Implement direct Notarius extraction execution

internal/app/runner_test.go

@@ -70,6 +70,17 @@ type captureSelectedArtifactsStage struct {
 	captured *[]string
 }
 
+type captureNotariusStage struct {
+	captured *bool
+}
+
+func (s captureNotariusStage) Name() string           { return "extract" }
+func (s captureNotariusStage) Declares() stage.IODecl { return stage.IODecl{} }
+func (s captureNotariusStage) Run(_ context.Context, env *stage.Env, _ *manifest.Manifest) (*stage.StageResult, error) {
+	*s.captured = env.Notarius != nil
+	return &stage.StageResult{}, nil
+}
+
 func (s captureSelectedArtifactsStage) Name() string           { return s.name }
 func (s captureSelectedArtifactsStage) Declares() stage.IODecl { return stage.IODecl{} }
 func (s captureSelectedArtifactsStage) Run(_ context.Context, env *stage.Env, _ *manifest.Manifest) (*stage.StageResult, error) {
@@ -154,6 +165,28 @@ func TestExecuteStagesPropagatesSelectedArtifactsToEnv(t *testing.T) {
 	}
 }
 
+func TestExecuteStagesComposesNotariusOnlyForEnabledExtraction(t *testing.T) {
+	cfg := testConfig(t)
+	cfg.Pipeline.Notarius = &config.NotariusConfig{Enabled: true}
+	captured := false
+
+	_, err := executeStages(context.Background(), cfg, []stage.Stage{captureNotariusStage{captured: &captured}}, RunOptions{})
+	if err != nil {
+		t.Fatalf("executeStages() error = %v", err)
+	}
+	if !captured {
+		t.Fatal("extract stage did not receive the default Notarius runner")
+	}
+
+	if needsNotariusForRun(cfg, []stage.Stage{countingStage{name: "analyze", runs: new(int)}}) {
+		t.Fatal("Notarius runner requested without extract in the selected plan")
+	}
+	cfg.Pipeline.Notarius.Enabled = false
+	if needsNotariusForRun(cfg, []stage.Stage{captureNotariusStage{captured: new(bool)}}) {
+		t.Fatal("Notarius runner requested while extraction is disabled")
+	}
+}
+
 func TestExecuteStagesAnalyzeOutputsPersistAsScriptoriumArtifacts(t *testing.T) {
 	cfg := testConfig(t)
 	storeForPaths := artifacts.NewLocalStore(cfg.Pipeline.Workspace.Root)