Azure pipeline YAML: check out Git submodules in latest HEAD version

Question

Azure pipeline: checkout latest version (HEAD) of a linked Git submodule, default or specific branch, instead of the initially linked commit version.

Issue: different versions of scripting repository

The same repository is used in two ways: by the pipeline as a Git resource (always HEAD), including for most YAML templates, and in Git repos as a submodule (subdirectory "scripts"), by default the linked commit.

Separate update step for Git submodule

The ordinary checkout step offers no option for the --remote option, when updating Git submodules, which makes Git update to the latest HEAD.

A separate script step is necessary with Git command, to update submodules to HEAD.

Authentication

Expecting that the Git operations need only the service token, $(System.AccessToken). Only read access needed. The persistCredentials option of the regular checkout step doesn't work for submodules, probably because only persisted for the main repo URL.

Branch tracking

For other than default, a branch must be linked (appears in .gitmodules file).

git submodule set-branch --branch fix/MyFix <path>

Setting branch to default, with

git submodule set-branch --default <path>

removes the branch setting from the .gitmodules file.

Question: Can we get submodules automatically?

Template uses preconfigured submodules in parameter. Can we iterate submodules from parent repo somehow?

The Template

parameters:
- name: GetLatestGitSubmodules
  displayName: 'Get HEAD of listed LatestGitSubmodules.'
  type: boolean
  default: false
- name: LatestGitSubmodules
  displayName: Only these Git submodules to HEAD.
  type: object
  default:
  - submodule:
    path: 'scripts'
    
steps:
- checkout: self
  submodules: recursive
  # persistCredientals no working for Submodule checkouts/updates.
- ${{ if parameters.GetLatestGitSubmodules }}:
  - ${{ each submodule in parameters.LatestGitSubmodules }}:
    - task: Bash@3
      displayName: Get HEAD of "${{submodule.path}}" submodule.
      inputs:
        script: | 
          set -e
          echo "Updating submodule '${{submodule.path}}' to latest."
          submoduleUrl=$(git config --get-all submodule.${{submodule.path}}.url)
          submoduleAuthHeaderKey="http.${submoduleUrl}.extraheader"
          echo "Submodule '${{submodule.path}}' auth header key: ${submoduleAuthHeaderKey}"
          git -c $submoduleAuthHeaderKey="AUTHORIZATION: bearer ${SYSTEM_ACCESSTOKEN}" submodule update --recursive --remote ${{submodule.path}}
          echo "Status of '${{submodule.path}}':"
          echo $(git submodule status ${{submodule.path}})
          echo "---------- end of '${{submodule.path}}' update ---------"
        targetType: inline
        failOnStderr: true
      env:
        SYSTEM_ACCESSTOKEN: $(System.AccessToken)