How do I check if a submodule changed commit against the source branch?

[vib-etched]

I'm using this action to get what files have changed when running a CI job. How does one check if the Submodule commit hash itself has changed?

My PR has the following change:
Submodule sw updated from f8e803 to 932876

I have tried this out by setting "exclude_submodules: false" in the action inputs. The submodule itself does not show up in the all_changed_files output.

Any help would be appreciated!

[jackton1]

HI @vib-etched, here’s how you can check for changes in a submodule path.

name: Check Submodule Changes

on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

jobs:
  check-submodule-changes:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Fetch full history
          submodules: true  # Ensure submodules are included=

      - name: Get changed files including submodules
        id: changed-files
        uses: tj-actions/changed-files@v44
        # No need to set `exclude_submodules` as it defaults to `false`

      - name: Check if submodule changed
        run: |
          echo "${{ steps.changed-files.outputs.all_changed_files }}"
          if echo "${{ steps.changed-files.outputs.all_changed_files }}" | grep -q 'submodule-path'; then
            echo "Submodule has changed."
          else
            echo "No changes in submodule."
          fi

[vib-etched]

Thanks Tonye,

This is what happens when I try out something similar.

- name: Add SSH private keys for submodule repositories
        uses: webfactory/[email protected]
        with:
          ssh-private-key: ${{ secrets.MACHINE_USER_TOKEN }}
     
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - name: Checkout repo
        uses: actions/checkout@v4
        with:
          fetch-depth: 2
          submodules: true
      - name: Determine changed files
        id: changed-files
        uses: tj-actions/changed-files@v44
        with:
          exclude_submodules: false

I see the following error message on checkout

Error: Failed to fetch pull request branch. Please ensure "persist-credentials" is set to "true" when checking out the repository. See: https://github.com/actions/checkout#usage

I suspect this is not using the correct ssh credentials when git fetching the submodule, is there a way to force ssh-based fetching in the action?

We do something like this in our github workflow to force an ssh checkout on some actions:
sed -rie 's,https://github\.com,ssh://[email protected],' .gitmodules

[prabhukiran9999]

@vib-etched
I think right now the only option is to fetch submodules in a separate step and the main repo separate. As when you use submodules: true. It tries to get the submodule and lacks permissions. It's unfortunate that this action depends on checking out repo with submodules: true flag

[jackton1]

@prabhukiran9999 I believe you can exclude submodules if that's is not a requirement for your use case with the exclude_submodules input set to true.

[prabhukiran9999]

Thanks @jackton1 . My use case is that I want to trigger certain actions on based on submodule changes. The files changed usually looks like Submodule updated [from fc9d9c to 5ad9a8].
We usually checkout our code in the actions like below

`  - name: Add SSH private keys for submodule repositories
    uses: webfactory/[email protected]
    with:
      ssh-private-key: |
        ${{ secrets.SSH_PRIVATE_KEY_SUBMODULE }}

  - name: Checkout repository
    uses: actions/checkout@v4
    
  - name: Checkout submodules
    run: |
      git submodule foreach 'git rev-parse HEAD > /dev/null 2>&1 || rm -rf $PWD'
      git submodule sync --recursive
      git submodule update --init --recursive --depth=1
      cd source
      git rev-parse HEAD
      cd ..
      `

This way we can check out the private submodule. We cannot check it out with the actions/checkout@v4 with submodules: true as it would lack permissions to the private submodule. When checking out the submodule this way, the condition ${{ steps.changed-files.outputs.all_changed_files }}" | grep -q 'submodule-path' is not working.

[jackton1]

Can you share the full code with the condition?

[prabhukiran9999]

Sure, Below is the code

    steps:
      - name: Configure Git
        run: |
          git config --global url.https://${{ secrets.TF_GH_TOKEN }}@github.com/.insteadOf https://github.com/                    
        
      - name: Add SSH private keys for submodule repositories
        uses: webfactory/[email protected]
        with:
          ssh-private-key: |
            ${{ secrets.SSH_PRIVATE_KEY_SUBMODULE }}

      - name: Checkout repository
        uses: actions/checkout@v4
        
      - name: Checkout submodules
        run: |
          git submodule foreach 'git rev-parse HEAD > /dev/null 2>&1 || rm -rf $PWD'
          git submodule sync --recursive
          git submodule update --init --recursive --depth=1
          cd source
          git rev-parse HEAD
          cd ..
          
      - name: Check for modification to source(Source is the name of the submodule directory)
        id: modified-source
        uses: tj-actions/changed-files@v45
        
      - name: check  if submodule is modified
        run: |
          if echo "${{ steps.changed-files.outputs.modified-source }}" | grep -q 'submodule-path'; then
            echo "source was modified"
            cd projects
            terragrunt run-all init -upgrade --terragrunt-non-interactive --terragrunt-parallelism 5
            terragrunt run-all plan --terragrunt-non-interactive --terragrunt-parallelism 5
          else
            echo "No changes in submodule."
          fi
          

[jackton1]

@vib-etched Have you tried passing ssh-key to the checkout action. See: https://github.com/actions/checkout#usage