From 26e824544223024b5e0ddea08c79657846b4319a Mon Sep 17 00:00:00 2001
From: "devsy-app[bot]" <277138668+devsy-app[bot]@users.noreply.github.com>
Date: Mon, 17 Aug 2026 10:47:26 +0000
Subject: [PATCH] test: cover gitsshsigning resolveKeyFile

Add tests for GitSSHSignatureRequest.resolveKeyFile covering the public-key temp-file creation, content verification, cleanup-on-close, and the empty-public-key fallback to KeyPath.

The existing tests only covered Sign() failure paths; resolveKeyFile had no coverage of its temp-file lifecycle or the no-op cleanup branch.
---
 pkg/gitsshsigning/server_test.go | 53 ++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/pkg/gitsshsigning/server_test.go b/pkg/gitsshsigning/server_test.go
index 39993db32..143e3ab16 100644
--- a/pkg/gitsshsigning/server_test.go
+++ b/pkg/gitsshsigning/server_test.go
@@ -1,6 +1,9 @@
 package gitsshsigning
 
 import (
+	"io"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -29,3 +32,53 @@ func TestSign_NonExistentKeyPath_ReturnsError(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "failed to sign commit")
 }
+
+func TestResolveKeyFile_PublicKey_CreatesAndCleansTempFile(t *testing.T) {
+	publicKey := "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakeKey test@example.com"
+	req := &GitSSHSignatureRequest{
+		PublicKey: publicKey,
+		KeyPath:   "/nonexistent/original/key",
+	}
+
+	resolved, cleanup, err := req.resolveKeyFile()
+	require.NoError(t, err)
+	defer cleanup()
+
+	require.NotEqual(t, req.KeyPath, resolved)
+	require.FileExists(t, resolved)
+
+	f, err := os.Open(resolved) //nolint:gosec // test-controlled temp file path
+	require.NoError(t, err)
+	defer func() { _ = f.Close() }()
+	got, err := io.ReadAll(f)
+	require.NoError(t, err)
+	assert.Equal(t, publicKey, string(got))
+}
+
+func TestResolveKeyFile_PublicKey_CleanupRemovesTempFile(t *testing.T) {
+	req := &GitSSHSignatureRequest{
+		PublicKey: "ssh-ed25519 AAAAC3 test@example.com",
+	}
+
+	resolved, cleanup, err := req.resolveKeyFile()
+	require.NoError(t, err)
+	require.FileExists(t, resolved)
+
+	cleanup()
+
+	_, statErr := os.Stat(resolved)
+	assert.True(t, os.IsNotExist(statErr), "temp file should be removed after cleanup")
+}
+
+func TestResolveKeyFile_EmptyPublicKey_ReturnsKeyPath(t *testing.T) {
+	keyPath := filepath.Join(t.TempDir(), "signing-key")
+	require.NoError(t, os.WriteFile(keyPath, []byte("key"), 0o600))
+
+	req := &GitSSHSignatureRequest{KeyPath: keyPath}
+	resolved, cleanup, err := req.resolveKeyFile()
+
+	require.NoError(t, err)
+	assert.Equal(t, keyPath, resolved)
+	cleanup()
+	assert.FileExists(t, keyPath, "original key file must not be removed by cleanup")
+}