fix: repair dev modules and scoped release git trust

tools/release/govoplan_release/git_state.py

@@ -164,9 +164,10 @@ def git_success(path: Path, *args: str, timeout: int = 10) -> bool:
 
 
 def git(path: Path, *args: str, timeout: int = 10) -> subprocess.CompletedProcess[str]:
+    command = scoped_git_command(path, *args)
     try:
         return subprocess.run(
-            ["/usr/bin/git", "-c", "core.hooksPath=/dev/null", *args],
+            command,
             cwd=path,
             check=False,
             text=True,
@@ -176,7 +177,20 @@ def git(path: Path, *args: str, timeout: int = 10) -> subprocess.CompletedProces
             env=sanitized_git_environment(),
         )
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(["/usr/bin/git", *args], 124, exc.stdout or "", exc.stderr or "git command timed out")
+        return subprocess.CompletedProcess(command, 124, exc.stdout or "", exc.stderr or "git command timed out")
+
+
+def scoped_git_command(path: Path, *args: str) -> tuple[str, ...]:
+    """Trust exactly one resolved catalog checkout for one Git invocation."""
+
+    return (
+        "/usr/bin/git",
+        "-c",
+        "core.hooksPath=/dev/null",
+        "-c",
+        f"safe.directory={path.resolve()}",
+        *args,
+    )
 
 
 def sanitized_git_environment(

tools/release/govoplan_release/publisher.py

@@ -1985,6 +1985,8 @@ def _git_bytes(
             "-C",
             str(path),
             "-c",
+            f"safe.directory={path.resolve()}",
+            "-c",
             "core.sharedRepository=0600",
             "-c",
             "core.fsmonitor=false",

tools/release/govoplan_release/repository_prepare.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from pathlib import Path
 import subprocess
 
-from .git_state import collect_repository_snapshot
+from .git_state import collect_repository_snapshot, scoped_git_command
 from .repository_push import command_text, compact_output
 from .workspace import load_repository_specs, resolve_repo_path, resolve_workspace_root
 
@@ -131,7 +131,12 @@ def resolve_message(*, repo: str, version: str | None, message: str | None) -> s
 
 
 def run(command: tuple[str, ...], *, cwd: Path) -> subprocess.CompletedProcess[str]:
+    effective_command = (
+        scoped_git_command(cwd, *command[1:])
+        if command and Path(command[0]).name == "git"
+        else command
+    )
     try:
-        return subprocess.run(command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
+        return subprocess.run(effective_command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(command, 124, exc.stdout or "", exc.stderr or "git command timed out")
+        return subprocess.CompletedProcess(effective_command, 124, exc.stdout or "", exc.stderr or "git command timed out")

tools/release/govoplan_release/repository_push.py

@@ -6,7 +6,7 @@ from pathlib import Path
 import shlex
 import subprocess
 
-from .git_state import collect_repository_snapshot
+from .git_state import collect_repository_snapshot, scoped_git_command
 from .workspace import load_repository_specs, resolve_repo_path, resolve_workspace_root
 
 
@@ -138,10 +138,15 @@ def command_text(command: tuple[str, ...]) -> str:
 
 
 def run(command: tuple[str, ...], *, cwd: Path) -> subprocess.CompletedProcess[str]:
+    effective_command = (
+        scoped_git_command(cwd, *command[1:])
+        if command and Path(command[0]).name == "git"
+        else command
+    )
     try:
-        return subprocess.run(command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
+        return subprocess.run(effective_command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(command, 124, exc.stdout or "", exc.stderr or "git push timed out")
+        return subprocess.CompletedProcess(effective_command, 124, exc.stdout or "", exc.stderr or "git push timed out")
 
 
 def compact_output(value: str) -> str:

tools/release/govoplan_release/repository_sync.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from pathlib import Path
 import subprocess
 
-from .git_state import collect_repository_snapshot
+from .git_state import collect_repository_snapshot, scoped_git_command
 from .repository_push import command_text, compact_output
 from .workspace import load_repository_specs, resolve_repo_path, resolve_workspace_root
 
@@ -93,7 +93,12 @@ def sync_repositories(
 
 
 def run(command: tuple[str, ...], *, cwd: Path) -> subprocess.CompletedProcess[str]:
+    effective_command = (
+        scoped_git_command(cwd, *command[1:])
+        if command and Path(command[0]).name == "git"
+        else command
+    )
     try:
-        return subprocess.run(command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
+        return subprocess.run(effective_command, cwd=cwd, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(command, 124, exc.stdout or "", exc.stderr or "git fetch timed out")
+        return subprocess.CompletedProcess(effective_command, 124, exc.stdout or "", exc.stderr or "git fetch timed out")

tools/release/govoplan_release/repository_tag.py

@@ -13,6 +13,7 @@ from .git_state import (
     collect_repository_snapshot,
     git_text,
     sanitized_git_environment,
+    scoped_git_command,
 )
 from .model import RepositorySnapshot
 from .repository_push import command_text, compact_output
@@ -479,12 +480,7 @@ def run(
     effective_command = command
     effective_environment = env
     if command and Path(command[0]).name == "git":
-        effective_command = (
-            "/usr/bin/git",
-            "-c",
-            "core.hooksPath=/dev/null",
-            *command[1:],
-        )
+        effective_command = scoped_git_command(cwd, *command[1:])
         effective_environment = sanitized_git_environment(env)
     try:
         return subprocess.run(

tools/release/govoplan_release/source_provenance.py

@@ -16,6 +16,7 @@ from .git_state import (
     collect_repository_snapshot,
     git_text,
     sanitized_git_environment,
+    scoped_git_command,
 )
 from .repository_tag import RemoteTagResult, ref_commit, remote_tag_commit
 from .version_alignment import repository_version_issues
@@ -417,9 +418,10 @@ def _git_file(path: Path, tag: str, name: str) -> str | None:
 
 
 def _git(path: Path, *args: str) -> subprocess.CompletedProcess[str]:
+    command = scoped_git_command(path, *args)
     try:
         return subprocess.run(
-            ("/usr/bin/git", "-c", "core.hooksPath=/dev/null", *args),
+            command,
             cwd=path,
             check=False,
             text=True,
@@ -429,7 +431,7 @@ def _git(path: Path, *args: str) -> subprocess.CompletedProcess[str]:
             env=sanitized_git_environment(),
         )
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(("/usr/bin/git", *args), 124, exc.stdout or "", exc.stderr or "Git command timed out")
+        return subprocess.CompletedProcess(command, 124, exc.stdout or "", exc.stderr or "Git command timed out")
 
 
 def _deduplicate(issues: list[SourceTagProvenanceIssue]) -> list[SourceTagProvenanceIssue]: