fix(release): support validated per-run SSH address family

tests/test_release_git_state.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from pathlib import Path
+import shlex
 import subprocess
 import sys
 import unittest
@@ -17,6 +18,80 @@ from govoplan_release import git_state  # noqa: E402
 
 
 class ReleaseGitStateTests(unittest.TestCase):
+    def test_unset_ssh_address_family_preserves_original_command_and_operator_config(self) -> None:
+        environment = git_state.sanitized_git_environment({})
+
+        self.assertEqual(
+            [
+                "/usr/bin/ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8",
+            ],
+            shlex.split(environment["GIT_SSH_COMMAND"]),
+        )
+        self.assertNotIn("GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY", environment)
+        self.assertEqual(environment, git_state.sanitized_git_environment(environment))
+
+    def test_ssh_address_family_accepts_only_fixed_choices_and_survives_resanitizing(self) -> None:
+        for family in ("any", "inet", "inet6"):
+            with self.subTest(family=family):
+                environment = git_state.sanitized_git_environment({
+                    "GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY": family,
+                    "GIT_SSH_COMMAND": "/attacker/ssh -o StrictHostKeyChecking=no",
+                    "GIT_SSH": "/attacker/ssh",
+                    "PATH": "/attacker/bin",
+                })
+
+                self.assertEqual(
+                    [
+                        "/usr/bin/ssh", "-o", "BatchMode=yes", "-o", "ConnectTimeout=8",
+                        "-o", f"AddressFamily={family}",
+                    ],
+                    shlex.split(environment["GIT_SSH_COMMAND"]),
+                )
+                self.assertNotIn("GIT_SSH", environment)
+                self.assertEqual("/usr/bin:/bin", environment["PATH"])
+                self.assertEqual(environment, git_state.sanitized_git_environment(environment))
+
+    def test_invalid_ssh_address_family_is_rejected_before_git_runs(self) -> None:
+        for invalid in (
+            "", "INET", "ipv4", " inet", "inet ", "inet\n",
+            "inet; touch /not-executed", "inet -o StrictHostKeyChecking=no",
+            "$(not-executed)",
+        ):
+            with (
+                self.subTest(value=invalid),
+                patch.dict("os.environ", {"GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY": invalid}),
+                patch.object(git_state.subprocess, "run") as run,
+            ):
+                with self.assertRaisesRegex(
+                    ValueError, "GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY must be any, inet, or inet6",
+                ):
+                    git_state.git(Path("/workspace/govoplan-core"), "status", "--porcelain")
+                run.assert_not_called()
+
+    def test_source_provenance_readback_keeps_family_but_discards_ssh_command_override(self) -> None:
+        from govoplan_release.source_provenance import inspect_remote_tag
+
+        completed = subprocess.CompletedProcess(
+            [], 0, f"{'a' * 40}\trefs/tags/v1.2.3\n{'b' * 40}\trefs/tags/v1.2.3^{{}}\n", "",
+        )
+        with (
+            patch.dict("os.environ", {
+                "GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY": "inet",
+                "GIT_SSH_COMMAND": "/attacker/ssh -o StrictHostKeyChecking=no",
+            }),
+            patch("govoplan_release.repository_tag.subprocess.run", return_value=completed) as run,
+        ):
+            result = inspect_remote_tag(
+                path=Path("/workspace/govoplan-core"), remote="origin",
+                remote_url="git@git.add-ideas.de:GovOPlaN/govoplan-core.git", tag="v1.2.3",
+            )
+
+        self.assertEqual("b" * 40, result.commit)
+        self.assertEqual(
+            "/usr/bin/ssh -o BatchMode=yes -o ConnectTimeout=8 -o AddressFamily=inet",
+            run.call_args.kwargs["env"]["GIT_SSH_COMMAND"],
+        )
+
     def test_manifest_version_does_not_confuse_interface_versions(self) -> None:
         from tempfile import TemporaryDirectory