From e907e711011034fa98b098e8c80ea0e1f923c10e Mon Sep 17 00:00:00 2001
From: "J. Nick Koston" <nick@home-assistant.io>
Date: Sun, 26 Apr 2026 04:08:43 -0500
Subject: [PATCH] [git] Address PR review feedback

- Add `--` terminator before submodule paths (both clone and refresh
  paths) so a path beginning with `-` cannot be parsed as a git option.
- Reword the refresh-fetch comment: this fetch also runs when ref is
  None, in which case it pulls the remote default branch.
---
 esphome/git.py               | 15 +++++++++------
 tests/unit_tests/test_git.py |  4 ++++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/esphome/git.py b/esphome/git.py
index 941c6ffcd2b..5ee66252276 100644
--- a/esphome/git.py
+++ b/esphome/git.py
@@ -141,7 +141,8 @@ def clone_or_update(
                     "Initializing submodules (%s) for %s", ", ".join(submodules), key
                 )
                 run_git_command(
-                    ["git", "submodule", "update", "--init", "--depth=1"] + submodules,
+                    ["git", "submodule", "update", "--init", "--depth=1", "--"]
+                    + submodules,
                     git_dir=repo_dir,
                 )
         except GitException:
@@ -184,10 +185,11 @@ def clone_or_update(
                     git_dir=repo_dir,
                 )
 
-                # Fetch remote ref. --depth=1 keeps the clone shallow while
-                # still picking up new commits when the remote tip moves: a
-                # shallow fetch always retrieves the current tip of the
-                # requested ref, then reset --hard FETCH_HEAD updates the
+                # Fetch from the remote. --depth=1 keeps the clone shallow
+                # while still picking up new commits when the remote tip
+                # moves: a shallow fetch retrieves the current tip being
+                # fetched, whether that's an explicit ref or the remote's
+                # default branch, then reset --hard FETCH_HEAD updates the
                 # working tree to it.
                 cmd = ["git", "fetch", "--depth=1", "--", "origin"]
                 if ref is not None:
@@ -238,7 +240,8 @@ def clone_or_update(
                     "Updating submodules (%s) for %s", ", ".join(submodules), key
                 )
                 run_git_command(
-                    ["git", "submodule", "update", "--init", "--depth=1"] + submodules,
+                    ["git", "submodule", "update", "--init", "--depth=1", "--"]
+                    + submodules,
                     git_dir=repo_dir,
                 )
 
diff --git a/tests/unit_tests/test_git.py b/tests/unit_tests/test_git.py
index 447956ed13b..2429365006c 100644
--- a/tests/unit_tests/test_git.py
+++ b/tests/unit_tests/test_git.py
@@ -855,6 +855,9 @@ def test_clone_with_submodules_uses_shallow_submodule_update(
     cmd = submodule_calls[0][0][0]
     assert "--depth=1" in cmd
     assert "components/foo" in cmd
+    # The `--` terminator must precede the submodule paths so a path
+    # beginning with `-` cannot be parsed as an option.
+    assert cmd.index("--") < cmd.index("components/foo")
 
 
 def test_refresh_fetch_is_shallow(tmp_path: Path, mock_run_git_command: Mock) -> None:
@@ -909,6 +912,7 @@ def test_refresh_submodule_update_is_shallow(
     cmd = submodule_calls[0][0][0]
     assert "--depth=1" in cmd
     assert "components/foo" in cmd
+    assert cmd.index("--") < cmd.index("components/foo")
 
 
 def test_refresh_picks_up_new_remote_commits(