feat: materialize local review submodules

[norvalbv]

Review 12 of 20 — hardened replacement stack. This is not a patch-equivalent split of #95; it is one layer of the larger redesign.

What this PR does

Adds local-only materialization for staged submodule gitlinks:

• Reads the superproject's staged gitlink commits.
• Materializes matching submodule commits only when their objects already exist locally.
• Uses a NUL-safe manifest for nested and unusual submodule paths.
• Avoids fetches, remote calls, target-submodule mutation, and target-controlled hooks.
• Warns and excludes dirty nested submodule contents and clean local commits that are newer than the staged superproject gitlink.

Why this slice exists

A PR can legitimately change a superproject gitlink. Reviewers need the files for that exact staged submodule commit, but devkit review must not fetch arbitrary code or rewrite the target's nested checkout while building its temporary snapshot.

Review carefully

• No network operation or submodule hook can run during materialization.
• Only the staged gitlink commit is represented.
• Missing local objects fail or warn according to the documented policy rather than silently reviewing different bytes.
• Nested paths, newline-containing paths, cleanup, and target immutability remain correct.

Explicit non-goals

• Dirty nested submodule contents are deliberately excluded with a warning.
• This does not update, initialize, fetch, or repair target submodules.
• This slice does not expose or wire the public devkit review command.

Stack position

• Base: feat: capture complete review snapshots #123
• Previous: feat: capture complete review snapshots #123
• Next: feat: freeze review setup runtime #125
• Full review order: refactor: share gate worktree preparation #104 → feat: configure review-mode gate routing #108 → feat: harden packaged reviewer runtime #110 → feat: compare review lint baselines #111 → refactor: establish review execution primitives #113 → refactor: isolate review gate projections #114 → refactor: add review runtime fingerprints #115 → feat: capture exact review snapshots #116 → feat: isolate review dependencies #118 → feat: freeze review runtime inputs #120 → feat: capture complete review snapshots #123 → feat: materialize local review submodules #124 → feat: freeze review setup runtime #125 → feat: isolate review dependencies #126 → feat: freeze review gate projections #127 → feat: freeze review runtime assets #128 → feat: isolate review cache roots #129 → feat: authenticate review repository state #130 → feat: supervise review gate processes #133 → feat: fence review verdict caches #135

Review bottom-up. These PRs currently target their predecessor branches; do not merge a middle PR directly to main. After review, successors must be retargeted/rebased as predecessors land, unless an explicit stack-collapse landing process is agreed.

Size and evidence

• 3 files
• +891 / -0 lines
• Includes a dedicated hermetic submodule integration suite.
• Originally published through devkit ship.
• This description update changes GitHub metadata only.

[coderabbitai]

Warning

Review limit reached

@norvalbv, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c736abd0-462c-40fa-b8b7-12b230ad4e8f

📥 Commits

Reviewing files that changed from the base of the PR and between 1211d51 and 9aba1e5.

📒 Files selected for processing (3)

• cli/__tests__/review-submodules.test.mts
• cli/lib/ship/review/submodule-manifest.sh
• cli/lib/ship/review/submodules.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/review-stack-12-local-submodules

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}