Actions/checkout@v3 with submodules failing, "permission denied"

Actions
1

Has anyone had luck using actions/checkout@v3 (or @v4) in a repository with private repo submodules? It seems like the token is only valid for the repo that’s running the action, not the submodules.

Submodule 'tools' (https://git.example.com/annika/repo.git) registered for path 'tools'
Cloning into '/workspace/annika/repo/subrepo'...
remote: User permission denied
fatal: unable to access 'https://git.example.com/annika/subrepo.git/': The requested URL returned error: 403
fatal: clone of 'https://git.example.com/annika/subrepo.git' into submodule path '/workspace/annika/repo/subrepo' failed
2 Likes
2

I am having the same struggle (but slightly different use case).

I digged in the code a bit and only found these three places where that error can happen: gitea/routers/web/repo/githttp.go at 2c1ff8701a7aeafc86f87c286514768cdf121ccb · go-gitea/gitea · GitHub

Why is it explicitly forbidden to do cross-repo http-auth over git?