- When making an Emacs X.YZ release, we require that every "external"
package has a tag emacs-xyz in its repository, and we pull in and
package that version.
- In the very same file in Emacs' tree that the repositories with
external packages will be listed, we also list the corresponding
revisions that will go into the upcoming release.
The latter is essentially the "git modules" model, which we can also
use.
I think, if the above suits us (see my other message in this thread),
we should indeed use "git submodule".
One advantage it has is that the package author forgotten to push a
tag for some Emacs release, we're still covered.
You mean, advantage compared to using submodules? If so, I don't
think I see how submodules are different in this regard.