Fix GitDagBundle submodule clone not using SSH settings from connection

[shunsuke-sugita]

What

GitDagBundle now wraps git submodule sync / submodule update with GIT_SSH_COMMAND from the Git connection (via GitPython custom_environment), using the worktree Repo (self.repo.git), not the bare mirror.

Why

configure_hook_env() populates hook.env, and bare clone passes it with clone_from(..., env=...). Submodule commands are separate Git subprocesses and did not receive GIT_SSH_COMMAND, so SSH URLs in .gitmodules could fail (host key / identity) even when the main repo clone worked.

Example failure (before this fix)

Submodule update could fail with errors such as:

2026-04-08T03:39:43.516370889Z Cloning into '{submodul_path}'...
2026-04-08T03:39:43.516372014Z Host key verification failed.
2026-04-08T03:39:43.516373389Z fatal: Could not read from remote repository.
2026-04-08T03:39:43.516374555Z
2026-04-08T03:39:43.516375430Z Please make sure you have the correct access rights
2026-04-08T03:39:43.516376389Z and the repository exists.
2026-04-08T03:39:43.516377430Z fatal: clone of '{submodule}' into submodule path 
'/tmp/airflow/dag_bundles/{submodule_path}s' failed
2026-04-08T03:39:43.516378680Z Failed to clone '{submodule}' a second time, aborting'
2026-04-08T03:39:43.518691472Z RuntimeError: Error pulling submodule from repository

Notes

• Aligns with the existing pattern in _fetch_bare_repo for origin.fetch on the bare repo.
• Unit tests still assert that submodule sync/update are invoked when submodules=True; no behavior change to other bundle modes.

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify the tool below)

---

• Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
• For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
• When adding dependency, check compliance with the ASF 3rd Party License Policy.
• For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates GitDagBundle submodule operations to inherit SSH configuration from the Git connection by running git submodule sync/update under GitPython’s custom_environment (using the worktree Repo).

Changes:

• Wraps submodule sync/update calls with GIT_SSH_COMMAND (when present in hook.env).
• Introduces a no-op context (nullcontext) when no SSH env override is needed.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[shunsuke-sugita]

Hi @kaxil , sorry to bother you while you’re busy — just a gentle reminder on this PR.
I’ve addressed the previous feedback and Copilot checks are passing now.
Could you take another look when you have time? Thanks!

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

[shunsuke-sugita]

@kaxil Thanks for the review. I’ve pushed updates addressing your feedback—please take another look when you have a moment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[potiuk]

@shunsuke-sugita Converting to draft — this PR doesn't yet meet our Pull Request quality criteria.

• ❌ Unresolved review comments (9 threads (3 from maintainers, 6 from other reviewers)): please walk through each unresolved review thread. Even if a suggestion looks incorrect or irrelevant — and some of them will be, especially any comments left by automated reviewers like GitHub Copilot — it is still the author's responsibility to respond: apply the fix, reply in-thread with a brief explanation of why the suggestion does not apply, or resolve the thread if the feedback is no longer relevant. Leaving threads unaddressed for weeks blocks the PR from moving forward.

See the linked criteria for how to fix each item, then mark the PR "Ready for review". This is not a rejection — just an invitation to bring the PR up to standard. No rush.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[potiuk]

Quick follow-up to the triage comment above — one clarification on the "Unresolved review comments" item:

Once you believe a thread has been addressed — whether by pushing a fix, or by replying in-thread with an explanation of why the suggestion doesn't apply — please mark the thread as resolved yourself by clicking the "Resolve conversation" button at the bottom of each thread. Reviewers don't auto-close their own threads, so an addressed-but-unresolved thread reads as "still waiting on the author" and keeps the PR from moving forward. The author doing the resolve-click is the expected convention on this project.

---

Note: This comment was drafted by an AI-assisted triage tool and may contain mistakes. Once you have addressed the points above, an Apache Airflow maintainer — a real person — will take the next look at your PR. We use this two-stage triage process so that our maintainers' limited time is spent where it matters most: the conversation with you.

[shunsuke-sugita]

@potiuk

Thank you for contacting us.
I will proceed as you suggested.