chore: Create submodule CI check

.github/CODEOWNERS

@@ -8,6 +8,12 @@ docs/other/updates/release-notes/ @dfinity/dx
 docs/building-apps/interact-with-canisters/agents/ @dfinity/dx
 docs/building-apps/developer-tools/cdks/ @dfinity/dx
 
+# SDK
+submodules/sdk @dfinity/sdk
+
+# Motoko
+submodules/motoko @dfinity/languages
+
 # FI
 docs/defi/ @dfinity/finint
 

.github/workflows/check_submodule.yml

@@ -0,0 +1,44 @@
+name: Validate Submodule Commits
+on:
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  submodule-commit-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+          fetch-depth: 0
+
+      - name: Validate Submodule Commits
+        run: |
+          # Submodules are very easy to accidentally overwrite with old versions.
+          # To make submodule updates more explicit and to prevent accidental changes we check the revisions explicitly here.
+
+          # dfx 0.25.1
+          LATEST_SDK="1fbe1537b0ac988c20ca447bee3a3750601f1294" 
+
+          # motoko 0.14.5
+          LATEST_MOTOKO="51fa74671829c59912c37500773cfaba950b0a1b" 
+
+          # Get current submodule commits
+          SDK_HASH=$(git submodule status submodules/sdk | awk '{print $1}')
+          MOTOKO_HASH=$(git submodule status submodules/motoko | awk '{print $1}')
+
+          # Validate SDK commit
+          if [[ "$SDK_HASH" != "$LATEST_SDK"* ]]; then
+            echo "Error: SDK submodule is not on the latest release commit"
+            exit 1
+          fi
+
+          # Validate Motoko commit
+          if [[ "$MOTOKO_HASH" != "$LATEST_MOTOKO"* ]]; then
+            echo "Error: Motoko submodule is not on the latest release commit"
+            exit 1
+          fi
+
+          echo "All submodules are on their latest release commits"

MOTOKO_MAINTENANCE.md

@@ -8,6 +8,9 @@ git checkout 0.14.1 #or whatever new tag you desire
 cd ../..
 git add submodules/motoko # add the change to the submodule
 ```
+
+Update the `.github/workflows/check_submodule.yml` file to reflect the latest version's commit hash.
+
 Replace `static/moc-interpreter-0.14.0.js` with `static/moc_interpreter-0.14.1.js` downloaded from the Motoko release page.
 
 Edit `static/load_moc.ts` to use the correct version of the interpreter and base libs.

README.md

@@ -406,10 +406,27 @@ The following submodules and their corresponding repos are currently used:
 
 ### Updating submodules
 
-To update all submodules, run the command:
+The SDK and Motoko submodules must be on the latest release version for their respective package release, i.e., IC SDK v0.25.1 or Motoko v0.14.5. These versions are checked by the Check Submodule CI job. 
+
+These versions can be updated to the newest release via commands:
+
+```
+cd submodules/motoko
+git checkout 0.14.1
+```
+
+and
+
+```
+cd submodules/sdk
+git checkout 0.25.1
+```
+
+For other submodules without release versions, checkout the latest commit hash when updates are requested. 
 
 ```
-git submodule update --remote
+cd submodules/dfxvm
+git checkout 69adb0cc8edd532dcdcb465cfcc2166692a51448
 ```
 
 ### Reverting submodule changes