From 20fb8f2ac9bf07710fd225b4a3bb7a085a5c96cc Mon Sep 17 00:00:00 2001
From: tresabhi <43380238+tresabhi@users.noreply.github.com>
Date: Sat, 14 Nov 2026 11:25:58 -0600
Subject: [PATCH] there we go

---
 .github/workflows/website.yaml | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml
index 4b0e303ce..3ab2889d2 100644
--- a/.github/workflows/website.yaml
+++ b/.github/workflows/website.yaml
@@ -107,24 +107,10 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || inputs.branch || 'production' }}
-          submodules: false
+          # the only submodule is closed, which needs secrets
+          submodules: ${{ env.HAS_ROOT_REPO_CONTEXT == 'true' && 'recursive' || 'false' }}
           token: ${{ secrets.GH_TOKEN || github.token }}
 
-      # Future proofing for Reforged: we'll have both closed and open repos, so
-      # we need to handle them here instead of disabling submodules outright
-      # checkout's persisted credentials are scoped to the root .git, so submodule clones need the token passed explicitly
-      - name: Checkout submodules
-        env:
-          TOKEN: ${{ secrets.GH_TOKEN || github.token }}
-        run: |
-          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
-
-          if [ "$HAS_ROOT_REPO_CONTEXT" = "true" ]; then
-            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1
-          else
-            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1 -- . ':!packages/closed'
-          fi
-
       - name: Setup bun
         uses: oven-sh/setup-bun@v2