Loading repositories with submodules is repeated. Failed to clone submodule from googlesource

My workflow:

jobs:
  build_push_to_registry:
    name: Push Docker image to GitHub Packages
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v2
        with:
          submodules: recursive
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.CR_PAT }}
      - name: Push to GitHub Packages
        uses: docker/build-push-action@v2
        with:
          file: build/manylinux/Dockerfile
          push: true
          tags: tgcalls/manylinux:latest

The second way:

- name: Check out the repo
    uses: actions/checkout@v2
- name: Checkout submodules
    run: git submodule update --init --recursive

My repository is private. It has several submodules. They are all public. Some on github, others on google. The checkout proceeds normally in two ways (see above). When trying to use build-push-action (with and without Buildx step), it cannot clone google submodules. Probably something is being mixed into the request. For example, some kind of token that Google cannot validate. Requests do not go through. Do not clone sambmodules…

Logs:

#1 [internal] load git source https://github.com/MarshalX/tgcalls.git#heads/master
#1 sha256:7f00bd87a6bdc53569455e81eceb45e3c91d9a6363df8e8c6c31f4e3a2fa9a08
#1 0.014 Initialized empty Git repository in /var/lib/buildkit/runc-overlayfs/snapshots/snapshots/1/fs/
#1 0.236 6eb146a71f45e268d96b6631e31482ddd610eb78	refs/heads/master
#1 1.612 From https://github.com/MarshalX/tgcalls
#1 1.612  * [new branch]      master     -> heads/master
#1 1.612  * [new branch]      master     -> origin/master
#1 2.289 Submodule 'cmake' (https://github.com/desktop-app/cmake_helpers) registered for path 'cmake'
#1 2.290 Submodule 'tgcalls/third_party/pybind11' (https://github.com/pybind/pybind11) registered for path 'tgcalls/third_party/pybind11'
#1 2.290 Submodule 'tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx' (https://chromium.googlesource.com/webm/libvpx) registered for path 'tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx'
#1 2.291 Submodule 'tgcalls/third_party/webrtc/src/third_party/libyuv' (https://chromium.googlesource.com/libyuv/libyuv) registered for path 'tgcalls/third_party/webrtc/src/third_party/libyuv'
#1 2.297 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/cmake'...
#1 2.552 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/pybind11'...
#1 2.953 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx'...
#1 3.043 remote: INVALID_ARGUMENT: Request contains an invalid argument
#1 3.043 remote: [type.googleapis.com/google.rpc.LocalizedMessage]
#1 3.043 remote: locale: "en-US"
#1 3.043 remote: message: "Invalid authentication credentials. Please generate a new identifier: https://chromium.googlesource.com/new-password"
#1 3.043 remote: 
#1 3.043 remote: [type.googleapis.com/google.rpc.RequestInfo]
#1 3.043 remote: request_id: "1953dfe24529482399a08c19095952ca"
#1 3.043 fatal: unable to access 'https://chromium.googlesource.com/webm/libvpx/': The requested URL returned error: 400
#1 3.045 fatal: clone of 'https://chromium.googlesource.com/webm/libvpx' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx' failed
#1 3.046 Failed to clone 'tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx'. Retry scheduled
#1 3.049 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libyuv'...
#1 3.172 remote: INVALID_ARGUMENT: Request contains an invalid argument
#1 3.172 remote: [type.googleapis.com/google.rpc.LocalizedMessage]
#1 3.172 remote: locale: "en-US"
#1 3.172 remote: message: "Invalid authentication credentials. Please generate a new identifier: https://chromium.googlesource.com/new-password"
#1 3.172 remote: 
#1 3.172 remote: [type.googleapis.com/google.rpc.RequestInfo]
#1 3.172 remote: request_id: "0eb89bc4773e4066960db6e5454bfe3b"
#1 3.172 fatal: unable to access 'https://chromium.googlesource.com/libyuv/libyuv/': The requested URL returned error: 400
#1 3.174 fatal: clone of 'https://chromium.googlesource.com/libyuv/libyuv' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libyuv' failed
#1 3.174 Failed to clone 'tgcalls/third_party/webrtc/src/third_party/libyuv'. Retry scheduled
#1 3.177 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx'...
#1 3.275 remote: INVALID_ARGUMENT: Request contains an invalid argument
#1 3.275 remote: [type.googleapis.com/google.rpc.LocalizedMessage]
#1 3.275 remote: locale: "en-US"
#1 3.275 remote: message: "Invalid authentication credentials. Please generate a new identifier: https://chromium.googlesource.com/new-password"
#1 3.275 remote: 
#1 3.275 remote: [type.googleapis.com/google.rpc.RequestInfo]
#1 3.275 remote: request_id: "43c0584098af4e24a79f0a120968ed82"
#1 3.275 fatal: unable to access 'https://chromium.googlesource.com/webm/libvpx/': The requested URL returned error: 400
#1 3.277 fatal: clone of 'https://chromium.googlesource.com/webm/libvpx' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx' failed
#1 3.277 Failed to clone 'tgcalls/third_party/webrtc/src/third_party/libvpx/source/libvpx' a second time, aborting
#1 ERROR: failed to update submodules for https://github.com/MarshalX/tgcalls.git: exit status 1
------
 > [internal] load git source https://github.com/MarshalX/tgcalls.git#heads/master:
------
error: failed to solve: rpc error: code = Unknown desc = failed to solve with frontend dockerfile.v0: failed to read dockerfile: failed to update submodules for https://github.com/MarshalX/tgcalls.git: exit status 1

As you can see the repository https://chromium.googlesource.com/webm/libvpx/ and https://chromium.googlesource.com/libyuv/libyuv/ is public.

1. How can I disable sending unnecessary headers when cloning submodules?
2. How can I disable cloning when I have already cloned the repository and all submodules?

Thanks!

[crazy-max]

@MarshalX Yes maybe authentication header is sent to submodules as well, that’s why you have this kind of issue. Looks like a bug on buildkit. WDYT @tonistiigi?

In the meantime you can use the Path context:

jobs:
  build_push_to_registry:
    name: Push Docker image to GitHub Packages
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repo
        uses: actions/checkout@v2
        with:
          submodules: recursive
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.CR_PAT }}
      - name: Push to GitHub Packages
        uses: docker/build-push-action@v2
        with:
          context: .
          file: build/manylinux/Dockerfile
          push: true
          tags: tgcalls/manylinux:latest

[crazy-max]

@roymiloh It doesn’t checkout submodules by default: https://github.com/actions/checkout/#usage

    # Whether to checkout submodules: `true` to checkout submodules or `recursive` to
    # recursively checkout submodules.
    #
    # When the `ssh-key` input is not provided, SSH URLs beginning with
    # `[e-mail]:` are converted to HTTPS.
    #
    # Default: false
    submodules: ''