Merge branch 'main' into fix-coverage-report-hang

.github/actions/check-submodules/index.js

@@ -143,8 +143,17 @@ const checkSubmodules = async function () {
             if (nonCrtRepo.test(submodule.name)) {
                 const isOnMain = await isAncestor(diff.thisCommit, 'origin/main', submodule.path);
                 if (!isOnMain) {
-                    core.setFailed(`Submodule ${submodule.name} is using a branch`);
-                    return;
+                    if (/^(aws-lc)$/.test(submodule.name)) {
+                        // for aws-lc we also use fips-2022-11-02 branch for FIPS support.
+                        const isOnFIPS = await isAncestor(diff.thisCommit, 'origin/fips-2022-11-02', submodule.path);
+                        if (!isOnFIPS) {
+                            core.setFailed(`Submodule ${submodule.name} is using a branch`);
+                            return;
+                        }
+                    } else {
+                        core.setFailed(`Submodule ${submodule.name} is using a branch`);
+                        return;
+                    }
                 }
             } else {
                 core.setFailed(`Submodule ${submodule.name} is not using a tagged release`);