=false` —
+			// the commit must go through without ever invoking the signer.
+			execFileSync('git', ['config', 'gpg.program', 'node --eval process.exit(1)'], {
+				cwd: r.path,
+				stdio: 'pipe',
+			});
+
+			writeFileSync(join(r.path, 'plain.txt'), 'content\n');
+			execFileSync('git', ['add', 'plain.txt'], { cwd: r.path, stdio: 'pipe' });
+
+			await r.provider.ops.commit(r.path, 'unsigned commit');
+
+			const log = execFileSync('git', ['log', '-1', '--format=%s'], {
+				cwd: r.path,
+				encoding: 'utf-8',
+			}).trim();
+			assert.strictEqual(log, 'unsigned commit');
+			assert.strictEqual(calls.length, 0, 'No signing hooks should fire for an unsigned commit');
+		} finally {
+			r.cleanup();
+		}
+	});
 });
 
 suite('OperationsGitSubProvider.push', () => {

packages/git-cli/src/providers/operations.ts

@@ -183,6 +183,13 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 		if (options?.date) {
 			params.push(`--date=${options.date}`);
 		}
+		// Host-level override (e.g. VS Code's `git.enableCommitSigning`) — request signing explicitly
+		// via `-S`. Implicit repo-config signing (`commit.gpgsign=true`) needs no flag, and `-S`
+		// alongside it is harmless, so the override can only enable signing, never force it off.
+		const sign = this.context.config?.signing?.enabled === true;
+		if (sign) {
+			params.push('-S');
+		}
 		// Read commit message from stdin via -F - to avoid shell escaping issues
 		params.push('-F', '-');
 
@@ -193,6 +200,15 @@ export class OperationsGitSubProvider implements GitOperationsSubProvider {
 			);
 			this.context.hooks?.cache?.onReset?.(repoPath, 'branches', 'status');
 			this.context.hooks?.repository?.onChanged?.(repoPath, ['head', 'heads', 'index']);
+			if (sign) {
+				// `-S` was passed and the commit succeeded, so signing is confirmed — fire the
+				// explicit-sign hook (same contract as the patch provider's `commit-tree -S` path).
+				let format: SigningFormat | undefined;
+				try {
+					format = (await this.provider.config.getSigningConfig?.(repoPath))?.format;
+				} catch {}
+				this.context.hooks?.commits?.onSigned?.(format ?? 'gpg', options?.source);
+			}
 		} catch (ex) {
 			scope?.error(ex);
 			await this.throwIfSigningError(repoPath, params, ex, options?.source);

packages/git/src/context.ts

@@ -137,9 +137,10 @@ export interface GitServiceHooks {
 		/**
 		 * Called when a commit is signed successfully.
 		 *
-		 * Note: currently fired only from explicit-sign paths in the patch provider
-		 * (where signing is requested via `-S` and confirmed up front). Operations
-		 * that sign implicitly via `commit.gpgsign=true` (`commit`, `merge`, `pull`,
+		 * Note: currently fired only from explicit-sign paths — the patch provider's
+		 * `commit-tree -S` and the commit operation when the host signing override
+		 * (`config.signing.enabled`) adds `-S`. Operations that sign implicitly via
+		 * `commit.gpgsign=true` (`commit` without the override, `merge`, `pull`,
 		 * `rebase`, `revert`, `cherryPick`) do not fire this hook because the
 		 * library cannot cheaply confirm that signing actually occurred without an
 		 * extra `git config`/`log --show-signature` call.

src/webviews/rpc/services/repository.ts

@@ -25,6 +25,7 @@ import { normalizePath } from '@gitlens/utils/path.js';
 import { getSettledValue } from '@gitlens/utils/promise.js';
 import { pluralize } from '@gitlens/utils/string.js';
 import type { DiffWithCommandArgs } from '../../../commands/diffWith.js';
+import type { Source } from '../../../constants.telemetry.js';
 import type { Container } from '../../../container.js';
 import { ProviderNotSupportedError } from '../../../errors.js';
 import type { FeatureAccess, PlusFeatures } from '../../../features.js';
@@ -835,7 +836,9 @@ export class RepositoryService {
 		options?: { all?: boolean; amend?: boolean },
 	): Promise<CommitResult> {
 		try {
-			await this.container.git.getRepositoryService(repoPath).ops?.commit(message, options);
+			await this.container.git
+				.getRepositoryService(repoPath)
+				.ops?.commit(message, { ...options, source: { source: 'graph' } satisfies Source });
 			return { status: 'committed' };
 		} catch (ex) {
 			const failure = classifyCommitFailure(ex);