Checkout with private submodules doesn't work

Hello. I can’t get to work private submodule checkout. 

I’ve created two private repositories: first_repo and second_repo. 

Then I’ve added second_repo as a submodule to first_repo.

When I am trying to make checkout it gives me the following:

Setting up auth
"C:\Program Files\Git\bin\git.exe" config --local --name-only --get-regexp core\.sshCommand
"C:\Program Files\Git\bin\git.exe" submodule foreach --recursive "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
"C:\Program Files\Git\bin\git.exe" config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
"C:\Program Files\Git\bin\git.exe" submodule foreach --recursive "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
"C:\Program Files\Git\bin\git.exe" config --local http.https://github.com/.extraheader "AUTHORIZATION: basic ***"

Fetching the repository
"C:\Program Files\Git\bin\git.exe" -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +refs/heads/master:refs/remotes/origin/master
Logon failed, use ctrl+c to cancel basic credential prompt.
<font color="#FF0000">##[error]fatal: could not read Username for 'https://github.com': terminal prompts disabled </font>The process 'C:\Program Files\Git\bin\git.exe' failed with exit code 128
Waiting 14 seconds before trying again

My yml file:

- name: Checkout
      uses: actions/checkout@v2

    - name: Checkout private tools
      uses: actions/checkout@v2
      with:
        repository: ShabalinAnton/second_repo
        token: ${{ secrets.MY_SECRET_PAT }}
        path: second_repo

I have already tried almost every solution I’ve found. But nothing seems to be working. 

Does anyone know the soluttion ?

Hi @shabalinanton ,

I can repro the same on my side:

Please re-create the personal access token and update the value of secrets, confirmed it works:

submodule3.png

Actually you can directly checkout both repo with below code:

- name: Checkout
        uses: actions/checkout@v2
        with:
           token: ${{ secrets.PAT1 }}
<font color="#FF6600">submodules: true</font>

Or you can clone the private repo via command:

- name: checkout
         run: |
           git clone https://username:$PAT@github.com/{org}/{repo}.git
         env:
           PAT: ${{ secrets.PAT1 }}

Thanks.

Hello, @weide-zhou Thanks for the answer!

But I still have a problem.

When I am trying to do:

- name: checkout2
      shell: bash
      run: |
         git clone https://ShabalinAnton:$PAT@github.com/ShabalinAnton/second_repo.git
      env:
        PAT: '${{secrets.MY_PAT}}'

Then I get the following error:

Run git clone ***github.com/ShabalinAnton/second_repo.git
  git clone ***github.com/ShabalinAnton/second_repo.git
  shell: /bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    PAT:
Cloning into 'second_repo'...
remote: Invalid username or password.
<font color="#FF0000">fatal: Authentication failed for 'https://github.com/ShabalinAnton/second_repo.git/'</font>##[error]Process completed with exit code 128.

But everything work when I change ${{secrets.MY_PAT}} to the key value, for example:

- name: checkout2
      shell: bash
      run: |
         git clone https://ShabalinAnton:$PAT@github.com/ShabalinAnton/second_repo.git
      env:
        PAT: 'a91c5f7477bb6234e30833c330815ce0d26f831d'

I believe something could be wrong with a syntax. Also this error appears when I am trying to use repository secret. 

This is my yml file:

name: Build And Deploy
on:
  push:
    branches: [master]

jobs:
  build:
    runs-on: windows-latest

    steps:
     - uses: actions/checkout@v2

     - uses: actions/checkout@v2
        with:
            submodules: 'true'
            token: '${{ secrets.SECOND_REPO_SECRET }}'

Which gives me the following result:

/usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +84a8987c1d0ede9770868a27ef4547c623df3f45:refs/remotes/origin/master
<font color="#FF0000">##[error]fatal: could not read Username for 'https://github.com': terminal prompts disabled</font> The process '/usr/bin/git' failed with exit code 128
  Waiting 16 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +84a8987c1d0ede9770868a27ef4547c623df3f45:refs/remotes/origin/master
  ##[error]fatal: could not read Username for 'https://github.com': terminal prompts disabled
  The process '/usr/bin/git' failed with exit code 128
  Waiting 19 seconds before trying again
  /usr/bin/git -c protocol.version=2 fetch --no-tags --prune --progress --no-recurse-submodules --depth=1 origin +84a8987c1d0ede9770868a27ef4547c623df3f45:refs/remotes/origin/master
  ##[error]fatal: could not read Username for 'https://github.com': terminal prompts disabled
  ##[error]The process '/usr/bin/git' failed with exit code 128

Hi @shabalinanton ,

Based on your error message, ${{secrets.MY_PAT}} doesn’t have the value of your token.

Please update the secrets MY_PAT with the new value, or re-create a new PAT token from github setting https://github.com/settings/tokens, and then update the secrets with the new PAT.

Please make sure the secrets exist on the repo which contains the workflow yaml.

Regarding the submodule parameter, you don’t need to checkout twice, only one action is enough, it will automatically checkout the submodule repo. Please check the usage link for more details.

 - uses: actions/checkout@v2 - uses: actions/checkout@v2
        with:
repository: {org}/{REPO_ONE}
            submodules: 'true'
            token: '${{ secrets.MY_PAT }}'

Thanks.

Hello again, @weide-zhou 

Please, watch the following. I’ve created a video with steps to reproduce my problem:

https://youtu.be/EIJjueSbg2U 

I can’t get why it don’t work on my side. Maybe you can help me.

Hi @shabalinanton ,

You didn’t store the PAT as the secret value of repo_one. Until the last minute of your video, you create the secrets, but with incorrect value…

Please update secert MY_SECRET with your PAT token.

secretsvalue.png

And in workflow yaml of repo_one:

- name: Checkout private tools
         uses: actions/checkout@v2
         with:
           repository: ShabakinAnton/<font color="#FF0000">first_repo</font> token: ${{ secrets.MY_SECRET }}
           submodules: true

Please refer to official doc for more details.

Thanks