Submodules checkout "repository not found" error without PAT

[WilliamRaia-ploomes]

I'm trying to use this action to checkout a private repo which has multiple other private repos as submodules, they're all from the same github organization. All the submodules work fine when interacting with them locally or through github UI. The problem is when running the workflow on github actions after registering all submodules to their paths when it tries to start to clone them it returns "remote: Repository not found." for every submodule we have.

Searching for this problem I've found people saying to use a PAT from a user like in the commented line below, even though that is definitely something I'd like to avoid for a company solution I've tried it and this results in failing to checkout to the primary repo with the error "remote: Write access to repository not granted." even though I'm an admin in the organization, have access to all the repos in it and have given the PAT all read and write repository permissions.

Used config for job:

  unit-tests:
    needs: check-branch
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          # token: ${{ secrets.PIPELINE_PAT }}
          submodules: 'recursive'
          # persist-credentials: false

Tried to give explicit permission for the workflow to read repos but same error.
Tried to use the "persist-credentials: false" and "true" options but same error as without it.
Already checked .gitmodules and all the repos are using correct HTTPS URLs in the format:

[submodule "packages/test"]
	path = packages/test
	url = https://github.com/Org/Test.git

What am I missing here?

[WilliamRaia-ploomes]

Got it to work with a Classic Personal Access Token instead of a Fine-grained one but this is more of a workaround than a fix really, I don't like the idea of a workflow that will be used by my whole company to depend on my own PAT. Why isn't the GITHUB_TOKEN enough for this functionality even with express permission?

[mirco-bozzolini]

Having the same issue, on some repositories I have no problem with others yes but I could not figure out why

[SaltFish001]

same to me. I don't want use PAT in org registry

[CPritch]

We're currently bumping up against this for our self-hosted runner too.

Edit: A colleague has just managed to get it working. He generated a new fine-grained token and added the 'contents read' and 'metadata' scope. He then added this as a repository secret and passed it in as the token to the checkout action. This works good enough for us.