Prevent accidental changes to .gitmodules

[thomie]

With haskell-infra/phab-ghc-builder#2 merged, we can now validate submodule updates on Phabricator, by editing .gitmodule temporarily. https://phabricator.haskell.org/D1033 is the first Diff to do so.

Maybe we should have a git hook that prevents any urls from entering the .gitmodules file.

[hvr]

I think it's easier to just add a rule to the Gitolite config to limit access to the .gitmodules files for non-wip branches... :-)

[thomie]

Sure. Do note we may want to add new submodules to .gitmodules later (e.g. shake).

[hvr]

@thomie sure, but adding a new submodule to .gitmodules requires additional administrative Git operations, so restricting access to .gitmodules to Git admins is the sensible thing to do anyway

[hvr]

Turns out I should have put this in place yesterday ;)

Especially since the script currently can be fooled to skip gitlink validation if the submodule URL is not recognised as local.

/cc @thoughtpolice @bgamari