Authentication error with local mirrored actions

I have set up two organizations: one for actual repositories and one called “actions” for mirroring and hosting actions. Every repo in both organizations is private by default.

The following workflow is throwing a authentication required for an action that is also mirrored:

name: Run Formatting Checks

on: [push]
jobs:
  test:
    runs-on: docker
    container:
      image: tld.com...devimage:latest    
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: true
      - uses: cpp-linter/cpp-linter-action@v2
        id: linter
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
           version: 18
          style: 'file'  # Use .clang-format config file
          tidy-checks: '' # Use .clang-tidy config file
          # only 'update' a single comment in a pull request's thread.
          thread-comments: ${{ github.event_name == 'pull_request' && 'update' }}
      - name: Fail fast?!
        if: steps.linter.outputs.checks-failed > 0
        run: exit 1

The checkout step runs fine:

Cloned https://tld.com/actions/checkout to /data/.cache/act/actions-checkout@v4
Checked out v4

The cpp-linter seems to run into an authentication error by calling setup-python action that is also mirrored on the local gitea instance:

run pre step for 'cpp-linter/cpp-linter-action@v2'
  ☁  git clone 'https://tld.com/actions/setup-python' # ref=v5
  cloning https://tld.com/actions/setup-python to /data/.cache/act/actions-setup-python@v5
Unable to clone https://tld.com/actions/setup-python refs/heads/v5: authentication required
authentication required

I don’t really know what to pass so the nested action is cloned successfully. Do you have any hints for me?

Am I running into this issue?