beman-submodule
A pseudo-submodule tool for vendoring Git repositories in Beman projects.
What is beman-submodule?
beman-submodule provides some of the features of git submodule, adding child git
repositories to a parent git repository, but unlike with git submodule, the entire child
repo is directly checked in, so only maintainers, not users, need to run this script. The
command line interface mimics git submodule's.
Installation
pip install beman-submodule
Or with uv:
uv tool install beman-submodule
Usage
Adding a beman submodule
beman-submodule add https://github.com/bemanproject/infra.git
This will clone the repository and create a .beman_submodule file tracking the remote and commit.
You can also specify a custom path:
beman-submodule add https://github.com/bemanproject/infra.git infra/
Updating beman submodules
Update all beman submodules to match their .beman_submodule configuration:
beman-submodule update
Update all beman submodules to the latest from upstream:
beman-submodule update --remote
Update only a specific submodule:
beman-submodule update --remote infra/
Checking status
Show the status of all beman submodules:
beman-submodule status
A + prefix indicates the submodule contents differ from the configured commit.
How does it work?
Along with the files from the child repository, it creates a dotfile called
.beman_submodule, which looks like this:
[beman_submodule]
remote=https://github.com/bemanproject/infra.git
commit_hash=9b88395a86c4290794e503e94d8213b6c442ae77
Updating to a specific commit or changing the remote URL
Edit the corresponding lines in the .beman_submodule file and run
beman-submodule update to update the state of the beman submodule to the new
settings.
Allow untracked files
If you need to add local files alongside the vendored content, use:
beman-submodule add --allow-untracked-files https://github.com/example/repo.git path/
This adds allow_untracked_files=True to the .beman_submodule config, preserving local
files during updates.
CI Integration
Add this job to your CI workflow to ensure beman submodules are in a valid state:
beman-submodule-test:
runs-on: ubuntu-latest
name: "Check beman submodules for consistency"
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Install beman-submodule
run: pip install beman-submodule
- name: beman submodule consistency check
run: |
(set -o pipefail; beman-submodule status | grep -qvF '+')
This will fail if the contents of any beman submodule don't match what's specified in the
.beman_submodule file.
Development
This project uses uv for development:
# Install dependencies
uv sync --group dev
# Run tests
uv run pytest
# Run linter
uv run ruff check .
# Format code
uv run ruff format .
License
Apache-2.0 WITH LLVM-exception
Metadata
Release files for beman-submodule 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| beman_submodule-0.1.0.tar.gz | 9.4 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| beman_submodule-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 20.5 kB
Release files / beman_submodule-0.1.0.tar.gz
| Download URL | beman_submodule-0.1.0.tar.gz |
|---|---|
| Size | 9.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d26eb6646a50d53a5f6334e7afca6d44362252efbeaf81acfc335912f1340410
|
|
BLAKE2b-256 checksum How to use checksums |
5376f2c3f0c22c1ab4a304a781a10cfe92960a9850a439e4b7f460c99cad18f7
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logRelease files / beman_submodule-0.1.0-py3-none-any.whl
| Download URL | beman_submodule-0.1.0-py3-none-any.whl |
|---|---|
| Size | 11.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
ef1e354291c89c2ae59b5b12ad1f5f76c66520a21b280192207f57c19359c4d8
|
|
BLAKE2b-256 checksum How to use checksums |
6723212d261d7c1ae723a76f6c66616b0419c1ac92a987973a60cd1347c52785
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.7
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logSecurity for beman-submodule 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for beman_submodule-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.