Add submodule pin check to CI

.github/workflows/submodule-pin-check.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+declare -Ar exceptions=(
+	[contracts]=origin/develop
+	[nitro-testnode]=origin/master
+
+	#TODO Rachel to check these are the intended branches.
+	[arbitrator/langs/c]=origin/vm-storage-cache
+	[arbitrator/tools/wasmer]=origin/adopt-v4.2.8
+)
+
+divergent=0
+for mod in `git submodule --quiet foreach 'echo $name'`; do
+	branch=origin/HEAD
+	if [[ -v exceptions[$mod] ]]; then
+		branch=${exceptions[$mod]}
+	fi
+
+	if ! git -C $mod merge-base --is-ancestor HEAD $branch; then
+		echo $mod diverges from $branch
+		divergent=1
+	fi
+done
+
+exit $divergent
+

.github/workflows/submodule-pin-check.yml

@@ -0,0 +1,21 @@
+name: Submodule Pin Check
+
+on:
+  pull_request:
+    branches: [ master ]
+    types: [synchronize, opened, reopened]
+
+jobs:
+  submodule-pin-check:
+    name: Submodule Pin Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Check all submodules are ancestors of origin/HEAD or configured branch
+        run: ${{ github.workspace }}/.github/workflows/submodule-pin-check.sh
+