From bb619cf8bfd90f1a8b9c644604042542b25ddc26 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Mon, 18 May 2026 00:13:07 -0700
Subject: [PATCH 1/8] First implementation

---
 .../dependabot-submodule-tag-alignment.yml    | 373 ++++++++++++++++++
 1 file changed, 373 insertions(+)
 create mode 100644 .github/workflows/dependabot-submodule-tag-alignment.yml

diff --git a/.github/workflows/dependabot-submodule-tag-alignment.yml b/.github/workflows/dependabot-submodule-tag-alignment.yml
new file mode 100644
index 0000000000000..2f0d8447f68b5
--- /dev/null
+++ b/.github/workflows/dependabot-submodule-tag-alignment.yml
@@ -0,0 +1,373 @@
+name: Dependabot Submodule Tag Alignment
+
+on:
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  enforce-submodule-tags:
+    # Only run for Dependabot PRs
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+
+    steps:
+      ######################################################################
+      # Checkout the PR branch itself.
+      #
+      # We intentionally checkout the PR HEAD branch because we may:
+      # - modify .gitmodules
+      # - update submodule pointers
+      # - force-push changes back into the Dependabot branch
+      ######################################################################
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+          submodules: recursive
+          ref: ${{ github.event.pull_request.head.ref }}
+
+      ######################################################################
+      # Configure git identity for commits made by the workflow.
+      ######################################################################
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      ######################################################################
+      # Install GitHub CLI.
+      #
+      # We use gh to close PRs cleanly when no update is needed.
+      ######################################################################
+      - name: Install GitHub CLI
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gh jq
+
+      ######################################################################
+      # Main logic.
+      #
+      # This script:
+      # 1. Detects modified submodules in the PR
+      # 2. Reads branch/tag/url from .gitmodules
+      # 3. Finds the newest tag reachable from the configured branch
+      # 4. Compares commits
+      # 5. Either:
+      #    - closes the PR
+      #    - updates only .gitmodules
+      #    - or rewrites the submodule commit to the latest tag commit
+      ######################################################################
+      - name: Enforce submodule tag policy
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+
+            set -euo pipefail
+
+            echo "========================================================"
+            echo "Detecting changed submodules in PR"
+            echo "========================================================"
+
+            # Find submodules whose gitlink changed in this PR
+            #
+            # git diff output format for submodules:
+            # 160000 <oldsha> <newsha> M path/to/submodule
+            #
+            CHANGED_SUBMODULES=$(git diff --submodule=short "$BASE_SHA" "$HEAD_SHA" | \
+                grep '^Submodule ' | awk '{print $2}')
+
+            if [ -z "$CHANGED_SUBMODULES" ]; then
+                echo "No changed submodules detected."
+                exit 0
+            fi
+
+            echo "Changed submodules:"
+            echo "$CHANGED_SUBMODULES"
+
+            ##################################################################
+            # Dependabot should create PRs containing only a single submodule
+            # update.
+            #
+            # If multiple submodules are modified in the same PR, this workflow
+            # does not know how to safely rewrite the PR title, comments, and
+            # branch contents deterministically.
+            #
+            # In that situation:
+            # - comment on the PR
+            # - fail the workflow
+            # - leave the PR untouched for manual review
+            ##################################################################
+            SUBMODULE_COUNT=$(echo "$CHANGED_SUBMODULES" | wc -w)
+
+            if [ "$SUBMODULE_COUNT" -gt 1 ]; then
+
+            echo "ERROR: Multiple submodule updates detected in one PR."
+
+            gh pr comment "$PR_NUMBER" \
+                --repo "$REPO" \
+                --body "$(cat <<EOF
+            Workflow \"$GITHUB_WORKFLOW\" expected exactly one submodule update in this Dependabot PR, but detected multiple updated submodules.
+
+            Updated submodules:
+            \`\`\`
+            $CHANGED_SUBMODULES
+            \`\`\`
+
+            This PR was left unchanged for manual review.
+            EOF
+            )"
+
+            exit 1
+            fi
+
+            ##################################################################
+            # Use the first (and expected only) changed submodule.
+            ##################################################################
+            SUBMODULE_PATH=$(echo "$CHANGED_SUBMODULES" | head -n1)
+
+            SHOULD_FORCE_PUSH=false
+            SHOULD_COMMIT=false
+
+            echo ""
+            echo "========================================================"
+            echo "Processing submodule: $SUBMODULE_PATH"
+            echo "========================================================"
+
+            ################################################################
+            # Read values from .gitmodules
+            ################################################################
+
+            SUBMODULE_URL=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.url" || true)
+            SUBMODULE_BRANCH=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.branch" || true)
+            SUBMODULE_TAG=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.tag" || true)
+
+            echo "URL:    $SUBMODULE_URL"
+            echo "Branch: $SUBMODULE_BRANCH"
+            echo "Tag:    ${SUBMODULE_TAG:-<none>}"
+
+            ################################################################
+            # If there is no tag property, do nothing.
+            ################################################################
+            if [ -z "${SUBMODULE_TAG}" ]; then
+              echo "No tag property found. Leaving Dependabot PR untouched."
+              exit 0
+            fi
+
+            ################################################################
+            # Fetch all refs from the submodule repository.
+            #
+            # We clone into a temp directory because we need to inspect:
+            # - branch heads
+            # - tags
+            # - tag commits
+            ################################################################
+            TEMP_DIR=$(mktemp -d)
+
+            git clone --quiet --no-checkout "$SUBMODULE_URL" "$TEMP_DIR"
+
+            pushd "$TEMP_DIR" > /dev/null
+
+            git fetch --all --tags --force
+
+            ################################################################
+            # Find the latest tag reachable from the configured branch.
+            #
+            # Strategy:
+            #   git tag --merged origin/<branch>
+            #
+            # This returns tags reachable from that branch.
+            #
+            # Then sort naturally using version sort.
+            ################################################################
+            REACHABLE_TAGS=$(git tag --merged "origin/${SUBMODULE_BRANCH}" --sort=-v:refname)
+
+            if [ -z "$REACHABLE_TAGS" ]; then
+              echo "No tags reachable from branch ${SUBMODULE_BRANCH}"
+              popd > /dev/null
+              rm -rf "$TEMP_DIR"
+              exit 0
+            fi
+
+            LATEST_TAG=$(echo "$REACHABLE_TAGS" | head -n1)
+
+            echo "Latest reachable tag: $LATEST_TAG"
+
+            ################################################################
+            # Resolve the commit hash for the latest tag.
+            ################################################################
+            LATEST_TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG")
+
+            echo "Latest tag commit: $LATEST_TAG_COMMIT"
+
+            popd > /dev/null
+
+            ################################################################
+            # Determine the commit currently used in the PR for this submodule
+            ################################################################
+            CURRENT_SUBMODULE_COMMIT=$(git ls-tree HEAD "$SUBMODULE_PATH" | awk '{print $3}')
+
+            echo "Current PR submodule commit: $CURRENT_SUBMODULE_COMMIT"
+
+            ################################################################
+            # If .gitmodules already contains the latest tag AND the submodule
+            # commit equals that tag commit, then this Dependabot PR is
+            # unnecessary.
+            #
+            # Close the PR and ignore it.
+            ################################################################
+            if [ "$SUBMODULE_TAG" = "$LATEST_TAG" ]; then
+
+                echo "This submodule is already on the latest release tag."
+                echo "Closing unnecessary Dependabot PR."
+
+                gh pr comment "$PR_NUMBER" \
+                    --repo "$REPO" \
+                    --body "$(cat <<EOF
+                Closing this PR because the submodule is already pinned to the latest release tag (${LATEST_TAG}).
+
+                @dependabot ignore this
+                EOF
+                )"
+
+                gh pr close "$PR_NUMBER" \
+                    --repo "$REPO"
+
+                exit 0
+            fi
+
+            ################################################################
+            # A newer release tag exists.
+            #
+            # Update the PR title so the PR reflects release tag upgrades
+            # instead of raw commit hashes.
+            ################################################################
+            NEW_PR_TITLE="Bump ${SUBMODULE_PATH} from ${SUBMODULE_TAG} to ${LATEST_TAG}"
+
+            echo "Updating PR title:"
+            echo "$NEW_PR_TITLE"
+
+            gh pr edit "$PR_NUMBER" \
+                --repo "$REPO" \
+                --title "$NEW_PR_TITLE"
+
+            ################################################################
+            # Update .gitmodules to use the newest tag.
+            ################################################################
+            echo "Updating .gitmodules tag -> $LATEST_TAG"
+
+            git config -f .gitmodules \
+              "submodule.${SUBMODULE_PATH}.tag" \
+              "$LATEST_TAG"
+
+            SHOULD_COMMIT=true
+
+            git add .gitmodules
+
+            ################################################################
+            # If Dependabot already updated the submodule to the same commit
+            # as the latest tag, then we only need to commit .gitmodules.
+            ################################################################
+            if [ "$CURRENT_SUBMODULE_COMMIT" = "$LATEST_TAG_COMMIT" ]; then
+                echo "Dependabot already matches the latest release tag commit."
+                echo "Only the .gitmodules tag value needs updating."
+                SHOULD_FORCE_PUSH=false
+            fi
+
+            ################################################################
+            # Otherwise:
+            #
+            # - checkout the latest tag commit in the submodule
+            # - update the gitlink in the parent repository
+            # - later we will force-push the rewritten branch
+            ################################################################
+            echo "Dependabot updated to a non-tag commit."
+            echo "Rewriting submodule to latest tag commit."
+
+            ################################################################
+            # Add a PR comment explaining why the workflow rewrote the
+            # Dependabot update.
+            ################################################################
+            gh pr comment "$PR_NUMBER" \
+                --repo "$REPO" \
+                --body "$(cat <<EOF
+            Dependabot updated this submodule to the latest commit on the tracked branch.
+
+            Workflow \"$GITHUB_WORKFLOW\" rewrote the update to use the latest release tag reachable from \`${SUBMODULE_BRANCH}\`.
+
+            Changes applied:
+            - previous tag: \`${SUBMODULE_TAG}\`
+            - new tag: \`${LATEST_TAG}\`
+            - dependabot target commit: \`${CURRENT_SUBMODULE_COMMIT}\`
+            - release tag commit: \`${LATEST_TAG_COMMIT}\`
+            EOF
+            )"
+
+            pushd "$SUBMODULE_PATH" > /dev/null
+
+            git fetch --tags --force
+            git checkout "$LATEST_TAG"
+
+            popd > /dev/null
+            rm -rf "$TEMP_DIR"
+
+            git add "$SUBMODULE_PATH"
+
+            SHOULD_FORCE_PUSH=true
+            SHOULD_COMMIT=true
+
+            ##################################################################
+            # Commit changes if needed.
+            ##################################################################
+            if [ "$SHOULD_COMMIT" = true ]; then
+
+                git add .gitmodules
+
+                git commit -m "Align submodules with latest release tags" || \
+                echo "No changes to commit"
+
+            else
+                echo "No repository changes required."
+                exit 0
+            fi
+
+            ##################################################################
+            # Push changes back into the Dependabot PR branch.
+            #
+            # Force push only if we rewrote the submodule gitlink commit.
+            ##################################################################
+            if [ "$SHOULD_FORCE_PUSH" = true ]; then
+
+                echo "Force-pushing rewritten Dependabot branch"
+
+                git push origin \
+                HEAD:"$PR_BRANCH" \
+                --force
+
+            else
+
+                echo "Pushing normal commit to Dependabot branch"
+
+                git push origin \
+                HEAD:"$PR_BRANCH"
+
+            fi
+
+      ######################################################################
+      # Final status output
+      ######################################################################
+      - name: Done
+        run: |
+          echo "Submodule tag enforcement completed."

From b17583a869c086663060197cf5d2394c82c9169b Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Mon, 18 May 2026 00:14:17 -0700
Subject: [PATCH 2/8] Implement dependabot-submodule-tag-alignment.yml

---
 .../dependabot-submodule-tag-alignment.yml    | 430 +++++++-----------
 1 file changed, 162 insertions(+), 268 deletions(-)

diff --git a/.github/workflows/dependabot-submodule-tag-alignment.yml b/.github/workflows/dependabot-submodule-tag-alignment.yml
index 2f0d8447f68b5..737b80dc7cd78 100644
--- a/.github/workflows/dependabot-submodule-tag-alignment.yml
+++ b/.github/workflows/dependabot-submodule-tag-alignment.yml
@@ -12,8 +12,7 @@ permissions:
   pull-requests: write
 
 jobs:
-  enforce-submodule-tags:
-    # Only run for Dependabot PRs
+  align-submodule-tags:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
 
@@ -42,11 +41,6 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
-      ######################################################################
-      # Install GitHub CLI.
-      #
-      # We use gh to close PRs cleanly when no update is needed.
-      ######################################################################
       - name: Install GitHub CLI
         run: |
           sudo apt-get update
@@ -65,7 +59,7 @@ jobs:
       #    - updates only .gitmodules
       #    - or rewrites the submodule commit to the latest tag commit
       ######################################################################
-      - name: Enforce submodule tag policy
+      - name: Align submodule tags
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -75,53 +69,46 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
 
-            set -euo pipefail
-
-            echo "========================================================"
-            echo "Detecting changed submodules in PR"
-            echo "========================================================"
-
-            # Find submodules whose gitlink changed in this PR
-            #
-            # git diff output format for submodules:
-            # 160000 <oldsha> <newsha> M path/to/submodule
-            #
-            CHANGED_SUBMODULES=$(git diff --submodule=short "$BASE_SHA" "$HEAD_SHA" | \
-                grep '^Submodule ' | awk '{print $2}')
-
-            if [ -z "$CHANGED_SUBMODULES" ]; then
-                echo "No changed submodules detected."
-                exit 0
-            fi
-
-            echo "Changed submodules:"
-            echo "$CHANGED_SUBMODULES"
-
-            ##################################################################
-            # Dependabot should create PRs containing only a single submodule
-            # update.
-            #
-            # If multiple submodules are modified in the same PR, this workflow
-            # does not know how to safely rewrite the PR title, comments, and
-            # branch contents deterministically.
-            #
-            # In that situation:
-            # - comment on the PR
-            # - fail the workflow
-            # - leave the PR untouched for manual review
-            ##################################################################
-            SUBMODULE_COUNT=$(echo "$CHANGED_SUBMODULES" | wc -w)
-
-            if [ "$SUBMODULE_COUNT" -gt 1 ]; then
-
-            echo "ERROR: Multiple submodule updates detected in one PR."
+          set -euo pipefail
+
+          ####################################################################
+          # Cleanup safety: always remove temp dir even on failure/exit
+          ####################################################################
+          TEMP_DIR=""
+          trap '[[ -n "$TEMP_DIR" ]] && rm -rf "$TEMP_DIR"' EXIT
+
+          echo "========================================================"
+          echo "Detecting changed submodules in PR"
+          echo "========================================================"
+
+          ####################################################################
+          # Detect submodule changes in this PR
+          ####################################################################
+          CHANGED_SUBMODULES=$(git diff --submodule=short "$BASE_SHA" "$HEAD_SHA" \
+            | grep '^Submodule ' | awk '{print $2}')
+
+          if [ -z "$CHANGED_SUBMODULES" ]; then
+            echo "No changed submodules detected."
+            exit 0
+          fi
+
+          echo "Changed submodules:"
+          echo "$CHANGED_SUBMODULES"
+
+          ####################################################################
+          # Enforce strict single-submodule rule
+          ####################################################################
+          SUBMODULE_COUNT=$(echo "$CHANGED_SUBMODULES" | wc -w)
+
+          if [ "$SUBMODULE_COUNT" -gt 1 ]; then
+
+            echo "ERROR: Multiple submodules detected."
 
             gh pr comment "$PR_NUMBER" \
-                --repo "$REPO" \
-                --body "$(cat <<EOF
-            Workflow \"$GITHUB_WORKFLOW\" expected exactly one submodule update in this Dependabot PR, but detected multiple updated submodules.
+              --repo "$REPO" \
+              --body "$(cat <<EOF
+            Workflow "$GITHUB_WORKFLOW" expected exactly one submodule update in this Dependabot PR, but found multiple:
 
-            Updated submodules:
             \`\`\`
             $CHANGED_SUBMODULES
             \`\`\`
@@ -129,245 +116,152 @@ jobs:
             This PR was left unchanged for manual review.
             EOF
             )"
+            exit 1
+          fi
+
+          ####################################################################
+          # Single submodule assumption
+          ####################################################################
+          SUBMODULE_PATH=$(echo "$CHANGED_SUBMODULES" | head -n1)
+
+          echo "Processing submodule: $SUBMODULE_PATH"
+
+          ####################################################################
+          # Read submodule metadata
+          ####################################################################
+          SUBMODULE_URL=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.url" || true)
+          SUBMODULE_BRANCH=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.branch" || true)
+          SUBMODULE_TAG=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.tag" || true)
+
+          echo "URL:    $SUBMODULE_URL"
+          echo "Branch: $SUBMODULE_BRANCH"
+          echo "Tag:    ${SUBMODULE_TAG:-<none>}"
 
+          if [ -z "$SUBMODULE_URL" ]; then
+            echo "ERROR: Missing submodule URL"
             exit 1
-            fi
-
-            ##################################################################
-            # Use the first (and expected only) changed submodule.
-            ##################################################################
-            SUBMODULE_PATH=$(echo "$CHANGED_SUBMODULES" | head -n1)
-
-            SHOULD_FORCE_PUSH=false
-            SHOULD_COMMIT=false
-
-            echo ""
-            echo "========================================================"
-            echo "Processing submodule: $SUBMODULE_PATH"
-            echo "========================================================"
-
-            ################################################################
-            # Read values from .gitmodules
-            ################################################################
-
-            SUBMODULE_URL=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.url" || true)
-            SUBMODULE_BRANCH=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.branch" || true)
-            SUBMODULE_TAG=$(git config -f .gitmodules --get "submodule.${SUBMODULE_PATH}.tag" || true)
-
-            echo "URL:    $SUBMODULE_URL"
-            echo "Branch: $SUBMODULE_BRANCH"
-            echo "Tag:    ${SUBMODULE_TAG:-<none>}"
-
-            ################################################################
-            # If there is no tag property, do nothing.
-            ################################################################
-            if [ -z "${SUBMODULE_TAG}" ]; then
-              echo "No tag property found. Leaving Dependabot PR untouched."
-              exit 0
-            fi
-
-            ################################################################
-            # Fetch all refs from the submodule repository.
-            #
-            # We clone into a temp directory because we need to inspect:
-            # - branch heads
-            # - tags
-            # - tag commits
-            ################################################################
-            TEMP_DIR=$(mktemp -d)
-
-            git clone --quiet --no-checkout "$SUBMODULE_URL" "$TEMP_DIR"
-
-            pushd "$TEMP_DIR" > /dev/null
-
-            git fetch --all --tags --force
-
-            ################################################################
-            # Find the latest tag reachable from the configured branch.
-            #
-            # Strategy:
-            #   git tag --merged origin/<branch>
-            #
-            # This returns tags reachable from that branch.
-            #
-            # Then sort naturally using version sort.
-            ################################################################
-            REACHABLE_TAGS=$(git tag --merged "origin/${SUBMODULE_BRANCH}" --sort=-v:refname)
-
-            if [ -z "$REACHABLE_TAGS" ]; then
-              echo "No tags reachable from branch ${SUBMODULE_BRANCH}"
-              popd > /dev/null
-              rm -rf "$TEMP_DIR"
-              exit 0
-            fi
-
-            LATEST_TAG=$(echo "$REACHABLE_TAGS" | head -n1)
-
-            echo "Latest reachable tag: $LATEST_TAG"
-
-            ################################################################
-            # Resolve the commit hash for the latest tag.
-            ################################################################
-            LATEST_TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG")
-
-            echo "Latest tag commit: $LATEST_TAG_COMMIT"
+          fi
 
+          ####################################################################
+          # Fetch submodule repository metadata
+          ####################################################################
+          TEMP_DIR=$(mktemp -d)
+
+          git clone --quiet --no-checkout "$SUBMODULE_URL" "$TEMP_DIR"
+          pushd "$TEMP_DIR" > /dev/null
+
+          git fetch --all --tags --force
+
+          REACHABLE_TAGS=$(git tag --merged "origin/${SUBMODULE_BRANCH}" --sort=-v:refname)
+
+          if [ -z "$REACHABLE_TAGS" ]; then
+            echo "No reachable tags for branch ${SUBMODULE_BRANCH}"
             popd > /dev/null
+            exit 0
+          fi
+
+          LATEST_TAG=$(echo "$REACHABLE_TAGS" | head -n1)
+          LATEST_TAG_COMMIT=$(git rev-list -n 1 "$LATEST_TAG")
+
+          popd > /dev/null
+
+          echo "Latest reachable tag: $LATEST_TAG"
+          echo "Latest tag commit:    $LATEST_TAG_COMMIT"
+
+          ####################################################################
+          # Current PR submodule commit
+          ####################################################################
+          CURRENT_SUBMODULE_COMMIT=$(git ls-tree HEAD "$SUBMODULE_PATH" | awk '{print $3}')
+
+          echo "Dependabot commit: $CURRENT_SUBMODULE_COMMIT"
+
+          ####################################################################
+          # CASE 1: Submodule already pinned to latest release tag
+          ####################################################################
+          if [ "$SUBMODULE_TAG" = "$LATEST_TAG" ]; then
+
+            echo "Submodule already at latest release tag. Closing PR."
 
-            ################################################################
-            # Determine the commit currently used in the PR for this submodule
-            ################################################################
-            CURRENT_SUBMODULE_COMMIT=$(git ls-tree HEAD "$SUBMODULE_PATH" | awk '{print $3}')
-
-            echo "Current PR submodule commit: $CURRENT_SUBMODULE_COMMIT"
-
-            ################################################################
-            # If .gitmodules already contains the latest tag AND the submodule
-            # commit equals that tag commit, then this Dependabot PR is
-            # unnecessary.
-            #
-            # Close the PR and ignore it.
-            ################################################################
-            if [ "$SUBMODULE_TAG" = "$LATEST_TAG" ]; then
-
-                echo "This submodule is already on the latest release tag."
-                echo "Closing unnecessary Dependabot PR."
-
-                gh pr comment "$PR_NUMBER" \
-                    --repo "$REPO" \
-                    --body "$(cat <<EOF
-                Closing this PR because the submodule is already pinned to the latest release tag (${LATEST_TAG}).
-
-                @dependabot ignore this
-                EOF
-                )"
-
-                gh pr close "$PR_NUMBER" \
-                    --repo "$REPO"
-
-                exit 0
-            fi
-
-            ################################################################
-            # A newer release tag exists.
-            #
-            # Update the PR title so the PR reflects release tag upgrades
-            # instead of raw commit hashes.
-            ################################################################
-            NEW_PR_TITLE="Bump ${SUBMODULE_PATH} from ${SUBMODULE_TAG} to ${LATEST_TAG}"
-
-            echo "Updating PR title:"
-            echo "$NEW_PR_TITLE"
-
-            gh pr edit "$PR_NUMBER" \
-                --repo "$REPO" \
-                --title "$NEW_PR_TITLE"
-
-            ################################################################
-            # Update .gitmodules to use the newest tag.
-            ################################################################
-            echo "Updating .gitmodules tag -> $LATEST_TAG"
-
-            git config -f .gitmodules \
-              "submodule.${SUBMODULE_PATH}.tag" \
-              "$LATEST_TAG"
-
-            SHOULD_COMMIT=true
-
-            git add .gitmodules
-
-            ################################################################
-            # If Dependabot already updated the submodule to the same commit
-            # as the latest tag, then we only need to commit .gitmodules.
-            ################################################################
-            if [ "$CURRENT_SUBMODULE_COMMIT" = "$LATEST_TAG_COMMIT" ]; then
-                echo "Dependabot already matches the latest release tag commit."
-                echo "Only the .gitmodules tag value needs updating."
-                SHOULD_FORCE_PUSH=false
-            fi
-
-            ################################################################
-            # Otherwise:
-            #
-            # - checkout the latest tag commit in the submodule
-            # - update the gitlink in the parent repository
-            # - later we will force-push the rewritten branch
-            ################################################################
-            echo "Dependabot updated to a non-tag commit."
-            echo "Rewriting submodule to latest tag commit."
-
-            ################################################################
-            # Add a PR comment explaining why the workflow rewrote the
-            # Dependabot update.
-            ################################################################
             gh pr comment "$PR_NUMBER" \
-                --repo "$REPO" \
-                --body "$(cat <<EOF
-            Dependabot updated this submodule to the latest commit on the tracked branch.
+              --repo "$REPO" \
+              --body "$(cat <<EOF
+            Workflow "$GITHUB_WORKFLOW" closed this PR because the submodule is already pinned to the latest release tag:
 
-            Workflow \"$GITHUB_WORKFLOW\" rewrote the update to use the latest release tag reachable from \`${SUBMODULE_BRANCH}\`.
+            - Tag: \`$LATEST_TAG\`
 
-            Changes applied:
-            - previous tag: \`${SUBMODULE_TAG}\`
-            - new tag: \`${LATEST_TAG}\`
-            - dependabot target commit: \`${CURRENT_SUBMODULE_COMMIT}\`
-            - release tag commit: \`${LATEST_TAG_COMMIT}\`
+            @dependabot ignore this
             EOF
             )"
 
-            pushd "$SUBMODULE_PATH" > /dev/null
+            gh pr close "$PR_NUMBER" --repo "$REPO"
 
-            git fetch --tags --force
-            git checkout "$LATEST_TAG"
+            exit 0
+          fi
 
-            popd > /dev/null
-            rm -rf "$TEMP_DIR"
-
-            git add "$SUBMODULE_PATH"
+          ####################################################################
+          # CASE 2: Newer tag exists → PR will be rewritten
+          ####################################################################
+          NEW_PR_TITLE="Bump ${SUBMODULE_PATH} from ${SUBMODULE_TAG:-unknown} to ${LATEST_TAG}"
 
-            SHOULD_FORCE_PUSH=true
-            SHOULD_COMMIT=true
+          gh pr edit "$PR_NUMBER" \
+            --repo "$REPO" \
+            --title "$NEW_PR_TITLE"
 
-            ##################################################################
-            # Commit changes if needed.
-            ##################################################################
-            if [ "$SHOULD_COMMIT" = true ]; then
+          echo "Updating .gitmodules to latest tag: $LATEST_TAG"
 
-                git add .gitmodules
+          git config -f .gitmodules \
+            "submodule.${SUBMODULE_PATH}.tag" \
+            "$LATEST_TAG"
 
-                git commit -m "Align submodules with latest release tags" || \
-                echo "No changes to commit"
+          git add .gitmodules
 
-            else
-                echo "No repository changes required."
-                exit 0
-            fi
+          ####################################################################
+          # CASE 2A: Dependabot already at tag commit → no rewrite needed
+          ####################################################################
+          if [ "$CURRENT_SUBMODULE_COMMIT" = "$LATEST_TAG_COMMIT" ]; then
 
-            ##################################################################
-            # Push changes back into the Dependabot PR branch.
-            #
-            # Force push only if we rewrote the submodule gitlink commit.
-            ##################################################################
-            if [ "$SHOULD_FORCE_PUSH" = true ]; then
+            echo "Dependabot already at tag commit. Only .gitmodules updated."
 
-                echo "Force-pushing rewritten Dependabot branch"
+          ####################################################################
+          # CASE 2B: Need to rewrite submodule to tag commit
+          ####################################################################
+          else
 
-                git push origin \
-                HEAD:"$PR_BRANCH" \
-                --force
+            echo "Rewriting submodule to tag commit..."
 
-            else
+            gh pr comment "$PR_NUMBER" \
+              --repo "$REPO" \
+              --body "$(cat <<EOF
+            Workflow "$GITHUB_WORKFLOW" rewrote this submodule update to use the latest release tag.
+
+            - Previous tag: \`${SUBMODULE_TAG}\`
+            - New tag: \`${LATEST_TAG}\`
+            - Dependabot commit: \`${CURRENT_SUBMODULE_COMMIT}\`
+            - Tag commit: \`${LATEST_TAG_COMMIT}\`
+            EOF
+            )"
 
-                echo "Pushing normal commit to Dependabot branch"
+            git submodule update --init --recursive "$SUBMODULE_PATH"
+            pushd "$SUBMODULE_PATH" > /dev/null
 
-                git push origin \
-                HEAD:"$PR_BRANCH"
+            git checkout "$LATEST_TAG"
 
-            fi
+            popd > /dev/null
 
-      ######################################################################
-      # Final status output
-      ######################################################################
-      - name: Done
-        run: |
-          echo "Submodule tag enforcement completed."
+            git add "$SUBMODULE_PATH"
+          fi
+
+          ####################################################################
+          # Commit result (always single commit if changes exist)
+          ####################################################################
+          if git diff --cached --quiet; then
+            echo "No changes to commit."
+            exit 0
+          fi
+
+          git commit -m "$NEW_PR_TITLE"
+
+          ####################################################################
+          # Push result back to Dependabot PR branch
+          ####################################################################
+          git push origin HEAD:"$PR_BRANCH"
\ No newline at end of file

From 9dbe028231ce9663675419029505877aa41d7ce8 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Wed, 20 May 2026 11:41:58 -0700
Subject: [PATCH 3/8] Update the detect submdule changes logic

---
 .github/workflows/dependabot-submodule-tag-alignment.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependabot-submodule-tag-alignment.yml b/.github/workflows/dependabot-submodule-tag-alignment.yml
index 737b80dc7cd78..ebb7962afc141 100644
--- a/.github/workflows/dependabot-submodule-tag-alignment.yml
+++ b/.github/workflows/dependabot-submodule-tag-alignment.yml
@@ -84,8 +84,13 @@ jobs:
           ####################################################################
           # Detect submodule changes in this PR
           ####################################################################
-          CHANGED_SUBMODULES=$(git diff --submodule=short "$BASE_SHA" "$HEAD_SHA" \
-            | grep '^Submodule ' | awk '{print $2}')
+          CHANGED_SUBMODULES=$(
+          git diff --name-only "$BASE_SHA" "$HEAD_SHA" \
+              | while read -r path; do
+                  git ls-tree "$HEAD_SHA" "$path" \
+                  | awk '$1 == "160000" {print $4}'
+              done
+          )
 
           if [ -z "$CHANGED_SUBMODULES" ]; then
             echo "No changed submodules detected."

From 2592c55439a5fd62dfb626b698b0de6e65be2ac4 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Wed, 20 May 2026 14:06:17 -0700
Subject: [PATCH 4/8] Avoid using heredoc in workflow

---
 .../dependabot-submodule-tag-alignment.yml    | 51 +++++++++----------
 1 file changed, 24 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/dependabot-submodule-tag-alignment.yml b/.github/workflows/dependabot-submodule-tag-alignment.yml
index ebb7962afc141..1d815b6c52c52 100644
--- a/.github/workflows/dependabot-submodule-tag-alignment.yml
+++ b/.github/workflows/dependabot-submodule-tag-alignment.yml
@@ -106,21 +106,20 @@ jobs:
           SUBMODULE_COUNT=$(echo "$CHANGED_SUBMODULES" | wc -w)
 
           if [ "$SUBMODULE_COUNT" -gt 1 ]; then
-
             echo "ERROR: Multiple submodules detected."
 
             gh pr comment "$PR_NUMBER" \
               --repo "$REPO" \
-              --body "$(cat <<EOF
-            Workflow "$GITHUB_WORKFLOW" expected exactly one submodule update in this Dependabot PR, but found multiple:
-
-            \`\`\`
-            $CHANGED_SUBMODULES
-            \`\`\`
+              --body "$(printf '%s\n' \
+                "Workflow \"$GITHUB_WORKFLOW\" expected exactly one submodule update in this Dependabot PR, but found multiple:" \
+                "" \
+                '```' \
+                "$CHANGED_SUBMODULES" \
+                '```' \
+                "" \
+                "This PR was left unchanged for manual review."
+              )"
 
-            This PR was left unchanged for manual review.
-            EOF
-            )"
             exit 1
           fi
 
@@ -189,14 +188,13 @@ jobs:
 
             gh pr comment "$PR_NUMBER" \
               --repo "$REPO" \
-              --body "$(cat <<EOF
-            Workflow "$GITHUB_WORKFLOW" closed this PR because the submodule is already pinned to the latest release tag:
-
-            - Tag: \`$LATEST_TAG\`
-
-            @dependabot ignore this
-            EOF
-            )"
+              --body "$(printf '%s\n' \
+                "Workflow \"$GITHUB_WORKFLOW\" closed this PR because the submodule is already pinned to the latest release tag:" \
+                "" \
+                "- Tag: \`$LATEST_TAG\`" \
+                "" \
+                "@dependabot ignore this"
+              )"
 
             gh pr close "$PR_NUMBER" --repo "$REPO"
 
@@ -236,15 +234,14 @@ jobs:
 
             gh pr comment "$PR_NUMBER" \
               --repo "$REPO" \
-              --body "$(cat <<EOF
-            Workflow "$GITHUB_WORKFLOW" rewrote this submodule update to use the latest release tag.
-
-            - Previous tag: \`${SUBMODULE_TAG}\`
-            - New tag: \`${LATEST_TAG}\`
-            - Dependabot commit: \`${CURRENT_SUBMODULE_COMMIT}\`
-            - Tag commit: \`${LATEST_TAG_COMMIT}\`
-            EOF
-            )"
+              --body "$(printf '%s\n' \
+                "Workflow \"$GITHUB_WORKFLOW\" rewrote this submodule update to use the latest release tag." \
+                "" \
+                "- Previous tag: \`${SUBMODULE_TAG}\`" \
+                "- New tag: \`${LATEST_TAG}\`" \
+                "- Dependabot commit: \`${CURRENT_SUBMODULE_COMMIT}\`" \
+                "- Tag commit: \`${LATEST_TAG_COMMIT}\`"
+              )"
 
             git submodule update --init --recursive "$SUBMODULE_PATH"
             pushd "$SUBMODULE_PATH" > /dev/null

From 6a6bec5d7a91312f06529c1d872570274999a5e9 Mon Sep 17 00:00:00 2001
From: Carson Tam <carson.tam@ucsf.edu>
Date: Wed, 20 May 2026 10:22:25 -0700
Subject: [PATCH 5/8] Test: Added sample-repository, v1.0

---
 .gitmodules       | 6 ++++++
 sample-repository | 1 +
 2 files changed, 7 insertions(+)
 create mode 160000 sample-repository

diff --git a/.gitmodules b/.gitmodules
index 374ce84fab543..badc2924435de 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -198,3 +198,9 @@
 	url = https://github.com/ucsf-education/moodle-theme-ucsf
 	branch = MOODLE_501_STABLE
 	tag = v5.1.2
+[submodule "sample-repository"]
+	path = sample-repository
+	url = https://github.com/ctam/sample-repository
+	branch = main
+	tag = v1.0
+
diff --git a/sample-repository b/sample-repository
new file mode 160000
index 0000000000000..aa6a25a7949f2
--- /dev/null
+++ b/sample-repository
@@ -0,0 +1 @@
+Subproject commit aa6a25a7949f2f6a79b697037cf4d8c8f04e5e87

From 00db8251114cc5465fa2366876edab66ce79d779 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 17:29:19 +0000
Subject: [PATCH 6/8] Bump public/local/oauthredirect from `8a4f791` to
 `386dc65`

Bumps [public/local/oauthredirect](https://github.com/ucsf-education/moodle-local_oauthredirect) from `8a4f791` to `386dc65`.
- [Commits](https://github.com/ucsf-education/moodle-local_oauthredirect/compare/8a4f79112ddf428dba26e7152fe8c8c833c5a986...386dc65eee4639d46c18d8f0d5eb250298afebd4)

---
updated-dependencies:
- dependency-name: public/local/oauthredirect
  dependency-version: 386dc65eee4639d46c18d8f0d5eb250298afebd4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 public/local/oauthredirect | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/local/oauthredirect b/public/local/oauthredirect
index 8a4f79112ddf4..386dc65eee463 160000
--- a/public/local/oauthredirect
+++ b/public/local/oauthredirect
@@ -1 +1 @@
-Subproject commit 8a4f79112ddf428dba26e7152fe8c8c833c5a986
+Subproject commit 386dc65eee4639d46c18d8f0d5eb250298afebd4

From 9c4700c8b92e02332107e18be572d6bdadb9ecf4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 21:11:28 +0000
Subject: [PATCH 7/8] Bump public/mod/questionnaire from `14585c8` to `4ce82ef`

Bumps [public/mod/questionnaire](https://github.com/PoetOS/moodle-mod_questionnaire) from `14585c8` to `4ce82ef`.
- [Release notes](https://github.com/PoetOS/moodle-mod_questionnaire/releases)
- [Commits](https://github.com/PoetOS/moodle-mod_questionnaire/compare/14585c89e2d983d7be640f4d943e9de7a31d7a58...4ce82ef59b7c001ae9426f1d70549e2e74acb931)

---
updated-dependencies:
- dependency-name: public/mod/questionnaire
  dependency-version: 4ce82ef59b7c001ae9426f1d70549e2e74acb931
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 public/mod/questionnaire | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/mod/questionnaire b/public/mod/questionnaire
index 14585c89e2d98..4ce82ef59b7c0 160000
--- a/public/mod/questionnaire
+++ b/public/mod/questionnaire
@@ -1 +1 @@
-Subproject commit 14585c89e2d983d7be640f4d943e9de7a31d7a58
+Subproject commit 4ce82ef59b7c001ae9426f1d70549e2e74acb931

From a8109a511b871df4dd7e1f5defbf429f306e8091 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 20 May 2026 21:17:57 +0000
Subject: [PATCH 8/8] Bump public/mod/questionnaire from v5.0.1 to v5.0.2

---
 .gitmodules | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index badc2924435de..045aa8d021efb 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -150,7 +150,7 @@
 	path = public/mod/questionnaire
 	url = https://github.com/PoetOS/moodle-mod_questionnaire
 	branch = MOODLE_500_STABLE
-	tag = v5.0.1
+	tag = v5.0.2
 [submodule "public/mod/quiz/report/archive"]
 	path = public/mod/quiz/report/archive
 	url = https://github.com/bfh/moodle-quiz_archive