submodule-pin-check.yml

name: Merge Checks

on:
  pull_request:
    branches: [ master ]
    types: [synchronize, opened, reopened, labeled, unlabeled]

jobs:
  submodule-pin-check:
    name: Submodule Pin Check
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Check all submodules are under origin/HEAD
        run: git submodule foreach git merge-base --is-ancestor HEAD origin/HEAD