Gitea actions fetch submodule lfs file error: `git-lfs: api error: Authentication required: Unauthorized`

[dangjinghao]

Description

Hello,

I have 2 repositories in the same organization blog, A is B's submodule. and there are some files saved as lfs in A.

I'm using actions/checkout@v4, here is the job configuration (in B's workflow)

  Generate-And-Deploy:
    runs-on: ubuntu-latest
    needs: Check-Private-Info
    steps:
      - name: checkout source
        uses: actions/checkout@v4
        with:
          submodules: 'recursive'
          lfs: true
        env:
          GIT_CURL_VERBOSE: '1'
          GIT_TRACE: '1'

When the lfs is true and submodules is enabled, actions/checkout will pull submodules and lfs files, but this process could not be finished because the server will return git-lfs: api error: Authentication required: Unauthorized.

Partial log:

00:24:06.499738 trace git-lfs: tq: running as batched queue, batch size of 100
00:24:06.499908 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-article.svg"
00:24:06.501526 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-categories.svg"
00:24:06.502704 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-notice.svg"
00:24:06.503530 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-tags.svg"
00:24:06.504776 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-toc.svg"
00:24:06.505598 trace git-lfs: filepathfilter: accepting "layout/_svg/x.svg"
00:24:06.506518 trace git-lfs: filepathfilter: accepting "layout/_svg/xx.svg"
00:24:06.507079 trace git-lfs: filepathfilter: accepting "layout/_svg/xxx.svg"
00:24:06.507671 trace git-lfs: filepathfilter: accepting "layout/_svg/xxxx.svg"
00:24:06.508214 trace git-lfs: filepathfilter: accepting "layout/_svg/xxxxx.svg"
00:24:06.511107 trace git-lfs: filepathfilter: accepting "source/favicon.ico"
00:24:06.511687 trace git-lfs: filepathfilter: accepting "source/xx.png"
00:24:06.512263 trace git-lfs: filepathfilter: accepting "source/xxx.png"
00:24:06.512978 trace git-lfs: tq: sending batch of size 13
00:24:06.513664 trace git-lfs: api: batch 13 files
00:24:06.514614 trace git-lfs: HTTP: POST https://example.com/blog/A.git/info/lfs/objects/batch
> POST /blog/A.git/info/lfs/objects/batch HTTP/1.1
> Host: example.com
> Accept: application/vnd.git-lfs+json
> Authorization: Basic * * * * *
> Content-Length: 1269
> Content-Type: application/vnd.git-lfs+json; charset=utf-8
> User-Agent: git-lfs/3.7.0 (GitHub; linux amd64; go 1.24.4)
> 
{"operation":"download","objects":[{"oid":"c34901e698c7fb37536287bc6f0846ad1261ba6fe24cad7ca42e49bb5a3a8a2d","size":4323},{"oid":"d6df376c445c02e8a51783c7bc9b71ddc3193febe3e922dd2073fb4de90d148a","size":4277},{"oid":"5339f57b037cd6987615634aa1be12beb07ae134f4c7ee301fd4ea416f5d266d","size":3290},{"oid":"a8f47db2ea1d02c1a3b296234dcd5e8fed67b97daed6c9e23644229bdc36d58f","size":2708},{"oid":"be1318bffbc7a9490e83a766ff5a62bdbdab20b06216f881d0b0acc0c39f387a","size":2690},{"oid":"890de78918022b5d121ac194f1dd7ffb7108e9b10cf876f5ca79861dbf4dec8f","size":1840},{"oid":"95dbb70e5be8eb66290ab464a6b37ab890a05b58e9b8bb5188d9ead88100ec82","size":1692},{"oid":"8bc85b2c10be14be6f63919804c1575395316b7a95989a2df69d6a6c55b85299","size":1547},{"oid":"15ea4fc0b2d34058e884b3d54e68d20607b951040d0f5421211e83a5d2e39706","size":1408},{"oid":"1ad8d892ea9ea902e8c12ed30cb1ae8d5d36e632b63181fb61cbfb55a95ef572","size":995},{"oid":"fdb2d4d2f6e7600658fe5795fdc903eb4a6dc428ad4ecc55bcb8ad1662fe5513","size":970},{"oid":"7ca0e88ff17b17e3582c40e4c5291d3704d4c21702cfc3901c7a9c6643a0a1b1","size":870},{"oid":"5aed5ca76b9074c6fe64e52136a2af43a3453c626c1cc833f0070c5d2a7a79b3","size":796}],"transfers":["lfs-standalone-file","basic","ssh"],"ref":{"name":"refs/heads/master"},"hash_algo":"sha256"}00:24:06.793504 trace git-lfs: HTTP: 401
< HTTP/2.0 401 Unauthorized
< Content-Length: 27
< Alt-Svc: h3=":443"; ma=2592000
< Cache-Control: max-age=0, private, must-revalidate, no-transform
< Content-Type: application/vnd.git-lfs+json
< Date: Sun, 27 Jul 2025 16:24:06 GMT
< Set-Cookie: xxx; Path=/; HttpOnly; Secure; SameSite=Lax
< Set-Cookie: _csrf=xxx; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax
< Via: 1.1 Caddy
< Www-Authenticate: Basic realm="gitea-lfs"
< X-Frame-Options: SAMEORIGIN
< 
00:24:06.799615 trace git-lfs: HTTP: {"Message":"Unauthorized"}
{"Message":"Unauthorized"}
00:24:06.800557 trace git-lfs: setting repository access to basic
00:24:06.801212 trace git-lfs: exec: git 'config' '--includes' '--replace-all' 'lfs.https://example.com/blog/A.git/info/lfs.access' 'basic'
00:24:06.804514 trace git-lfs: api error: Authentication required: Unauthorized
00:24:06.805273 trace git-lfs: tq: running as batched queue, batch size of 100
00:24:06.805357 trace git-lfs: filepathfilter: accepting "layout/_svg/icon-article.svg"
Downloading layout/_svg/icon-article.svg (1.5 KB)
00:24:06.805397 trace git-lfs: tq: running as batched queue, batch size of 100
00:24:06.805427 trace git-lfs: tq: sending batch of size 1
00:24:06.805648 trace git-lfs: api: batch 1 files
00:24:06.805980 trace git-lfs: HTTP: POST https://example.com/blog/A.git/info/lfs/objects/batch
> POST /blog/A.git/info/lfs/objects/batch HTTP/1.1
> Host: example.com
> Accept: application/vnd.git-lfs+json
> Authorization: Basic * * * * *
> Content-Length: 229
> Content-Type: application/vnd.git-lfs+json; charset=utf-8
> User-Agent: git-lfs/3.7.0 (GitHub; linux amd64; go 1.24.4)
> 
{"operation":"download","objects":[{"oid":"8bc85b2c10be14be6f63919804c1575395316b7a95989a2df69d6a6c55b85299","size":1547}],"transfers":["lfs-standalone-file","basic","ssh"],"ref":{"name":"refs/heads/master"},"hash_algo":"sha256"}00:24:06.944070 trace git-lfs: HTTP: 401
< HTTP/2.0 401 Unauthorized
< Content-Length: 27
< Alt-Svc: h3=":443"; ma=2592000
< Cache-Control: max-age=0, private, must-revalidate, no-transform
< Content-Type: application/vnd.git-lfs+json
< Date: Sun, 27 Jul 2025 16:24:06 GMT
< Set-Cookie: xxx; Path=/; HttpOnly; Secure; SameSite=Lax
< Set-Cookie: _csrf=xxx; Path=/; Max-Age=86400; HttpOnly; Secure; SameSite=Lax
< Via: 1.1 Caddy
< Www-Authenticate: Basic realm="gitea-lfs"
< X-Frame-Options: SAMEORIGIN
< 
00:24:06.944208 trace git-lfs: HTTP: {"Message":"Unauthorized"}
{"Message":"Unauthorized"}
00:24:06.944251 trace git-lfs: api error: Authentication required: Unauthorized
Error downloading object: layout/_svg/icon-article.svg (8bc85b2): Smudge error: Error downloading layout/_svg/icon-article.svg (8bc85b2c10be14be6f63919804c1575395316b7a95989a2df69d6a6c55b85299): batch response: Authentication required: Unauthorized
00:24:06.944855 trace git-lfs: exec: git '-c' 'filter.lfs.smudge=' '-c' 'filter.lfs.clean=' '-c' 'filter.lfs.process=' '-c' 'filter.lfs.required=false' 'rev-parse' '--git-dir'
00:24:06.949085 trace git-lfs: exec: git '-c' 'filter.lfs.smudge=' '-c' 'filter.lfs.clean=' '-c' 'filter.lfs.process=' '-c' 'filter.lfs.required=false' 'remote'
Errors logged to '/workspace/blog/B/.git/modules/themes/A/lfs/logs/20250728T002406.944356469.log'.
Use `git lfs logs last` to view the log.
error: external filter 'git-lfs filter-process' failed
fatal: layout/_svg/icon-article.svg: smudge filter lfs failed
fatal: Unable to checkout '1881e767f4f87b056cec48d55e52d851b61a71ca' in submodule path 'themes/A'
::remove-matcher owner=checkout-git::
::error::The process '/usr/bin/git' failed with exit code 128
  ❌  Failure - Main checkout source
exitcode '1': failure

It can be reproduced.

possible releated to #23824.

Gitea Version

1.24.2

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

2.49.0

Operating System

docker image: gitea/gitea:latest

How are you running Gitea?

gitea server docker image: gitea/gitea:latest
gitea runner docker image: gitea/act_runner:latest (v0.2.12)

Database

SQLite