Does Netlify use pinned version of git submodule, or does it update it? (re: Hugo theme as submodule)

Support
, ,
1

Hello–

I followed instructions for the Github → Netlify + Hugo deployment process and everything is working as expected, thank you! I am using a public Hugo theme, included as a git submodule in my private web site repo (as recommended in the Hugo help), and that also seems to be working as expected-- Netlify must be checking out my repo recursively, as it’s able to pull in and build with that theme.

All good so far, but a friend who reviewed this asked if Netlify pulls the same specific version of the submodule I have in my repo (a standard git clone --recursive), or if Netlify is also running ‘git submodule update’ to pull the most up to date version of the theme (some web searches suggested the latter might be happening but it’s unclear).

I think I would actually want the former-- I have tested my web site with a specific version of a theme (on my local dev machine the git submodule gives me one consistent commit of the theme), and I don’t want the Netlify Hugo build to break without notice if the theme changes substantially (or to be exposed to security issues, were a theme repo to be hacked some year in the future, etc).

Can you confirm:

  1. If Netlify uses a fixed commit or most up to date version of a git submodule?
  2. If the latter, does my concern seem valid, and is there a recommended best practice for me to ensure Netlify is building using the same version of the submodule I use in my repo? (I know I could manually copy the theme repo into a subfolder of my repo, but that seems inelegant and defeats the point of using git submodules)

Thanks.

2

Hi @icegoat9,

I believe we update the submodules ourselves. Though I’d confirm with the devs.

4

Thank you @hrishikesh , and I’m sorry-- which devs do you mean / is there a better place for me to ask this rather narrow question? :slight_smile:

(I guess I can also experiment myself by creating my own submodule, updating it behind the scenes, and seeing if my Netlify deployment uses the pinned version or auto-updates, just trying to understand whether what I’m doing will be unreliable down the road…)

5

We run git submodule update --init which is the method to clone the specific version and not update automatically: Git - Submodules (git-scm.com). So my statement was wrong and only use the specific version.

1 Like
6

Thank you, that detail is really helpful!