Follow-up from #1448 (Bob's automated reviewer, P1-as-hardening).
The nightly resolver builds its first-party list as git submodule --quiet foreach 'echo $sm_path' | grep -vx awatcher and then runs git submodule update --remote --recursive -- $firstparty. --recursive moves nested submodules of those parents to their upstream tips too, and the name filter only knows top-level awatcher. Today every nested submodule is ActivityWatch-org (aw-webui under aw-server/aw-server-rust/aw-tauri, media under aw-qt and each aw-webui), so nothing third-party moves — but the boundary is a list, not a property.
Make it a property: walk .gitmodules recursively and treat a submodule as first-party iff its URL is under github.com/ActivityWatch/ (case-insensitive); apply --remote per level only to those, leave the rest at their recorded revisions, and print the excluded set in the job log so the boundary is visible in every run.
Not blocking #1448: the nightly never publishes, and the current tree has no nested third-party submodule.
Follow-up from #1448 (Bob's automated reviewer, P1-as-hardening).
The nightly resolver builds its first-party list as
git submodule --quiet foreach 'echo $sm_path' | grep -vx awatcherand then runsgit submodule update --remote --recursive -- $firstparty.--recursivemoves nested submodules of those parents to their upstream tips too, and the name filter only knows top-levelawatcher. Today every nested submodule is ActivityWatch-org (aw-webuiunder aw-server/aw-server-rust/aw-tauri,mediaunder aw-qt and each aw-webui), so nothing third-party moves — but the boundary is a list, not a property.Make it a property: walk
.gitmodulesrecursively and treat a submodule as first-party iff its URL is undergithub.com/ActivityWatch/(case-insensitive); apply--remoteper level only to those, leave the rest at their recorded revisions, and print the excluded set in the job log so the boundary is visible in every run.Not blocking #1448: the nightly never publishes, and the current tree has no nested third-party submodule.