Check submodule commit provenance in CI

[jethrogb]

Currently, when any changes are made to a submodule in the Rust repository, rustbot adds a warning comment but it's up to the reviewer to check all the changes.

One of the things that should always be true of a submodule commit (at merge time in the Rust repo) is that it should already be merged in an upstream branch. This can be checked in an automated fashion during CI by checking the commit against a set of allowed remote branches.

If this is not checked, something that might happen is that an author simultaneously makes an upstream and Rust PR with one commit. Later, the author (force) pushes another commit to the same upstream PR but forgets to update the Rust submodule. The original commit will at some point be garbage-collected by GitHub and merging the Rust PR would be bad because the complete source code would not be accessible in git in the future. This happened in #75009.

This check should not be done for try builds, so that development can continue unimpeded.

@rustbot modify labels: +C-enhancement +T-infra

[RalfJung]

FWIW, we have used this technique of merging not-yet-upstream-merged submodule updates into rustc master in the past in Miri. That was quite helpful when disentangling a mess of mutual dependencies. We were careful to make sure the Miri branch gets merged into Miri master later without any force-pushing. But we haven't done that in a while so I think these days we could live without being able to do that.

Cc @rust-lang/miri

[jethrogb]

It doesn't necessarily need to be merged, the submodule commit just needs to be in the set of allowed remote branches for the upstream project. Potentially each project could designate their own set.

[jethrogb]

Close call: #82102

[nagisa]

What I think happened in the referenced PR was this:

I fetched the llvm-project with git fetch origin and wanting to make changes on top of the rustc/11.0-2021-01-05 I ran git checkout rustc/11.0-2021-01-05, made my changes, committed them, and submitted the PR.

Later when the PR was already merged, I took care to git fetch origin and git checkout -f rustc/11.0-2021-01-05 (note the missing origin/ in front of rustc/) which made git to check out the branch that I had implicitly created locally in the previous step, rather than the rustc/11.0-2021-01-05 as it appears in the origin remote.

There're definitely a fair amount of potential footguns here.