fix: use repo-local http.extraHeader for submodule auth

.gitea/workflows/release.yaml

@@ -16,13 +16,17 @@ jobs:
       matrix:
         goarch: [amd64, arm64]
     steps:
-      # Checkout step removed due to checkout failures. Replaced with manual clone below.
-      - name: Clone repository with auth
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          submodules: false
+
+      - name: Update submodules with repo-local auth
         run: |
-          git config --local http.extraheader "Authorization: Bearer ${{ gitea.token }}"
-          git clone --recursive https://${{ gitea.server_url }}/hainzero/WGRplane.git app
-          git config --unset http.extraheader  # Reset after use
-          ls -la app  # Debug
+          git -C . config http.extraheader "Authorization: Bearer ${{ gitea.token }}"
+          git submodule update --init --recursive
+          git -C . config --unset http.extraheader
+          ls -la app/  # Debug
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -58,13 +62,17 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      # Checkout step removed due to checkout failures. Replaced with manual clone below.
-      - name: Clone repository with auth
+      - name: Checkout code
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          submodules: false
+
+      - name: Update submodules with repo-local auth
         run: |
-          git config --local http.extraheader "Authorization: Bearer ${{ gitea.token }}"
-          git clone --recursive https://${{ gitea.server_url }}/hainzero/WGRplane.git app
-          git config --unset http.extraheader  # Reset after use
-          ls -la app  # Debug
+          git -C . config http.extraheader "Authorization: Bearer ${{ gitea.token }}"
+          git submodule update --init --recursive
+          git -C . config --unset http.extraheader
+          ls -la app/  # Debug
 
       - name: Download all artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
@@ -99,10 +107,13 @@ jobs:
           git checkout main
 
       - name: Commit and push latest.json
+        env:
+          GIT_ASKPASS: ${{ gitea.token }}
+          GIT_AUTHOR_NAME: "Gitea Actions"
+          GIT_AUTHOR_EMAIL: "actions@gitea.com"
+          GIT_COMMITTER_NAME: "Gitea Actions"
+          GIT_COMMITTER_EMAIL: "actions@gitea.com"
         run: |
-          git config user.name "Gitea Actions"
-          git config user.email "actions@gitea.com"
-          # Removed credentials-in-URL to comply with security guidelines
           git add latest.json
           git commit -m "Update latest.json for release ${{ gitea.ref_name }} [skip ci]" || echo "No changes to commit"
           git push origin main