Skip to main content

beman-submodule

A pseudo-submodule tool for vendoring Git repositories in Beman projects.

What is beman-submodule?

beman-submodule provides some of the features of git submodule, adding child git repositories to a parent git repository, but unlike with git submodule, the entire child repo is directly checked in, so only maintainers, not users, need to run this script. The command line interface mimics git submodule's.

Installation

pip install beman-submodule

Or with uv:

uv tool install beman-submodule

Usage

Adding a beman submodule

beman-submodule add https://github.com/bemanproject/infra.git

This will clone the repository and create a .beman_submodule file tracking the remote and commit.

You can also specify a custom path:

beman-submodule add https://github.com/bemanproject/infra.git infra/

Updating beman submodules

Update all beman submodules to match their .beman_submodule configuration:

beman-submodule update

Update all beman submodules to the latest from upstream:

beman-submodule update --remote

Update only a specific submodule:

beman-submodule update --remote infra/

Checking status

Show the status of all beman submodules:

beman-submodule status

A + prefix indicates the submodule contents differ from the configured commit.

How does it work?

Along with the files from the child repository, it creates a dotfile called .beman_submodule, which looks like this:

[beman_submodule]
remote=https://github.com/bemanproject/infra.git
commit_hash=9b88395a86c4290794e503e94d8213b6c442ae77

Updating to a specific commit or changing the remote URL

Edit the corresponding lines in the .beman_submodule file and run beman-submodule update to update the state of the beman submodule to the new settings.

Allow untracked files

If you need to add local files alongside the vendored content, use:

beman-submodule add --allow-untracked-files https://github.com/example/repo.git path/

This adds allow_untracked_files=True to the .beman_submodule config, preserving local files during updates.

CI Integration

Add this job to your CI workflow to ensure beman submodules are in a valid state:

  beman-submodule-test:
    runs-on: ubuntu-latest
    name: "Check beman submodules for consistency"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Install beman-submodule
        run: pip install beman-submodule
      - name: beman submodule consistency check
        run: |
          (set -o pipefail; beman-submodule status | grep -qvF '+')

This will fail if the contents of any beman submodule don't match what's specified in the .beman_submodule file.

Development

This project uses uv for development:

# Install dependencies
uv sync --group dev

# Run tests
uv run pytest

# Run linter
uv run ruff check .

# Format code
uv run ruff format .

License

Apache-2.0 WITH LLVM-exception

Metadata

Release files for beman-submodule 0.1.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for beman-submodule 0.1.0
File Size Uploaded Provenance
beman_submodule-0.1.0.tar.gz 9.4 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for beman-submodule 0.1.0
File Interpreter ABI Platform
beman_submodule-0.1.0-py3-none-any.whl Python 3 none any Details

Total release size: 20.5 kB

Release files / beman_submodule-0.1.0.tar.gz

Download URL beman_submodule-0.1.0.tar.gz
Size 9.4 kB
Tags Source
SHA-256 checksum
How to use checksums
d26eb6646a50d53a5f6334e7afca6d44362252efbeaf81acfc335912f1340410
BLAKE2b-256 checksum
How to use checksums
5376f2c3f0c22c1ab4a304a781a10cfe92960a9850a439e4b7f460c99cad18f7
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.7

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.

Transparency log

Release files / beman_submodule-0.1.0-py3-none-any.whl

Download URL beman_submodule-0.1.0-py3-none-any.whl
Size 11.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
ef1e354291c89c2ae59b5b12ad1f5f76c66520a21b280192207f57c19359c4d8
BLAKE2b-256 checksum
How to use checksums
6723212d261d7c1ae723a76f6c66616b0419c1ac92a987973a60cd1347c52785
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.7

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.

Transparency log

Security for beman-submodule 0.1.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for beman_submodule-0.1.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Feb 7, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

This release

0.1.0 This release

2 release files Full provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page