# Actions/checkout@v3 with submodules failing, "permission denied" **URL:** \ **Category:** Actions\ **Created:** [April 27, 2024, 8:29am UTC](https://forum.gitea.com/t/actions-checkout-v3-with-submodules-failing-permission-denied/9051 "2024-04-27T08:29:33Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![abackstrom](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/abackstrom/32/4564_2.png) [@abackstrom](https://forum.gitea.com/u/abackstrom)\ **Post date:** [April 27, 2024, 8:29am UTC](https://forum.gitea.com/t/actions-checkout-v3-with-submodules-failing-permission-denied/9051/1 "2024-04-27T08:29:33Z")
Has anyone had luck using `actions/checkout@v3` (or `@v4`) in a repository with private repo submodules? It seems like the token is only valid for the repo that’s running the action, not the submodules. ```auto Submodule 'tools' (https://git.example.com/annika/repo.git) registered for path 'tools' Cloning into '/workspace/annika/repo/subrepo'... remote: User permission denied fatal: unable to access 'https://git.example.com/annika/subrepo.git/': The requested URL returned error: 403 fatal: clone of 'https://git.example.com/annika/subrepo.git' into submodule path '/workspace/annika/repo/subrepo' failed ``` ---
**Author:** ![lifeofguenter](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/lifeofguenter/32/6609_2.png) [@lifeofguenter](https://forum.gitea.com/u/lifeofguenter)\ **Post date:** [January 25, 2025, 8:01pm UTC](https://forum.gitea.com/t/actions-checkout-v3-with-submodules-failing-permission-denied/9051/2 "2025-01-25T20:01:37Z")
I am having the same struggle (but slightly different use case). I digged in the code a bit and only found these three places where that error can happen: [gitea/routers/web/repo/githttp.go at 2c1ff8701a7aeafc86f87c286514768cdf121ccb · go-gitea/gitea · GitHub](https://github.com/go-gitea/gitea/blob/2c1ff8701a7aeafc86f87c286514768cdf121ccb/routers/web/repo/githttp.go#L198) Why is it explicitly forbidden to do cross-repo http-auth over git?