Fix SMIME signature for emails on push

This prevents emails from being signed multiple times when there are
multiple recipients.

Changelog: fixed

app/workers/emails_on_push_worker.rb

@@ -87,13 +87,14 @@ class EmailsOnPushWorker # rubocop:disable Scalability/IdempotentWorker
   private
 
   def send_email(recipient, project_id, options)
-    # Generating the body of this email can be expensive, so only do it once
-    @skip_premailer ||= email.present?
-    @email ||= Notify.repository_push_email(project_id, options)
-
-    email.to = recipient
-    email.add_message_id
-    email.header[:skip_premailer] = true if skip_premailer
-    email.deliver_now
+    @email ||= Notify.repository_push_email(project_id, options).tap do |mail|
+      Premailer::Rails::Hook.perform(mail)
+    end
+
+    current_email = email.dup
+    current_email.to = recipient
+    current_email.add_message_id
+    current_email.header[:skip_premailer] = true
+    current_email.deliver_now
   end
 end

spec/workers/emails_on_push_worker_spec.rb

@@ -139,6 +139,43 @@ RSpec.describe EmailsOnPushWorker, :mailer do
 
           perform
         end
+
+        context 'when SMIME signing is enabled' do
+          include SmimeHelper
+
+          before :context do
+            @root_ca = generate_root
+            @cert = generate_cert(signer_ca: @root_ca)
+          end
+
+          let(:root_certificate) do
+            Gitlab::X509::Certificate.new(@root_ca[:key], @root_ca[:cert])
+          end
+
+          let(:certificate) do
+            Gitlab::X509::Certificate.new(@cert[:key], @cert[:cert])
+          end
+
+          before do
+            allow(Gitlab::X509::Certificate).to receive_messages(from_files: certificate)
+
+            Mail.register_interceptor(Gitlab::Email::Hook::SmimeSignatureInterceptor)
+          end
+
+          after do
+            Mail.unregister_interceptor(Gitlab::Email::Hook::SmimeSignatureInterceptor)
+          end
+
+          it 'does not sign the email multiple times' do
+            perform
+
+            ActionMailer::Base.deliveries.each do |mail|
+              expect(mail.header['Content-Type'].value).to match('multipart/signed').and match('protocol="application/x-pkcs7-signature"')
+
+              expect(mail.to_s.scan(/Content-Disposition: attachment;\r\n filename=smime.p7s/).size).to eq(1)
+            end
+          end
+        end
       end
 
       context "when recipients are invalid" do