Hardware FixRecommendedDevice not working? Your driver may be the problemCheck updates for common hardware issues.Fix DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
World desk5 min

Growing Pains with Five Repositories: Gitlinks and Dual CI

Git submodules pin commits, not copied files. Learn how to initialize them in CI, authorize private dependencies, handle nested submodules, and coordinate two CI systems without letting builds drift.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a multi-repository project, make each build use the exact dependency commits recorded by its superproject, then configure every CI system to fetch those submodules with credentials that can read them. A Git submodule is not a copied directory: its gitlink pins a commit in another repository. That distinction is central to keeping builds reproducible when multiple repositories and CI systems are involved.

What a gitlink records—and what it does not

A submodule is a separate Git repository checked out beneath a superproject. The superproject’s tree contains a gitlink: an object name identifying the commit expected at that path. The submodule keeps its own history; its files and commits are not copied into the superproject’s history. Git describes the gitlink as the commit the superproject expects the submodule’s working directory to be at (Git: gitsubmodules).

As an Amazon Associate I earn from qualifying purchases.

The .gitmodules file maps a submodule’s logical name to its working-tree path and default clone URL. Relative URLs are resolved against the superproject’s origin, which can be convenient when related repositories move together. In a fork, however, that origin may change the resolution; GitLab recommends using absolute URLs when fork workflows are expected (GitLab: Using Git submodules in CI/CD).

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why an ordinary checkout may leave dependencies missing

Checking out the superproject does not by itself guarantee that submodule working trees are populated. Run git submodule update --init to initialize and check out the commit recorded by the superproject. By default, Git uses that recorded commit rather than the latest commit on a remote branch; the submodule will commonly be in a detached-HEAD state. Git documents the initialization and update behavior in its git-submodule reference.

That detached state is useful for builds: it makes the checked-out dependency match the superproject’s recorded version. It is not the right place to casually develop a change. Make and publish the change in the submodule repository, then update and commit the gitlink in the superproject.

Update a submodule without losing the pin

  1. Enter the submodule and switch to an appropriate branch, or create one: cd path/to/submodule && git switch -c my-change.
  2. Make the change, commit it, and push that commit to the submodule’s remote.
  3. Return to the superproject and stage the submodule path: cd ../.. && git add path/to/submodule.
  4. Commit and push the superproject change. That commit records the new gitlink, allowing CI and other developers to check out the same dependency revision.

Git’s Pro Git submodule chapter provides further background on this workflow.

Make CI checkout match the recorded dependency commits

CI checkout has two distinct requirements: initialize the submodules, and authenticate to every repository that must be read. A provider’s “fetch submodules” setting handles the first only if the selected mode includes the dependencies you need. It does not automatically grant access to private repositories. If a submodule contains another submodule, configure recursive initialization and verify the behavior for the specific provider action or runner version in use.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Reproducibility: build the gitlink commit recorded in the superproject, not a branch’s latest remote commit.
  • Credentials: authorize the job to read each private dependency; a token that can read the current repository may not reach another one.
  • Depth: if using shallow clones, configure submodule depth separately where the provider supports it.
  • Runner isolation: avoid credentials or Git settings persisting between jobs on shared shell executors.

GitLab CI/CD: choose the submodule strategy and access

GitLab Runner uses GIT_SUBMODULE_STRATEGY to control initialization. Set it to normal for top-level submodules and recursive when nested submodules must also be initialized. GitLab also documents GIT_SUBMODULE_DEPTH, GIT_SUBMODULE_PATHS, and GIT_SUBMODULE_UPDATE_FLAGS; the submodule depth is independent of the main repository’s GIT_DEPTH. The --jobs update flag can fetch submodules in parallel. Consult the current GitLab Runner submodule configuration for supported settings and runner-version details.

For a private submodule fetched with CI_JOB_TOKEN, the upstream project must permit job-token access, and the user who triggered the job must have an appropriate role. A job token from one GitLab instance cannot authenticate to a submodule on another instance; use a credential authorized to read that external repository and store it as a protected, masked CI variable. Follow the current runner guidance for credentials used by Git commands inside submodule directories, since externalized credentials may not automatically carry into subsequent commands. Avoid persistent global credential changes on shell executors, where settings can affect later jobs.

GitHub Actions: checkout options do not expand token scope

The official actions/checkout action accepts submodules: true for submodules or submodules: recursive when nested dependencies are required. Its documentation says that github.token is scoped to the current repository. Private or internal secondary repositories therefore need the documented separate credential option and a token with suitable access. Check the exact action version, token permissions, and repository policy used by the workflow in the actions/checkout documentation.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Keep two CI systems coordinated without assuming one topology

“Dual CI” does not tell you whether both systems build every repository, one validates while another deploys, or each repository owns its own pipeline. There is no universal configuration implied by a project using five repositories. Decide and document these responsibilities before wiring triggers:

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Which repository owns each component, and which repositories depend on it?
  • Which CI system is authoritative for each test, build, or deployment check?
  • What change triggers a run in another repository or CI system?
  • How are the exact gitlink commits that passed testing promoted together?

A superproject commit can provide a record of a tested combination of dependency commits. Whether that should be the promotion unit depends on the project’s release and ownership model; independent repositories may still have their own release processes. Whatever the arrangement, ensure each system tests the intended recorded revisions rather than silently following moving remote heads.

Why following a remote branch can undermine repeatability

GitLab documents the risk of using --remote to update submodules: it follows a remote branch rather than simply using the commit pinned by the superproject. That can make a later build use a different dependency without a corresponding superproject change. For most builds, GitLab recommends explicitly tracking submodule commits and updating them deliberately, for example with dependency automation (GitLab Runner configuration).

Use deliberate gitlink updates when you want a reviewable change that records which dependency revision was tested. If a workflow intentionally tracks a branch head, treat that as a different policy: document it, make the resulting revision visible in the build record, and do not confuse it with a build pinned solely by the superproject.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
Windows Errors? Fix Them Before They SpreadFree repair scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.