feat: add auto secure boot to new kernel update

tests/test_package_manager_secure_boot.py

@@ -0,0 +1,55 @@
+import sys
+import unittest
+from pathlib import Path
+from unittest.mock import Mock, patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "lib"))
+
+import package_manager
+from secure_boot import SecureBootResult
+
+
+class SecureBootTransactionTests(unittest.TestCase):
+    @patch.object(package_manager.subprocess, "run")
+    @patch.object(package_manager, "prepare_secure_boot")
+    def test_aborts_before_pacman_when_preflight_fails(
+        self, prepare_mock, run_mock
+    ):
+        prepare_mock.return_value = SecureBootResult(
+            success=False,
+            configured=True,
+            error="ESP indisponible",
+        )
+
+        result = package_manager.install_packages(["linux-cachyos"])
+
+        self.assertFalse(result.success)
+        self.assertIn("ESP indisponible", result.error)
+        run_mock.assert_not_called()
+
+    @patch.object(package_manager, "refresh_secure_boot")
+    @patch.object(package_manager.subprocess, "run")
+    @patch.object(package_manager, "prepare_secure_boot")
+    def test_reports_post_transaction_signing_failure(
+        self, prepare_mock, run_mock, refresh_mock
+    ):
+        prepare_mock.return_value = SecureBootResult(
+            success=True,
+            configured=True,
+        )
+        run_mock.return_value = Mock(returncode=0, stdout="", stderr="")
+        refresh_mock.return_value = SecureBootResult(
+            success=False,
+            configured=True,
+            error="signature invalide",
+        )
+
+        result = package_manager.upgrade_cached_packages(["linux"])
+
+        self.assertFalse(result.success)
+        self.assertIn("paquets ont été installés", result.error)
+        self.assertIn("signature invalide", result.error)
+
+
+if __name__ == "__main__":
+    unittest.main()