Why does GitHub not analyze git submodules for dependencies?

The article https://help.github.com/en/github/visualizing-repository-data-with-graphs/listing-the-projects-that-depend-on-a-repository describes how dependencies are analyzed by github:

The dependents graph contains data for these languages:

  • RubyGems
  • NPM
  • PyPI
  • Maven (pom.xml only)
  • Nuget

So where are git submodules in that list, especially if they point obviously at github itself? Seems like a quite major oversight, will this be implemented soon?

2 Likes

Hey @etc0de, Welcome to the GitHub Community forum!

To my understanding, it is because a git submodule is not always and by default pointing to an external dependency. While that’s certainly a use, it is not a steadfast requirement as some of the others you mentioned below.

So you’re saying it is common to put git submodules without using them?

The thing is, if I put a git submodule then I can’t even check out the full repo properly without it so I don’t understand how that is not a hard dependency. Now whether it’s actually used at runtime by the software, how do you know it is just because it appears in Maven, NPM, …? It is possible to list things in there too that aren’t actually made use of.

In the end I think this should come down to why people usually add git submodules. I think it’s rare that people put them and they’re not a build & runtime dependency. And it would add a lot to have those dependencies mapped out as well, since it’s the universal way to put dependencies when not using a package manager. (GitHub could still ignore git submodules and prefer the package manager files if any recognized ones are present.)

So any chance this will be changed?

@logankilpatrick - I’m not sure the argument stands on its own legs. As @etc0de has stated, you cannot make the “if it’s a dependency, it must be used” in nearly every language.

Would it be possible to make submodules a dependency type for those who would like to see this functionality? I’d be all for being a guinea pig :slight_smile: