fix(cli): validate Git signing format in developer doctor

scripts/dev-setup.sh

@@ -173,14 +173,24 @@ check_git_configuration() {
   fi
 
   sign_enabled="$(git_config commit.gpgsign)"
-  sign_format="$(git_config gpg.format)"
-  signing_key="$(git_config user.signingkey)"
-  if [ "${sign_enabled}" = "true" ] && [ -n "${signing_key}" ]; then
-    pass "Git commit signing configured (${sign_format:-openpgp})"
-  else
-    fail "Git commit signing is incomplete" \
-      "Configure user.signingkey and set commit.gpgsign=true before committing."
+  if ! sign_format="$(git -C "${REPO_ROOT}" config --get gpg.format 2>/dev/null)"; then
+    sign_format="openpgp"
   fi
+  signing_key="$(git_config user.signingkey)"
+  case "${sign_format}" in
+    openpgp | ssh | x509)
+      if [ "${sign_enabled}" = "true" ] && [ -n "${signing_key}" ]; then
+        pass "Git commit signing configured (${sign_format})"
+      else
+        fail "Git commit signing is incomplete" \
+          "Configure user.signingkey and set commit.gpgsign=true before committing."
+      fi
+      ;;
+    *)
+      fail "Git commit signing format is unsupported (${sign_format:-empty})" \
+        "Set gpg.format to openpgp, ssh, or x509, or run: git config --unset gpg.format"
+      ;;
+  esac
 
   hooks_path="$(git_config core.hooksPath)"
   if [ -n "${hooks_path}" ]; then

test/dev-setup-doctor.test.ts

@@ -93,7 +93,10 @@ fi`,
     if [ "\${FAKE_GIT_SIGNING_MISSING:-}" = "1" ]; then exit 1; fi
     echo "true"
     ;;
-  *" config --get gpg.format "*) echo "ssh" ;;
+  *" config --get gpg.format "*)
+    if [ "\${FAKE_GIT_SIGN_FORMAT_UNSET:-}" = "1" ]; then exit 1; fi
+    echo "\${FAKE_GIT_SIGN_FORMAT-ssh}"
+    ;;
   *" config --get user.signingkey "*)
     if [ "\${FAKE_GIT_SIGNING_MISSING:-}" = "1" ]; then exit 1; fi
     echo "test-signing-key"
@@ -254,6 +257,48 @@ describe("contributor environment doctor", () => {
     expect(result.output).toContain("Git pre-push hook is missing");
   });
 
+  it("rejects an unsupported git signing format with a precise remediation", () => {
+    const fixture = createFixture();
+
+    const result = runDoctor(fixture, { FAKE_GIT_SIGN_FORMAT: "bogus" });
+
+    expect(result.status).toBe(1);
+    expect(result.output).not.toContain("Git commit signing configured");
+    expect(result.output).toContain("Git commit signing format is unsupported (bogus)");
+    expect(result.output).toContain(
+      "Next: Set gpg.format to openpgp, ssh, or x509, or run: git config --unset gpg.format",
+    );
+  });
+
+  it("accepts an unset git signing format and reports the openpgp default", () => {
+    const fixture = createFixture();
+
+    const result = runDoctor(fixture, { FAKE_GIT_SIGN_FORMAT_UNSET: "1" });
+
+    expect(result.status).toBe(0);
+    expect(result.output).toContain("Git commit signing configured (openpgp)");
+  });
+
+  it("rejects an explicitly empty git signing format", () => {
+    const fixture = createFixture();
+
+    const result = runDoctor(fixture, { FAKE_GIT_SIGN_FORMAT: "" });
+
+    expect(result.status).toBe(1);
+    expect(result.output).not.toContain("Git commit signing configured");
+    expect(result.output).not.toContain("Ready to create a feature branch.");
+    expect(result.output).toContain("Git commit signing format is unsupported (empty)");
+  });
+
+  it.each(["openpgp", "x509"])("accepts the %s git signing format", (format) => {
+    const fixture = createFixture();
+
+    const result = runDoctor(fixture, { FAKE_GIT_SIGN_FORMAT: format });
+
+    expect(result.status).toBe(0);
+    expect(result.output).toContain(`Git commit signing configured (${format})`);
+  });
+
   it("reports missing commands, dependencies, artifacts, and contributor identity", () => {
     const fixture = createFixture();
     fs.rmSync(path.join(fixture.fakeBin, "hadolint"));