Define the catalog publication identity

tests/test_release_catalog_publication.py

@@ -26,11 +26,42 @@ from govoplan_release.publisher import (  # noqa: E402
     verify_committed_publication,
     verify_remote_branch_head,
     verify_remote_publication,
+    _sanitized_git_environment,
     _trusted_npm_command,
 )
 
 
 class ReleaseCatalogPublicationTests(unittest.TestCase):
+    def test_publication_git_identity_is_fixed_and_non_personal(self) -> None:
+        with patch.dict(
+            os.environ,
+            {
+                "GIT_AUTHOR_NAME": "Attacker",
+                "GIT_AUTHOR_EMAIL": "attacker@example.test",
+                "GIT_COMMITTER_NAME": "Attacker",
+                "GIT_COMMITTER_EMAIL": "attacker@example.test",
+            },
+            clear=False,
+        ):
+            environment = _sanitized_git_environment()
+
+        self.assertEqual(
+            "GovOPlaN Release Automation",
+            environment["GIT_AUTHOR_NAME"],
+        )
+        self.assertEqual(
+            "release@govoplan.invalid",
+            environment["GIT_AUTHOR_EMAIL"],
+        )
+        self.assertEqual(
+            environment["GIT_AUTHOR_NAME"],
+            environment["GIT_COMMITTER_NAME"],
+        )
+        self.assertEqual(
+            environment["GIT_AUTHOR_EMAIL"],
+            environment["GIT_COMMITTER_EMAIL"],
+        )
+
     def test_build_command_uses_its_pinned_node_directory(self) -> None:
         completed = subprocess.CompletedProcess(
             ["/trusted/node/bin/npm"],