From ae9682039386227235e0a645232c89a4db52b22c Mon Sep 17 00:00:00 2001
From: Snider <snider@host.uk.com>
Date: Thu, 29 Jan 2026 02:59:11 +0000
Subject: [PATCH] test(signing): add integration tests

Tests for skip conditions and disabled configs.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 pkg/build/signing/signing_test.go | 130 ++++++++++++++++++++++++++++++
 1 file changed, 130 insertions(+)
 create mode 100644 pkg/build/signing/signing_test.go

diff --git a/pkg/build/signing/signing_test.go b/pkg/build/signing/signing_test.go
new file mode 100644
index 0000000..52a5561
--- /dev/null
+++ b/pkg/build/signing/signing_test.go
@@ -0,0 +1,130 @@
+package signing
+
+import (
+	"context"
+	"runtime"
+	"testing"
+)
+
+func TestSignBinaries_Good_SkipsNonDarwin(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: true,
+		MacOS: MacOSConfig{
+			Identity: "Developer ID Application: Test",
+		},
+	}
+
+	// Create fake artifact for linux
+	artifacts := []Artifact{
+		{Path: "/tmp/test-binary", OS: "linux", Arch: "amd64"},
+	}
+
+	// Should not error even though binary doesn't exist (skips non-darwin)
+	err := SignBinaries(ctx, cfg, artifacts)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestSignBinaries_Good_DisabledConfig(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: false,
+	}
+
+	artifacts := []Artifact{
+		{Path: "/tmp/test-binary", OS: "darwin", Arch: "arm64"},
+	}
+
+	err := SignBinaries(ctx, cfg, artifacts)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestSignBinaries_Good_SkipsOnNonMacOS(t *testing.T) {
+	if runtime.GOOS == "darwin" {
+		t.Skip("Skipping on macOS - this tests non-macOS behavior")
+	}
+
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: true,
+		MacOS: MacOSConfig{
+			Identity: "Developer ID Application: Test",
+		},
+	}
+
+	artifacts := []Artifact{
+		{Path: "/tmp/test-binary", OS: "darwin", Arch: "arm64"},
+	}
+
+	err := SignBinaries(ctx, cfg, artifacts)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestNotarizeBinaries_Good_DisabledConfig(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: false,
+	}
+
+	artifacts := []Artifact{
+		{Path: "/tmp/test-binary", OS: "darwin", Arch: "arm64"},
+	}
+
+	err := NotarizeBinaries(ctx, cfg, artifacts)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestNotarizeBinaries_Good_NotarizeDisabled(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: true,
+		MacOS: MacOSConfig{
+			Notarize: false,
+		},
+	}
+
+	artifacts := []Artifact{
+		{Path: "/tmp/test-binary", OS: "darwin", Arch: "arm64"},
+	}
+
+	err := NotarizeBinaries(ctx, cfg, artifacts)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestSignChecksums_Good_SkipsNoKey(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: true,
+		GPG: GPGConfig{
+			Key: "", // No key configured
+		},
+	}
+
+	// Should silently skip when no key
+	err := SignChecksums(ctx, cfg, "/tmp/CHECKSUMS.txt")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}
+
+func TestSignChecksums_Good_Disabled(t *testing.T) {
+	ctx := context.Background()
+	cfg := SignConfig{
+		Enabled: false,
+	}
+
+	err := SignChecksums(ctx, cfg, "/tmp/CHECKSUMS.txt")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+}