387a53d37c
The default per-job Actions token only covers the triggering repo; the theme submodule lives in a separate private repo (hmk/pelican-latex), so cloning it needs a token with read access to both. Add CHECKOUT_TOKEN as a repo secret (a Gitea access token with repo read scope) for this to work.