git: warn on signing format default change

The default value for programs.git.signing.format changed in 25.05
from an implicit "openpgp" to null. Keep the existing gated
mkOptionDefault behavior so the signing block only materializes when
other signing settings are in use, but route the versioned value and
static docs text through the shared state-version helper.

Add a focused current-state-version test that covers a non-empty
signing configuration with no explicit format, alongside the existing
legacy implicit-openpgp and explicit-format tests.

Signed-off-by: Austin Horstman <khaneliman12@gmail.com>

modules/programs/git.nix

@@ -17,6 +17,19 @@ let
     ;
 
   cfg = config.programs.git;
+
+  signingFormatStateVersionDefault = lib.hm.deprecations.mkStateVersionOptionDefault {
+    inherit (config.home) stateVersion;
+    since = "25.05";
+    optionPath = [
+      "programs"
+      "git"
+      "signing"
+      "format"
+    ];
+    legacy.value = "openpgp";
+    current.value = null;
+  };
 in
 {
   meta.maintainers = with lib.maintainers; [
@@ -69,10 +82,7 @@ in
                 "x509"
               ]
             );
-            defaultText = literalExpression ''
-              "openpgp" for state version < 25.05,
-              undefined for state version ≥ 25.05
-            '';
+            inherit (signingFormatStateVersionDefault) defaultText;
             description = ''
               The signing method to use when signing commits and tags.
               Valid values are `openpgp` (OpenPGP/GnuPG), `ssh` (SSH), and `x509` (X.509 certificates).
@@ -429,11 +439,7 @@ in
       (mkIf (cfg.signing != { }) {
         programs.git = {
           signing = {
-            format =
-              if (lib.versionOlder config.home.stateVersion "25.05") then
-                (mkOptionDefault "openpgp")
-              else
-                (mkOptionDefault null);
+            format = mkOptionDefault signingFormatStateVersionDefault.default;
             signer =
               let
                 defaultSigners = {

tests/modules/programs/git/default.nix

@@ -5,6 +5,7 @@
   git-with-signing-key-id-legacy = ./git-with-signing-key-id-legacy.nix;
   git-with-signing-key-id = ./git-with-signing-key-id.nix;
   git-without-signing-key-id = ./git-without-signing-key-id.nix;
+  git-without-signing-key-id-current = ./git-without-signing-key-id-current.nix;
   git-without-signing = ./git-without-signing.nix;
   git-with-hooks = ./git-with-hooks.nix;
   git-with-lfs = ./git-with-lfs.nix;

tests/modules/programs/git/git-without-signing-key-id-current-expected.conf

@@ -0,0 +1,9 @@
+[commit]
+	gpgSign = true
+
+[tag]
+	gpgSign = true
+
+[user]
+	email = "user@example.org"
+	name = "John Doe"

tests/modules/programs/git/git-without-signing-key-id-current.nix

@@ -0,0 +1,24 @@
+{
+  home.stateVersion = "25.05";
+
+  programs.git = {
+    enable = true;
+    settings = {
+      user = {
+        name = "John Doe";
+        email = "user@example.org";
+      };
+    };
+
+    signing = {
+      signer = "path-to-gpg";
+      key = null;
+      signByDefault = true;
+    };
+  };
+
+  nmt.script = ''
+    assertFileExists home-files/.config/git/config
+    assertFileContent home-files/.config/git/config ${./git-without-signing-key-id-current-expected.conf}
+  '';
+}