Harden release source execution

tools/release/govoplan_release/source_provenance.py

@@ -12,7 +12,11 @@ import tomllib
 from typing import Iterable
 from urllib.parse import urlsplit
 
-from .git_state import collect_repository_snapshot, git_text
+from .git_state import (
+    collect_repository_snapshot,
+    git_text,
+    sanitized_git_environment,
+)
 from .repository_tag import RemoteTagResult, ref_commit, remote_tag_commit
 from .version_alignment import repository_version_issues
 from .workspace import load_repository_specs, resolve_repo_path
@@ -415,16 +419,17 @@ def _git_file(path: Path, tag: str, name: str) -> str | None:
 def _git(path: Path, *args: str) -> subprocess.CompletedProcess[str]:
     try:
         return subprocess.run(
-            ("git", *args),
+            ("/usr/bin/git", "-c", "core.hooksPath=/dev/null", *args),
             cwd=path,
             check=False,
             text=True,
             stdout=subprocess.PIPE,
             stderr=subprocess.PIPE,
             timeout=30,
+            env=sanitized_git_environment(),
         )
     except subprocess.TimeoutExpired as exc:
-        return subprocess.CompletedProcess(("git", *args), 124, exc.stdout or "", exc.stderr or "Git command timed out")
+        return subprocess.CompletedProcess(("/usr/bin/git", *args), 124, exc.stdout or "", exc.stderr or "Git command timed out")
 
 
 def _deduplicate(issues: list[SourceTagProvenanceIssue]) -> list[SourceTagProvenanceIssue]: