From 921f2f7b05a2f4cf5d5b4d81dd3944c73e00ccca Mon Sep 17 00:00:00 2001
From: Andrew Nesbitt <andrewnez@gmail.com>
Date: Tue, 25 Aug 2026 16:02:41 +0100
Subject: [PATCH] Report Git submodules as dependencies

---
 detect/detect_test.go             | 33 +++++++++++++++++++++++++++++++
 knowledge/_shared/_manifests.toml |  1 +
 2 files changed, 34 insertions(+)

diff --git a/detect/detect_test.go b/detect/detect_test.go
index 97cb067..d851b2d 100644
--- a/detect/detect_test.go
+++ b/detect/detect_test.go
@@ -1658,6 +1658,39 @@ func TestKnowledgeBaseLoads(t *testing.T) {
 	}
 }
 
+func TestGitSubmoduleManifestDependencies(t *testing.T) {
+	dir := t.TempDir()
+	writeFile(t, dir, ".gitmodules", `[submodule "lib/foo"]
+	path = lib/foo
+	url = https://github.com/example/foo.git
+[submodule "vendor/bar"]
+	path = vendor/bar
+	url = git@github.com:example/bar.git
+`)
+
+	report := runOn(t, dir)
+	wantManifest := brief.ManifestInfo{
+		Ecosystem: "git",
+		Path:      ".gitmodules",
+		Kind:      "manifest",
+	}
+	if !slices.Contains(report.Manifests, wantManifest) {
+		t.Errorf("manifests should contain %+v, got %+v", wantManifest, report.Manifests)
+	}
+	wantDependencies := map[string]string{
+		"lib/foo":    "pkg:git/lib%2Ffoo?repository_url=https:%2F%2Fgithub.com%2Fexample%2Ffoo.git",
+		"vendor/bar": "pkg:git/vendor%2Fbar?repository_url=git%40github.com:example%2Fbar.git",
+	}
+	for name, purl := range wantDependencies {
+		if !slices.ContainsFunc(report.Dependencies, func(dependency brief.DepInfo) bool {
+			return dependency.Name == name && dependency.PURL == purl &&
+				dependency.Scope == brief.ScopeRuntime && dependency.Direct
+		}) {
+			t.Errorf("dependencies should contain direct Git dependency %q, got %+v", name, report.Dependencies)
+		}
+	}
+}
+
 func TestNoEmptyToolNames(t *testing.T) {
 	knowledgeBase := loadKB(t)
 
diff --git a/knowledge/_shared/_manifests.toml b/knowledge/_shared/_manifests.toml
index 3cc8b78..f9be0f0 100644
--- a/knowledge/_shared/_manifests.toml
+++ b/knowledge/_shared/_manifests.toml
@@ -1,5 +1,6 @@
 [manifests]
 files = [
+    ".gitmodules",
     "Gemfile",
     "Gemfile.lock",
     "package.json",