feat(rust-build): support private git deps via opt-in git-token secret

When git-token is provided, the compile job configures a github.com credential (url.insteadOf) and CARGO_NET_GIT_FETCH_WITH_CLI, then inits submodules manually. This lets private cross-repo submodules and cargo git dependencies resolve. Behaviour is unchanged when the secret is unset.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Itsusinn

.github/workflows/rust-build.yml

@@ -56,6 +56,9 @@ on:
       sentry-dsn:
         description: 'Sentry DSN for error reporting'
         required: false
+      git-token:
+        description: 'Token (PAT or App token) with read access to private git dependencies / submodules. When set, the compile job configures git credentials so private cross-repo submodules and cargo git dependencies can be fetched. Leave unset for fully public projects.'
+        required: false
 
 defaults:
   run:
@@ -122,9 +125,27 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v6
         with:
-          submodules: true
+          # When a git-token is provided, submodules are initialised manually in
+          # the next step (after credentials are configured) so that private
+          # cross-repo submodules can be cloned. Otherwise behave as before.
+          submodules: ${{ secrets.git-token != '' && 'false' || 'true' }}
           fetch-depth: 1
 
+      - name: Configure private git credentials
+        if: ${{ secrets.git-token != '' }}
+        env:
+          GIT_TOKEN: ${{ secrets.git-token }}
+        run: |
+          # Authenticate all github.com access with the provided token so that
+          # private cross-repo submodules and cargo git dependencies resolve.
+          git config --global url."https://x-access-token:${GIT_TOKEN}@github.com/".insteadOf "https://github.com/"
+          # Make cargo use the git CLI (which honours the credential above) when
+          # fetching git dependencies.
+          echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"
+          # Now that credentials are set, initialise submodules.
+          git submodule sync --recursive
+          git submodule update --init --recursive
+
       # ── Sccache: restore/auto-save disk cache + local disk setup ──
       - name: Determine sccache directory
         if: inputs.enable-sccache