Known issue with gitsubmodule updates

[mburumaxwell]

Support for updating gitsubmodules was added recently in https://github.com/dependabot/dependabot-core/pull/6320 but it does not work as expected. This issue is for tracking purposes and to avoid duplicates. This issue will present itself as being unable to create the pull request but what actually fails is the creation of the commit before creating the PR.

Just in case someone comes looking for reasons why this may still not update the .gitmodules file, it would appear that Azure DevOps API checks if the content represents a commit and rejects it even if the commit is not for the given repository. More information on this:

• https://developercommunity.visualstudio.com/t/REST-API-does-not-support-updating-git-s/10272679
• https://developercommunity.visualstudio.com/t/Can-not-update-submodule-using-GitHttpCl/1537646

Dependabot works just fine as per process but the actual call to the Azure DevOps API fails.

POST /<org>/<proj>/_apis/git/repositories/managd-updater/pushes?api-version=5.0 HTTP/1.1
Authorization: Basic xyz
Content-Type: application/json
User-Agent: PostmanRuntime/7.30.1
Accept: */*
Postman-Token: 2c4e1a73-5d46-4141-8dbd-bb88875cc65d
Host: dev.azure.com:443
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Length: 1207
 
{
    "refUpdates": [
        {
            "name": "refs/heads/dependabot/submodules/dependabot-core-4b000ac",
            "oldObjectId": "f772af45a62b8748d8f785dd3ff3d828ca71f8da"
        }
    ],
    "commits": [
        {
            "comment": "Bump dependabot-core from `41a8646` to `4b000ac`\n\nBumps [dependabot-core](https://github.com/dependabot/dependabot-core) from `41a8646` to `4b000ac`.\n- [Release notes](https://github.com/dependabot/dependabot-core/releases)\n- [Commits](https://github.com/dependabot/dependabot-core/compare/41a864663f82d95b2b779afcfecc88fe195d38c4...4b000ace1ebcbf2b812a85522da6b1ae13a57367)",
            "author": {
                "name": "dependabot[bot]",
                "email": "[email protected]"
            },
            "changes": [
                {
                    "changeType": "edit",
                    "item": {
                        "path": "/dependabot-core"
                    },
                    "newContent": {
                        "content": "NGIwMDBhY2UxZWJjYmYyYjgxMmE4NTUyMmRhNmIxYWUxM2E1NzM2Nw==\n",
                        "contentType": "base64encoded"
                    }
                }
            ]
        }
    ]
}
 
HTTP/1.1 400 Bad Request
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 400
Content-Type: application/json; charset=utf-8
Expires: -1
P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT"
X-TFS-ProcessId: dd8389c6-32dd-4864-a6c4-48ef5b2c7b59
Strict-Transport-Security: max-age=31536000; includeSubDomains
ActivityId: 44c86568-7660-403e-8e68-a2802901d1b3
X-TFS-Session: 44c86568-7660-403e-8e68-a2802901d1b3
X-VSS-E2EID: 44c86568-7660-403e-8e68-a2802901d1b3
X-VSS-SenderDeploymentId: fa85298d-d7df-eba2-6cd2-9d3c9247a546
X-VSS-UserData: 961314fa-c312-68ab-8dce-cbb71e30c268:***@***.***
X-FRAME-OPTIONS: SAMEORIGIN
Request-Context: appId=cid-v1:a32646d4-6542-4ff0-b4b1-416ef6b2d466
Access-Control-Expose-Headers: Request-Context
X-Content-Type-Options: nosniff
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: BE0D5F8224594D799C0BDEA70D2E17E9 Ref B: NBO30EDGE0308 Ref C: 2023-02-05T18:07:07Z
Date: Sun, 05 Feb 2023 18:07:08 GMT
 
{
    "$id": "1",
    "innerException": null,
    "message": "Expected a Blob, but objectId 41a864663f82d95b2b779afcfecc88fe195d38c4 resolved to a Commit (path '/dependabot-core')\r\nParameter name: newPush",
    "typeName": "Microsoft.TeamFoundation.SourceControl.WebServer.InvalidArgumentValueException, Microsoft.TeamFoundation.SourceControl.WebServer",
    "typeKey": "InvalidArgumentValueException",
    "errorCode": 0,
    "eventId": 0
}

[mburumaxwell]

Leave a comment if this affects you so that we can track impact. You can add extra information if necessary.