Configure access to private repos in the CI

Author: zah

.gitlab-ci.yml

@@ -9,9 +9,14 @@ default:
       NIX_CONFIG_FILE=~/.config/nix/nix.conf
       mkdir -p "$(dirname "$NIX_CONFIG_FILE")"
       {
-        echo "access-tokens = ${CI_SERVER_HOST}=PAT:${CI_GROUP_TOKEN}"
+        echo "access-tokens = ${CI_SERVER_HOST}=PAT:${CI_GROUP_TOKEN} github.com=${GH_READ_METACRAFT_PRIVATE_REPOS}"
       } > "$NIX_CONFIG_FILE"
 
+      # Rewrite SSH URLs to HTTPS with token for submodule cloning
+      # (e.g. tree-sitter-nim uses SSH URL in .gitmodules)
+      git config --global url."https://oauth2:${GH_READ_METACRAFT_PRIVATE_REPOS}@github.com/".insteadOf "git@github.com:"
+      git config --global url."https://oauth2:${GH_READ_METACRAFT_PRIVATE_REPOS}@github.com/".insteadOf "ssh://git@github.com/"
+
 stages:
   - lint
   - build