The idfkit bump workflow commits the governance checkout as a submodule #25

What happens

Every pull request bump-idfkit.yml opens carries a governance gitlink at mode 160000, with no .gitmodules entry beside it. Both open bumps had it: #21 and #23, both at a3dddc36. Nothing on main has ever carried it.

Why

The workflow checks out idfkit/idfkit-conformance into governance/ at the pinned level, so adoption_statements.py can read parity.toml:

- name: Check out the conformance repository at the pinned governance level
  uses: actions/checkout@v4
  with:
    repository: idfkit/idfkit-conformance
    ref: ${{ steps.pin.outputs.governance }}
    path: governance

It then opens the pull request with peter-evans/create-pull-request@v7 and no add-paths, which stages every change in the working tree. The nested checkout is one of them.

Why it matters

Merged as it stands, main gains a submodule reference that resolves for nobody: no .gitmodules, so a fresh clone gets an empty directory where a reader expects a repository. Every later bump then carries it forward, because the gitlink is tracked from then on.

Nothing reads it. The governance tag is pinned in pyproject.toml and fetched at build time by scripts/_governance_source.py. The checkout is a build-time convenience and belongs in the runner's filesystem, not in the history.

Suggested fix

Either constrain what the action stages:

add-paths: |
  pyproject.toml
  uv.lock

or add governance/ to .gitignore, which also protects anyone running the same steps locally. add-paths is the narrower of the two and states in the workflow what an unattended bump is allowed to change.

Already done

Removed by hand from #23 before merge; #21 closed as superseded with a note. The workflow is unchanged, so the next bump reproduces it.