fix(ssh): skip file path signing keys in GPG agent forwarding

[skevetter]

• When user.signingKey is a file path (starts with / or ~) and gpg.format is not explicitly ssh or x509, skip GPG agent forwarding — the key is an SSH key, not a GPG hex fingerprint
• Handles the case where users set an SSH key path in user.signingKey without setting gpg.format = ssh
• Preserves x509 certificate path behavior (gpgsm legitimately uses file paths)

Closes #731

Summary by CodeRabbit

• Bug Fixes

  • Improved GPG/SSH signing key validation to detect filesystem paths (both absolute and tilde-prefixed) and skip them in specific scenarios.
  • Enhanced signing key processing to return empty values instead of passing through potentially invalid configuration entries.

• Tests

  • Added test coverage validating behavior for absolute and tilde-prefixed paths in signing key configuration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0436dcfe-47c9-43c3-9b3f-ce1a8468d59b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/731-ssh-key-path-detection

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}