UpdateSubmodule.ps1

<#
.SYNOPSIS
Updates Git submodules in the local workspace.

.DESCRIPTION
Authentication must be configured before running this script. Use Git
Credential Manager, another Git credential helper, or an SSH agent.

This script intentionally does not accept credentials or embed them in
submodule URLs, Git configuration, command-line arguments, or log output.
#>

[CmdletBinding()]
param(
    [switch] $Remote
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$workingFolder = $PSScriptRoot
$submoduleMetaFile = Join-Path -Path $workingFolder -ChildPath '.gitmodules'

function Invoke-Git {
    param(
        [Parameter(Mandatory)]
        [string[]] $GitArguments
    )

    Write-Host ('git {0}' -f ($GitArguments -join ' '))

    & git -C $workingFolder @GitArguments

    if ($LASTEXITCODE -ne 0) {
        throw "Git exited with code $LASTEXITCODE."
    }
}

Get-Command git -ErrorAction Stop | Out-Null

if (-not (Test-Path -LiteralPath $submoduleMetaFile -PathType Leaf)) {
    throw "The submodule metadata file '$submoduleMetaFile' does not exist."
}

Write-Host '************************************************'

# Synchronize local submodule configuration with .gitmodules without
# rewriting URLs or embedding credentials.
Invoke-Git -GitArguments @(
    'submodule'
    'sync'
    '--recursive'
)

$updateArguments = @(
    'submodule'
    'update'
    '--init'
    '--recursive'
)

if ($Remote) {
    $updateArguments += '--remote'
}

Invoke-Git -GitArguments $updateArguments

Write-Host '************************************************'