GitHub Actions Pull Private Git Submodule

checkout.yml

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
    - name: Clone main repository
      uses: actions/checkout@v4

    - name: Add SSH private keys for submodule repositories
      uses: webfactory/ssh-agent@v0.9.0
      with:
        ssh-private-key: ${{ secrets.READ_ONLY_DEPLOY_KEY }}

    - name: Clone submodules
      run: git submodule update --init --recursive --remote

Check this issue for future solution: actions/checkout#287

Read ssh-agent Usage section to learn how to:

1. create a deploy key for your private git repo
2. set secrets in your parent repo
   https://github.com/marketplace/actions/webfactory-ssh-agent

Also, in .gitmodules, change the repo url to the ssh format git@:

[submodule "xxx"]
	path = xxx
	url = git@github.com:username/xxx

You can also use relative paths in the .gitmodules url, like ../other-repo.git

You can also use relative paths in the .gitmodules url, like ../other-repo.git

https://stackoverflow.com/a/44630028/11844720

I finally solved this problem by specifying the submodules url as a [relative path](https://git-scm.com/docs/git-submodule):

So lets say your main git repository can be reached

either via https://gitlabserver.com/my/path/main.git
or via user@gitlabserver.com:my/path/main.git
And the .gitmodules file looks like this:

[submodule "utils"]     
    path = libs/utils   
    url = https://gitlabserver.com/my/path/utils.git
That would mean that even when you check out the main application via ssh, the submodule utils would still be accessed via https.

However, you can replace the absolute path with a relative one like this:

[submodule "utils"]     
    path = libs/utils   
    url = ../utils.git
and from now on use

either git clone --recursive https://gitlabserver.com/my/path/main.git
or git clone --recursive user@gitlabserver.com:my/path/main.git
to get the whole repository structure which ever way you want. Obviously that doesn't work for cases where the relative ssh and the https paths are not the same, but at least for gitlab hosted repositories this is the case.

This is also handy if you (for whatever reason) mirror your repository structure at two different remote sites.

I think I found the cleanest solution to this so far

actions/checkout#287 (comment)