From 255292dce64878663d0c311f1389527d566c9df0 Mon Sep 17 00:00:00 2001
From: kazmosahebi <kazmosahebi@hypersec.io>
Date: Tue, 9 Jun 2026 22:31:31 +1000
Subject: [PATCH] fix: add optional submodules input to python-ci

Adds an optional 'submodules' input to the reusable python-ci workflow. When set (e.g. submodules: schemas), the test job runs git submodule update --init for the named paths after checkout, so tests that read submodule content can resolve it. Defaults to empty -- a no-op for every current consumer.

Motivated by dfe-engine: its schema-profile tests resolve from the schemas submodule (common-header/*.yaml) and otherwise fall back to stale bundled profiles, failing CI. Works for a public submodule with the default GITHUB_TOKEN; private submodules still need skipif or a cross-repo token.

Reconciles docs/LESSONS.md: skipif for private submodules, the submodules input for public ones.

Refs #39
---
 .github/workflows/python-ci.yml | 10 ++++++++++
 docs/LESSONS.md                 | 10 +++++++---
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index 1990690..cf53b5c 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -52,6 +52,10 @@ on:
         type: string
         default: "auto"
         description: "Version resolution for from-head: auto | patch | minor (forced)."
+      submodules:
+        type: string
+        default: ""
+        description: "Space-separated submodule paths to init after checkout (e.g. 'schemas'). Empty (default) inits nothing. The submodule must be reachable by the job token -- public, or a token with cross-repo read access."
     secrets:
       JFROG_TOKEN:
         required: false
@@ -232,6 +236,12 @@ jobs:
       - name: Install dependencies
         run: uv sync --frozen --all-extras
 
+      - name: Init submodules
+        if: ${{ inputs.submodules != '' }}
+        env:
+          SUBMODULES: ${{ inputs.submodules }}
+        run: git submodule update --init --depth 1 $SUBMODULES
+
       - name: Run tests
         run: ${{ env.HYPERCI_INSTALL }} run test
 
diff --git a/docs/LESSONS.md b/docs/LESSONS.md
index a8482c7..a52897e 100644
--- a/docs/LESSONS.md
+++ b/docs/LESSONS.md
@@ -299,9 +299,13 @@ build to ensure fresh artifacts, also via `hyperi-ci run build`.
 - Detection: directory-based > marker-based > conftest-based
 - Coverage: separate `.coverage.<tier>` files, combine at end
 - No test directory: exit 0 (graceful skip)
-- Private submodules (e.g. `dfe-schemas`): mark dependent tests with
-  `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`
-  rather than trying to check out private submodules in CI (GITHUB_TOKEN can't)
+- Submodule-dependent tests:
+  - Public submodule: set the `submodules` input on the reusable workflow
+    (e.g. `submodules: schemas`) so CI checks it out and the tests run.
+  - Private submodule (e.g. `dfe-schemas` while private): GITHUB_TOKEN can't
+    clone it, so mark dependent tests with
+    `@pytest.mark.skipif(not schemas_dir.exists(), reason="submodule not checked out")`
+    rather than checking it out in CI (or wire a cross-repo token).
 
 ### Publishing