test(source-control): disable commit signing in prune_babysit_worktrees fixtures

[kyle-sexton]

Fixes #2358

Summary

• Set commit.gpgsign false repo-locally in make_repo so fixture setup does not attempt GPG signing on machines with global commit.gpgsign=true.
• Matches the pattern already used in worktree-create-gate.test.sh and scripts/test-git-helpers.sh.

Test plan

• python3 -m unittest tests.test_prune_babysit_worktrees (45/0)

Related

• fix(source-control): make the worktree-create gate's failures legible and its opt-out honest #2309 — same class of defect fixed in shell suites
• fix(tests): stop git_init from persisting identity into real repos #2333 — shared test-git-helpers.sh contract this mirrors

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 33s —— View job

---

Security review

• Gather context (PR diff, file contents)
• Analyze changes for security issues
• Report findings

Scope: Single file, test-fixture only — plugins/source-control/skills/babysit-prs/scripts/tests/test_prune_babysit_worktrees.py (+4/-1).

Change: Adds git -C <tmp> config commit.gpgsign false inside make_repo(), scoped to a throwaway repository created under tempfile for this test module, so fixture setup doesn't fail on machines with commit.gpgsign=true set globally.

Findings: none.

• The git config call is repo-local (-C <tmp>, no --global/--system), applied only to an ephemeral test repo created in a temp directory and torn down at test end — it never touches the developer's real repo or global git config.
• No secrets, tokens, credentials, or CI/workflow files are involved.
• No injection surface: all git args are static string literals, no user/external input is interpolated.
• No authorization or access-control logic is touched — this is purely test scaffolding.
• Matches the existing pattern used in worktree-create-gate.test.sh and scripts/test-git-helpers.sh, as noted in the PR description.

No security issues found in this PR.

[claude]

Claude finished @kyle-sexton's task in 1m 20s —— View job

---

Claude's review

• Gather context (diff, CLAUDE.md/REVIEW.md, related test file)
• Understand the request (code review)
• Review changed file for correctness, coverage, maintainability
• Post findings

Summary

This is a minimal, well-scoped test-fixture fix. make_repo (the one and only fixture-repo constructor in this module — used transitively by make_bare_hub and every test that calls make_repo/add_worktree) now sets commit.gpgsign false repo-locally before the initial --allow-empty commit, so a global commit.gpgsign=true (with no key for the fixture identity t@t) no longer breaks fixture setup.

Correctness: the git config commit.gpgsign false call is placed after user.email/user.name and before the commit call (test_prune_babysit_worktrees.py#L52-L58), so it takes effect before the commit that would otherwise attempt signing. Correct.

Consistency: this matches the identical repo-local pattern already established elsewhere in the repo — plugins/source-control/hooks/worktree-create-gate.test.sh:40, scripts/test-git-helpers.sh:51, plugins/source-control/scripts/worktree-create.test.sh:87, and several others found via a repo-wide grep for gpgsign. No inconsistency or missed spot.

Scope: repo-local only (not global), so it can't mask a real signing regression on the writing machine — consistent with the comment in babysit_merge.py:324 that explicitly warns against commit.gpgsign=false in production remedies. This change is confined to test fixtures, so no conflict there.

Test coverage / error handling: no new test coverage needed — this is a fixture-setup fix, not new behavior, and the existing 45 tests all route through this fixed make_repo.

No correctness, design, or maintainability issues found. No security-lane concerns apply (test-only change, no external input, no secrets). Left one inline comment (discussion) confirming the fix's scope and precedent — not a blocking finding.

Note on verification: I was not able to execute the test suite myself in this sandbox (no command-execution approval), so I did not independently confirm the "45/0" result in the PR's Test plan — that figure is author-claimed and unverified by me. The static review above (diff correctness + pattern consistency across the repo) is independently verified.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.