From 9d74b1fecd113fa5ac3f0eef25667944fa0a2742 Mon Sep 17 00:00:00 2001
From: moonpower <xxmoonpower1234xx@gmail.com>
Date: Tue, 7 Apr 2026 08:35:20 +0200
Subject: [PATCH] Use explicit token for private fsui submodule

---
 .gitea/workflows/build.yml | 72 +++++++++++++++++++++++++++++++++++---
 1 file changed, 68 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 0b85b60..34f791d 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -36,7 +36,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: recursive
+          submodules: false
+
+      - name: Fetch submodules with private repo token
+        shell: bash
+        env:
+          FSUI_SUBMODULE_TOKEN: ${{ secrets.FSUI_SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "$FSUI_SUBMODULE_TOKEN" ]; then
+            echo "FSUI_SUBMODULE_TOKEN is required to fetch the private fsui-lib submodule." >&2
+            exit 1
+          fi
+
+          auth="$(printf 'x-access-token:%s' "$FSUI_SUBMODULE_TOKEN" | base64 | tr -d '\n')"
+          git config --global http.https://git.nanodata.cloud/.extraheader "AUTHORIZATION: basic $auth"
+          git submodule sync --recursive
+          git submodule update --init --recursive --depth=1
 
       - name: Install Linux dependencies
         shell: bash
@@ -69,7 +85,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: recursive
+          submodules: false
+
+      - name: Fetch submodules with private repo token
+        shell: bash
+        env:
+          FSUI_SUBMODULE_TOKEN: ${{ secrets.FSUI_SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "$FSUI_SUBMODULE_TOKEN" ]; then
+            echo "FSUI_SUBMODULE_TOKEN is required to fetch the private fsui-lib submodule." >&2
+            exit 1
+          fi
+
+          auth="$(printf 'x-access-token:%s' "$FSUI_SUBMODULE_TOKEN" | base64 | tr -d '\n')"
+          git config --global http.https://git.nanodata.cloud/.extraheader "AUTHORIZATION: basic $auth"
+          git submodule sync --recursive
+          git submodule update --init --recursive --depth=1
 
       - name: Install MinGW toolchains
         shell: bash
@@ -103,7 +135,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: recursive
+          submodules: false
+
+      - name: Fetch submodules with private repo token
+        shell: bash
+        env:
+          FSUI_SUBMODULE_TOKEN: ${{ secrets.FSUI_SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "$FSUI_SUBMODULE_TOKEN" ]; then
+            echo "FSUI_SUBMODULE_TOKEN is required to fetch the private fsui-lib submodule." >&2
+            exit 1
+          fi
+
+          auth="$(printf 'x-access-token:%s' "$FSUI_SUBMODULE_TOKEN" | base64 | tr -d '\n')"
+          git config --global http.https://git.nanodata.cloud/.extraheader "AUTHORIZATION: basic $auth"
+          git submodule sync --recursive
+          git submodule update --init --recursive --depth=1
 
       - name: Install Android build dependencies
         shell: bash
@@ -169,7 +217,23 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          submodules: recursive
+          submodules: false
+
+      - name: Fetch submodules with private repo token
+        shell: bash
+        env:
+          FSUI_SUBMODULE_TOKEN: ${{ secrets.FSUI_SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          if [ -z "$FSUI_SUBMODULE_TOKEN" ]; then
+            echo "FSUI_SUBMODULE_TOKEN is required to fetch the private fsui-lib submodule." >&2
+            exit 1
+          fi
+
+          auth="$(printf 'x-access-token:%s' "$FSUI_SUBMODULE_TOKEN" | base64 | tr -d '\n')"
+          git config --global http.https://git.nanodata.cloud/.extraheader "AUTHORIZATION: basic $auth"
+          git submodule sync --recursive
+          git submodule update --init --recursive --depth=1
 
       - name: Install WASM packaging tools
         shell: bash