Deployment keys not used within setup for git submodules

[jeroenrinzema]

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug, and:

• The documentation does not mention anything about my problem
• There are no open or closed issues that are related to my problem

Description

Hi, I noticed that the build-push-action@v2 is attempting to clone the submodules within the repository. It looks like the action is not using the previously configured/updated git configurations correctly causing the step to fail:

      - name: Setup *** SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.***_DEPLOY_KEY }}" > ~/.ssh/id_rsa_***
          chmod 600 ~/.ssh/id_rsa_***

          ssh-keyscan github.com >> ~/.ssh/known_hosts

          cat >> ~/.ssh/config <<'EOF'
          Host github.com-***
            HostName github.com
            User git
            IdentityFile ~/.ssh/id_rsa_***
            IdentitiesOnly yes
          EOF

          git config --global url."git@github.com-***:***/".insteadOf "git@github.com:***/"

Expected behaviour

I expect the submodule to be cloned using my previously created ssh configurations.

Actual behaviour

Action fails due to breaking/missing submodule

Repository URL

No response

Workflow run URL

No response

YAML workflow

name: _build (reusable)

on:
  workflow_call:

jobs:
  build:
    name: Build docker images
    runs-on: blacksmith-4vcpu-ubuntu-2204
    steps:
      - name: Set up Docker Buildx
        uses: useblacksmith/setup-docker-builder@v1
    
      # TODO: this step is temporary until the project is OSS
      - name: Setup *** SSH key
        run: |
          mkdir -p ~/.ssh
          echo "${{ secrets.***_DEPLOY_KEY }}" > ~/.ssh/id_rsa_***
          chmod 600 ~/.ssh/id_rsa_***

          ssh-keyscan github.com >> ~/.ssh/known_hosts

          cat >> ~/.ssh/config <<'EOF'
          Host github.com-***
            HostName github.com
            User git
            IdentityFile ~/.ssh/id_rsa_***
            IdentitiesOnly yes
          EOF

          git config --global url."git@github.com-***:***/".insteadOf "git@github.com:***/"
          
      - uses: actions/checkout@v5
        with:
            submodules: recursive

      - uses: yokawasa/action-setup-kube-tools@v0.11.1
        with:
          setup-tools: |
            helm
            skaffold
          helm: "3.17.3"
          skaffold: "2.15.0"

      - name: Blacksmith Docker cache
        uses: useblacksmith/build-push-action@v2
        with:
          setup-only: true

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build images
        run: skaffold build --file-output skaffold.json --default-repo ghcr.io/${{ github.repository }} --build-concurrency=0 --push
      
      - name: Upload artifact
        uses: actions/upload-artifact@v4
        with:
          name: skaffold
          path: skaffold.json

Workflow logs

Run useblacksmith/build-push-action@v2

GitHub Actions runtime token ACs
Docker info
Check buildx availability
Buildx version

Checking for configured builder
Setting up build metrics tracking
Builder info
Proxy configuration
Inputs.context: https://github.com/***/***.git#***
Final context: https://github.com/***/***.git#***
/usr/bin/docker buildx build --iidfile /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-iidfile-abc781dbcc.txt --attest type=provenance,mode=min,inline-only=true,builder-id=https://github.com/***/***/actions/runs/18462720894/attempts/1 --secret id=GIT_AUTH_TOKEN,src=/home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/tmp-4478-6ZHmDsV00l62 --metadata-file /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-metadata-a06b0ead90.json https://github.com/***/***.git#*** --debug
#0 building with "blacksmith-mgozm5j1" instance using remote driver
#1 [internal] load git source https://github.com/***/***.git#***
#1 0.008 Initialized empty Git repository in /var/lib/buildkit/runc-overlayfs/snapshots/snapshots/1/fs/
#1 0.012 fatal: Not a valid object name ^{commit}
#1 0.716 From https://github.com/***/
#1 0.716 * branch *** -> FETCH_HEAD
#1 0.741 Submodule 'platform' (git@github.com:/platform.git) registered for path 'oss'
#1 0.743 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
#1 1.230 git@github.com: Permission denied (publickey).
#1 1.230 fatal: Could not read from remote repository.
#1 1.230
#1 1.230 Please make sure you have the correct access rights
#1 1.230 and the repository exists.
#1 1.232 fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
#1 1.232 Failed to clone 'oss'. Retry scheduled
#1 1.234 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
#1 1.707 git@github.com: Permission denied (publickey).
#1 1.708 fatal: Could not read from remote repository.
#1 1.708
#1 1.708 Please make sure you have the correct access rights
#1 1.708 and the repository exists.
#1 1.709 fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
#1 1.709 Failed to clone 'oss' a second time, aborting
#1 ERROR: failed to update submodules for https://github.com/***/***.git: git stderr:
Submodule 'platform' (git@github.com:/platform.git) registered for path 'oss'
Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
Failed to clone 'oss'. Retry scheduled
Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
Failed to clone 'oss' a second time, aborting
: exit status 1

[internal] load git source https://github.com/***/***.git#:
1.232 fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
1.232 Failed to clone 'oss'. Retry scheduled
1.234 Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
1.707 git@github.com: Permission denied (publickey).
1.708 fatal: Could not read from remote repository.
1.708
1.708 Please make sure you have the correct access rights
1.708 and the repository exists.
1.709 fatal: clone of 'git@github.com:***/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
1.709 Failed to clone 'oss' a second time, aborting

---

WARNING: No output specified with remote driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
ERROR: failed to solve: failed to read dockerfile: failed to update submodules for https://github.com/***/***.git: git stderr:
Submodule 'platform' (git@github.com:/platform.git) registered for path 'oss'
Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'git@github.com:/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
Failed to clone 'oss'. Retry scheduled
Cloning into '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'git@github.com:***/platform.git' into submodule path '/var/lib/buildkit/runc-overlayfs/snapshots/snapshots/2/fs/oss' failed
Failed to clone 'oss' a second time, aborting
: exit status 1
3957 v0.24.0 buildkitd --debug --config=buildkitd.toml --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
github.com/moby/buildkit/frontend/dockerui.(*Client).ReadEntrypoint
/src/frontend/dockerui/config.go:394
github.com/moby/buildkit/frontend/dockerfile/builder.Build
/src/frontend/dockerfile/builder/build.go:48
github.com/moby/buildkit/frontend/gateway/forwarder.(*GatewayForwarder).Solve
/src/frontend/gateway/forwarder/frontend.go:36
github.com/moby/buildkit/solver/llbsolver.(*provenanceBridge).Solve
/src/solver/llbsolver/provenance.go:178
github.com/moby/buildkit/frontend/gateway.(*llbBridgeForwarder).Solve
/src/frontend/gateway/gateway.go:770
github.com/moby/buildkit/control/gateway.(*GatewayForwarder).Solve
/src/control/gateway/gateway.go:114
github.com/moby/buildkit/frontend/gateway/pb._LLBBridge_Solve_Handler.func1
/src/frontend/gateway/pb/gateway_grpc.pb.go:365
google.golang.org/grpc.getChainUnaryHandler.func1
/src/vendor/google.golang.org/grpc/server.go:1217
main.unaryInterceptor
/src/cmd/buildkitd/main.go:731
google.golang.org/grpc.NewServer.chainUnaryServerInterceptors.chainUnaryInterceptors.func1
/src/vendor/google.golang.org/grpc/server.go:1208
github.com/moby/buildkit/frontend/gateway/pb._LLBBridge_Solve_Handler
/src/frontend/gateway/pb/gateway_grpc.pb.go:367
google.golang.org/grpc.(Server).processUnaryRPC
/src/vendor/google.golang.org/grpc/server.go:1405
google.golang.org/grpc.(Server).handleStream
/src/vendor/google.golang.org/grpc/server.go:1815
google.golang.org/grpc.(Server).serveStreams.func2.1
/src/vendor/google.golang.org/grpc/server.go:1035
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1700
4726 v0.23.0 /home/runner/.docker/cli-plugins/docker-buildx buildx build --iidfile /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-iidfile-abc781dbcc.txt --attest type=provenance,mode=min,inline-only=true,builder-id=https://github.com/***/***/actions/runs/18462720894/attempts/1 --secret id=GIT_AUTH_TOKEN,src=/home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/tmp-4478-6ZHmDsV00l62 --metadata-file /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-metadata-a06b0ead90.json https://github.com/***/***.git# --debug
google.golang.org/grpc.(*ClientConn).Invoke
google.golang.org/grpc@v1.69.4/call.go:35
github.com/moby/buildkit/frontend/gateway/pb.(*lLBBridgeClient).Solve
github.com/moby/buildkit@v0.21.0/frontend/gateway/pb/gateway_grpc.pb.go:98
github.com/moby/buildkit/client.(*gatewayClientForBuild).Solve
github.com/moby/buildkit@v0.21.0/client/build.go:98
github.com/moby/buildkit/frontend/gateway/grpcclient.(*grpcClient).Solve
github.com/moby/buildkit@v0.21.0/frontend/gateway/grpcclient/client.go:412
github.com/docker/buildx/build.BuildWithResultHandler.func3.4.2
github.com/docker/buildx/build/build.go:454
github.com/moby/buildkit/frontend/gateway/grpcclient.(*grpcClient).Run
github.com/moby/buildkit@v0.21.0/frontend/gateway/grpcclient/client.go:215
github.com/moby/buildkit/client.(*Client).Build.func2
github.com/moby/buildkit@v0.21.0/client/build.go:59
github.com/moby/buildkit/client.(*Client).solve.func3
github.com/moby/buildkit@v0.21.0/client/solve.go:295
golang.org/x/sync/errgroup.(*Group).Go.func1
golang.org/x/sync@v0.13.0/errgroup/errgroup.go:79
runtime.goexit
runtime/asm_amd64.s:1700
3957 v0.24.0 buildkitd --debug --config=buildkitd.toml --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
github.com/moby/buildkit/frontend/gateway.(*llbBridgeForwarder).Return
/src/frontend/gateway/gateway.go:1035
github.com/moby/buildkit/control/gateway.(*GatewayForwarder).Return
/src/control/gateway/gateway.go:146
github.com/moby/buildkit/frontend/gateway/pb._LLBBridge_Return_Handler.func1
/src/frontend/gateway/pb/gateway_grpc.pb.go:473
google.golang.org/grpc.getChainUnaryHandler.func1
/src/vendor/google.golang.org/grpc/server.go:1217
main.unaryInterceptor
/src/cmd/buildkitd/main.go:731
google.golang.org/grpc.NewServer.chainUnaryServerInterceptors.chainUnaryInterceptors.func1
/src/vendor/google.golang.org/grpc/server.go:1208
github.com/moby/buildkit/frontend/gateway/pb._LLBBridge_Return_Handler
/src/frontend/gateway/pb/gateway_grpc.pb.go:475
google.golang.org/grpc.(*Server).processUnaryRPC
/src/vendor/google.golang.org/grpc/server.go:1405
3957 v0.24.0 buildkitd --debug --config=buildkitd.toml --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
github.com/moby/buildkit/util/gitutil.(*GitCLI).Run
/src/util/gitutil/git_cli.go:240
github.com/moby/buildkit/source/git.(*gitSourceHandler).Snapshot
/src/source/git/source.go:650
github.com/moby/buildkit/solver/llbsolver/ops.(*SourceOp).Exec
/src/solver/llbsolver/ops/source.go:112
github.com/moby/buildkit/solver.(*sharedOp).Exec.func2
/src/solver/jobs.go:1120
github.com/moby/buildkit/util/flightcontrol.(call[...]).run
/src/util/flightcontrol/flightcontrol.go:122
sync.(Once).doSlow
/usr/local/go/src/sync/once.go:78
sync.(Once).Do
/usr/local/go/src/sync/once.go:69
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1700
4726 v0.23.0 /home/runner/.docker/cli-plugins/docker-buildx buildx build --iidfile /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-iidfile-abc781dbcc.txt --attest type=provenance,mode=min,inline-only=true,builder-id=https://github.com/***/***/actions/runs/18462720894/attempts/1 --secret id=GIT_AUTH_TOKEN,src=/home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/tmp-4478-6ZHmDsV00l62 --metadata-file /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-metadata-a06b0ead90.json https://github.com/***/***.git# --debug
google.golang.org/grpc.(*ClientConn).Invoke
google.golang.org/grpc@v1.69.4/call.go:35
github.com/moby/buildkit/api/services/control.(*controlClient).Solve
github.com/moby/buildkit@v0.21.0/api/services/control/control_grpc.pb.go:88
github.com/moby/buildkit/client.(Client).solve.func2
github.com/moby/buildkit@v0.21.0/client/solve.go:268
golang.org/x/sync/errgroup.(Group).Go.func1
golang.org/x/sync@v0.13.0/errgroup/errgroup.go:79
3957 v0.24.0 buildkitd --debug --config=buildkitd.toml --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
github.com/moby/buildkit/solver.(edge).execOp
/src/solver/edge.go:963
github.com/moby/buildkit/solver/internal/pipe.NewWithFunction[...].func2
/src/solver/internal/pipe/pipe.go:78
runtime.goexit
/usr/local/go/src/runtime/asm_amd64.s:1700
4726 v0.23.0 /home/runner/.docker/cli-plugins/docker-buildx buildx build --iidfile /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-iidfile-abc781dbcc.txt --attest type=provenance,mode=min,inline-only=true,builder-id=https://github.com/***/***/actions/runs/18462720894/attempts/1 --secret id=GIT_AUTH_TOKEN,src=/home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/tmp-4478-6ZHmDsV00l62 --metadata-file /home/runner/_work/_temp/docker-actions-toolkit-9JCZn2/build-metadata-a06b0ead90.json https://github.com/***/***.git# --debug
github.com/moby/buildkit/client.(*Client).solve.func2
github.com/moby/buildkit@v0.21.0/client/solve.go:285
golang.org/x/sync/errgroup.(*Group).Go.func1
golang.org/x/sync@v0.13.0/errgroup/errgroup.go:79
3957 v0.24.0 buildkitd --debug --config=buildkitd.toml --allow-insecure-entitlement security.insecure --allow-insecure-entitlement network.host
github.com/moby/buildkit/source/git.(*gitSourceHandler).Snapshot
/src/source/git/source.go:652
github.com/moby/buildkit/solver/llbsolver/ops.(*SourceOp).Exec
/src/solver/llbsolver/ops/source.go:112
Reporting build completion
Error: buildx failed with: /src/solver/llbsolver/ops/source.go:112

BuildKit logs

Additional info

No response