Pulling a git submodule with private access from a Github action

Question

I'm trying to pull a git submodule during my 'push' github action. The submodule is a private repository.

I've created a PAT with read-only access to my repositories. And I've added the contents of that PAT as a secret in the git repo (not the submodule).

This is my github action file:

name: Java CI

on: [ push ]

env:
  SUBMODULE_ACCESS: ${{ secrets.SUBMODULE_ACCESS }}

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
      - name: Update submodules
        run: |
          git config --global url."https://${SUBMODULE_ACCESS}:[email protected]/".insteadOf "https://github.com/"
          git submodule update --init --recursive
      - name: Set up JDK 19
        uses: actions/setup-java@v2
        with:
          java-version: '19'
          distribution: 'adopt'
      - name: Cache local .m2
        uses: actions/cache@v2
        with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-maven-${{ hashFiles('**.pom.xml') }}
          restore-keys: |
            ${{ runner.os }}-maven-
      - name: Run lints and test with Maven
        run: mvn clean install -Dall

When I run this, I see the following error:

remote: Support for password authentication was removed on August 13, 2021. remote: Please see https://docs.github.com/en/get-started/getting-started-with-git/about-remote-repositories#cloning-with-https-urls for information on currently recommended modes of authentication.

But that link just mentions PATs, which I think I've set up?