No Way to Use Deploy Key Only For Specific Submodule?

[xanderdunn]

I have a private repository. It has two submodules in it. One of them is public, and one of them is private.

      - name: Checkout my repo
        uses: actions/checkout@v3

The above succeeds, but fails to fetch any of the submodules.

      - name: Checkout my repo
        uses: actions/checkout@v3
        with:
            submodules: 'true'      

The above fails because it can't checkout the private submodule.

I create a deploy key on the private submodule's repository, and add the private key as a secret on the repository where I'm running this GitHub Action. However:

      - name: Checkout my repo
        uses: actions/checkout@v3
        with:
            submodules: 'true'
            ssh-key: ${{ secrets.ACTION_SSH_SECRET }}

The above fails because it tries to use the ssh-key for all three repositories: this repo, the public submodule, and the private submodule. This fails on both this repo and the public submodule because the deploy key is only on the private submodule.

So, I manually check out reach repository:

      - name: Checkout my repo
        uses: actions/checkout@v3
      - name: Checkout public submodule
        run: |
          git clone https://github.com/foundry-rs/forge-std subnet-evm/test_precompile/lib/forge-std
          cd subnet-evm/test_precompile/lib/forge-std
          git submodule update --init --recursive

      - name: Checkout private submodule
        run: |
          mkdir ~/.ssh
          echo "${{ secrets.ACTION_SSH_SECRET }}" > ~/.ssh/id_deploy_key
          chmod 600 ~/.ssh/id_deploy_key
          cd subnet-evm
          GIT_SSH_COMMAND='ssh -i ~/.ssh/id_deploy_key' git clone --single-branch --branch my_branch [email protected]:my-org/private-repo.git

Is there really no way to do this with the checkout action? Must I maintain all of the above manually? It's fragile because I'm not actually using what's in the .gitmodules, I've hard-coded every repo to be checked out in the GitHub Action. It would be nice if the ssh-key could be specified for a specific submodule, or if it would fallback to the default credentials if the ssh-key fails.

[parched]

This is the way I'm doing it, but it would be better if we could just set the ssh-key option per submodule.

      - uses: actions/checkout@v3
        with:
          submodules: false

      - run: |
          mkdir -p ~/.ssh
          echo '${{ secrets.XXX_SSH_KEY }}' > ~/.ssh/id_xxx

          cat << EOF > ~/.ssh/config
          Host xxx
            HostName github.com
            User git
            IdentityFile ~/.ssh/id_xxx
            StrictHostKeyChecking no
          EOF

          # need to change from https to ssh and change to host to match ~/.ssh/config
          git config submodule.xxx.url 'git@xxx:my-org/xxx.git'

          git submodule update --init
        shell: bash

[alex-envoy]

Is this really still the best/only way to pull from a private submodule repo? It works fine, but feels awful.