GitHub workflow to tag a submodule

I have a repo with a workflow that runs make. The repo has a submodule that I own. What I want to do is create or update a tag in the submodule if the make succeeds.

The submodule is unreliable and I want to keep track of the last known version that builds ok.

This is my workflow so far (k.edu is the submodule):

name: CI
on: # Controls when the workflow will run
 push:
  branches: [ "main" ]
 pull_request:
  branches: [ "main" ]
 workflow_dispatch: # Allows you to run this workflow manually from the Actions tab
jobs:
  build:
   runs-on: ${{ matrix.os }}
   strategy:
    matrix:
     os: [macos-latest] #[ubuntu-latest, macos-latest]
   steps:
      - uses: actions/checkout@v4
        with:
         submodules: 'true'
      - name: clang on ${{ matrix.os }}
        run: clang -v
      - name: build on ${{ matrix.os }}
        run:  cd k.edu && make

in the end, i couldn't tag the submodule as the workflow doesn't have rights to change it. what i did was append the submodule HEAD revision to mac, a file tracked in the main module. then, next time i fetch changes to mac, i can run a script to tag the submodule on my machine.

name: MacOS build
on: # Controls when the workflow will run
 push:
  branches: [ "main" ]
 workflow_dispatch: # Allows you to run this workflow manually from the Actions tab
jobs:
  build:
   runs-on: macos-latest
   permissions: write-all
   steps:
      - uses: actions/checkout@v4
        with:
         submodules: 'true'
      - name: build
        run: if ! grep `cd k.edu && git rev-parse HEAD` mac; then cd k.edu && make; fi
      - name: mac add
        run: |
         if ! grep `cd k.edu && git rev-parse HEAD` mac; then
          (cd k.edu && git rev-parse HEAD>>../mac)
          git config --global user.name 'github-action'
          git config --global user.email 'github-action@users.noreply.github.com'
          git add mac; git commit -m "$(date -u)"; git push
         fi