I did some digging on the submodule update issue. I think the problem is that we specify

--depth=1

. This means only the most recent commit is retrieved. The top-level submodule is almost never specifying the most recent commit in the recursive submodules, so this fails. It's possible we could get the desired behavior (not checking out the entire repo) using

--reference

or

--dissociate

.