use read-only url for migrations submodule