Harden release source execution

tools/release/govoplan_release/version_alignment.py

@@ -9,7 +9,7 @@ import re
 import subprocess
 import tomllib
 
-from .git_state import collect_versions
+from .git_state import collect_versions, sanitized_git_environment
 from .workspace import load_repository_specs, resolve_repo_path
 
 
@@ -684,12 +684,13 @@ def _git_tag_commit(repo_path: Path, tag: str) -> str | None:
     if not (repo_path / ".git").exists():
         return None
     result = subprocess.run(
-        ["git", "-C", str(repo_path), "rev-list", "-n", "1", tag],
+        ["/usr/bin/git", "-C", str(repo_path), "rev-list", "-n", "1", tag],
         check=False,
         text=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.DEVNULL,
         timeout=10,
+        env=sanitized_git_environment(),
     )
     value = result.stdout.strip()
     return value if result.returncode == 0 and value else None
@@ -699,12 +700,13 @@ def _git_tag_file(repo_path: Path, tag: str, relative_path: str) -> str | None:
     if not (repo_path / ".git").exists():
         return None
     result = subprocess.run(
-        ["git", "-C", str(repo_path), "show", f"{tag}:{relative_path}"],
+        ["/usr/bin/git", "-C", str(repo_path), "show", f"{tag}:{relative_path}"],
         check=False,
         text=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.DEVNULL,
         timeout=10,
+        env=sanitized_git_environment(),
     )
     return result.stdout if result.returncode == 0 else None