From 79c2ad87a4f54f54fca602f02c63eb75455e84e1 Mon Sep 17 00:00:00 2001
From: tresabhi <43380238+tresabhi@users.noreply.github.com>
Date: Sat, 14 Nov 2026 11:22:21 -0600
Subject: [PATCH] wtf? lets try this

---
 .github/workflows/website.yaml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml
index d8ff5ed3e..4b0e303ce 100644
--- a/.github/workflows/website.yaml
+++ b/.github/workflows/website.yaml
@@ -112,12 +112,17 @@ jobs:
 
       # Future proofing for Reforged: we'll have both closed and open repos, so
       # we need to handle them here instead of disabling submodules outright
+      # checkout's persisted credentials are scoped to the root .git, so submodule clones need the token passed explicitly
       - name: Checkout submodules
+        env:
+          TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
+          AUTH="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+
           if [ "$HAS_ROOT_REPO_CONTEXT" = "true" ]; then
-            git submodule update --init --recursive --depth=1
+            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1
           else
-            git submodule update --init --recursive --depth=1 -- . ':!packages/closed'
+            git -c "http.https://github.com/.extraheader=$AUTH" submodule update --init --recursive --depth=1 -- . ':!packages/closed'
           fi
 
       - name: Setup bun