How do you stop a user from committing to a submodule in git?

Question

Let's say you have a parent project and submodule.

There is a user who has read/write permission to the parent project but only read permission for the submodule.

How do you stop the user from making a change to the submodule and committing it and then subsequently committing and pushing the updated reference to this new commit in the parent project?

The user will not be able to push their changes to the submodule as they do not have permission. When another user now pulls down the parent project they will have a reference to a submodule commit that has not been pushed up to the server.

Answer 1

There are two solutions:

1. tell your user to use the new --recurse-submodules=check option when pushing
2. or set up a server-side hook that checks for the new submodule check, in this answer