CI: authenticate pushes to subrepositories properly

Signed-off-by: Stephen Gutekanst <stephen@hexops.com>

.github/workflows/push_subrepos.yml

@@ -9,9 +9,9 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v2
-      with:
-        token: ${{ secrets.HEXOPS_MACH_PUSH_SUBREPOS }}
-    - name: 'gpu/dawn: use latest binary release'
+    - name: 'Push recent commits to subrepositories'
+      env:
+        ACCESS_TOKEN: ${{ secrets.HEXOPS_MACH_PUSH_SUBREPOS }}
       run: |
         git config user.name 'Repository synchronization automation'
         git config user.email 'stephen@hexops.com'

dev/update-subrepos.sh

@@ -2,12 +2,12 @@
 set -exuo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"/..
 
-if [[ -z "${GITHUB_ACTIONS}" ]]; then
+if [[ -z ${GITHUB_ACTIONS+""} ]]; then
     git remote add -f mach-glfw git@github.com:hexops/mach-glfw || true
     git remote add -f mach-gpu-dawn git@github.com:hexops/mach-gpu-dawn || true
 else
-    git remote add -f mach-glfw https://github.com/hexops/mach-glfw || true
-    git remote add -f mach-gpu-dawn https://github.com/hexops/mach-gpu-dawn || true
+    git remote add -f mach-glfw "https://slimsag:$ACCESS_TOKEN@github.com/hexops/mach-glfw" || true
+    git remote add -f mach-gpu-dawn "https://slimsag:$ACCESS_TOKEN@github.com/hexops/mach-gpu-dawn" || true
 fi
 
 git fetch mach-glfw