Cannot explain checkout failure in GitHub actions. What could be wrong?

Question

I use a private repository as a dependency in my poetry project, and I have a GitHub action set up to install the dependencies using poetry. However, for some reason, it fails to check-out that private repository, giving me the following error:

Failed to clone <private-repo>, check your git configuration and permissions for this repository.
 
at /opt/hostedtoolcache/Python/3.11.7/x64/lib/python3.11/site-packages/poetry/vcs/git/backend.py:233 in _clone_legacy
167 229│
168 230│ try:
157 231│ SystemGit.clone(url, target)
158 232│ except CalledProcessError:
159 → 233│ raise PoetryConsoleError(
160 234│ f"Failed to clone {url}, check your git configuration and permissions"
161 235│ " for this repository."
162 236│ )
163 237│
164
165Cannot install <private-repo>.
 

Here is the part of my yaml file responsible for installing dependencies:

name: Python tests
 
on:
  workflow_dispatch:
  push:
    branches:
      - main
  pull_request:
    branches:
      - '*'
 
jobs:
  build:
    runs-on: ubuntu-latest
 
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          submodules: 'true'
          token: ${{ secrets.GIT_CREDENTIALS }}
          persist-credentials: true
 
      - name: Set up git
        run: |
          git config --global url.https://<my-username>:${{ secrets.GIT_CREDENTIALS }}@github.com/.insteadOf https://github.com/
 
      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: 3.11
 
      - name: Install Poetry
        run: |
          python -m pip install --upgrade pip
          pip install poetry

I have also made sure to make the private repository accessible to GitHub actions of other repositories. What could be wrong?

Answer 1

It turns out that the checkout failure was not of the private repo, but the private submodule inside that private repo. This problem has been extensively discussed in the following issue:

https://github.com/actions/checkout/issues/116

The following job is what did the trick for me:

run: |
        # From https://github.com/actions/checkout/issues/116#issuecomment-583221947
        git config --global url."https://${{ secrets.PAT }}@github.com/".insteadOf "git@github.com:"
        git submodule sync --recursive

Here, secrets.PAT is my Personal Access Token (PAT).