feat(workflows): add submodules input to reusable CI workflows

[WomB0ComB0]

Summary

• Adds optional submodules input to required.yml, dotnet-ci.yml, and security-scan.yml
• Forwards to actions/checkout in build, format, test, and CodeQL jobs
• Empty default ("") preserves current behavior for all existing callers

Why

resq-software/viz depends on lib/dotnet-sdk as a git submodule, but CI's reusable workflows never check it out — causing build and CodeQL failures with CS0246 for every SDK-sourced type. This change lets consumer repos opt into submodule checkout via a single input.

Caller usage (viz example)

- uses: resq-software/.github/.github/workflows/required.yml@<sha>
  with:
    lang: dotnet
    dotnet-solution: ResQ.Viz.sln
    codeql-languages: '["csharp"]'
    submodules: recursive        # ← new

Backwards compatibility

Purely additive. The submodules input defaults to "", which when forwarded to actions/checkout is treated identically to "not set" — no existing caller (resQ, vcpkg, viz, dotnet-sdk) changes behavior unless they explicitly opt in.

Test plan

• Merge
• Bump pin in resq-software/viz/.github/workflows/ci.yml and pass submodules: recursive
• Confirm gates / .NET CI / Build and scan / CodeQL (csharp) pass on viz PR with a valid submodule pin

🤖 Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Rate limit exceeded

@WomB0ComB0 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 4 minutes and 55 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 55 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fff9ceec-8d76-4164-91ef-977a9584ea85

📥 Commits

Reviewing files that changed from the base of the PR and between 40fa987 and 6d78d13.

📒 Files selected for processing (3)

• .github/workflows/dotnet-ci.yml
• .github/workflows/required.yml
• .github/workflows/security-scan.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/submodules-checkout-support

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}