the dist needs to be commit as well...

Author: TingDaoK

.github/actions/check-submodules/dist/index.js

@@ -27978,8 +27978,17 @@ const checkSubmodules = async function () {
             if (nonCrtRepo.test(submodule.name)) {
                 const isOnMain = await isAncestor(diff.thisCommit, 'origin/main', submodule.path);
                 if (!isOnMain) {
-                    core.setFailed(`Submodule ${submodule.name} is using a branch`);
-                    return;
+                    if (/^(aws-lc)$/.test(submodule.name)) {
+                        // for aws-lc we also use fips-2022-11-02 branch for FIPS support.
+                        const isOnFIPS = await isAncestor(diff.thisCommit, 'origin/fips-2022-11-02', submodule.path);
+                        if (!isOnFIPS) {
+                            core.setFailed(`Submodule ${submodule.name} is using a branch`);
+                            return;
+                        }
+                    } else {
+                        core.setFailed(`Submodule ${submodule.name} is using a branch`);
+                        return;
+                    }
                 }
             } else {
                 core.setFailed(`Submodule ${submodule.name} is not using a tagged release`);