Enforce offical Tooling

Author: SteveLLamb

workflows/action.yml

@@ -11,6 +11,15 @@ inputs:
     required: true
   GITHUB_TOKEN:
     required: true
+  OFFICIAL_SUBMODULE_PATH:
+    required: false
+    default: tooling
+  OFFICIAL_SUBMODULE_URL:
+    required: false
+    default: https://github.com/SMPTE/html-pub.git
+  OFFICIAL_SUBMODULE_BRANCH:
+    required: false
+    default: main
 
 runs:
   using: "composite"
@@ -20,6 +29,63 @@ runs:
       shell: bash
       run: cmp ${GITHUB_ACTION_PATH}/../.github/workflows/main.yml .github/workflows/main.yml
 
+    - name: Enforce official submodule lock
+      shell: bash
+      env:
+        SUB_PATH: ${{ inputs.OFFICIAL_SUBMODULE_PATH }}
+        OFFICIAL_URL: ${{ inputs.OFFICIAL_SUBMODULE_URL }}
+        OFFICIAL_BRANCH: ${{ inputs.OFFICIAL_SUBMODULE_BRANCH }}
+      run: |
+        set -euo pipefail
+
+        if [[ -z "${SUB_PATH:-}" ]]; then
+          echo "ERROR: SUB_PATH is empty"; exit 1
+        fi
+
+        if [[ ! -f ".gitmodules" ]]; then
+          echo "ERROR: .gitmodules not found. This repository must declare the '${SUB_PATH}' submodule."
+          exit 1
+        fi
+
+        URL_IN_MODULES=$(git config -f .gitmodules --get "submodule.${SUB_PATH}.url" || true)
+        if [[ "$URL_IN_MODULES" != "$OFFICIAL_URL" ]]; then
+          echo "ERROR: ${SUB_PATH} URL in .gitmodules is '$URL_IN_MODULES' but must be '$OFFICIAL_URL'"
+          exit 1
+        fi
+
+        RECORDED_SHA=$(git ls-tree HEAD "$SUB_PATH" | awk '{print $3}')
+        if [[ -z "${RECORDED_SHA:-}" ]]; then
+          echo "ERROR: No submodule commit recorded for ${SUB_PATH}. Did you add and commit the submodule?"
+          exit 1
+        fi
+
+        OFFICIAL_SHA=$(git ls-remote "$OFFICIAL_URL" "refs/heads/$OFFICIAL_BRANCH" | awk '{print $1}')
+        if [[ -z "${OFFICIAL_SHA:-}" ]]; then
+          echo "ERROR: Could not read '$OFFICIAL_BRANCH' from '$OFFICIAL_URL'"
+          exit 1
+        fi
+
+        echo "Recorded(${SUB_PATH}): $RECORDED_SHA"
+        echo "Official ($OFFICIAL_BRANCH): $OFFICIAL_SHA"
+
+        if [[ "$RECORDED_SHA" != "$OFFICIAL_SHA" ]]; then
+          cat <<'MSG'
+ERROR: Submodule is not on latest official main.
+
+To fix locally:
+  git submodule update --init --remote -- "${SUB_PATH}"
+  # or explicitly:
+  cd "${SUB_PATH}"
+  git fetch origin "${OFFICIAL_BRANCH}"
+  git checkout --detach "origin/${OFFICIAL_BRANCH}"
+  cd -
+  git add "${SUB_PATH}"
+  git commit -m "Bump ${SUB_PATH} to latest ${OFFICIAL_BRANCH}"
+
+MSG
+          exit 1
+        fi
+
     - name: Install vnu
       shell: bash
       run: sudo pip install html5validator==0.4.2