I've been banging my head against GitHub Actions and using private repositories as git dependencies for most of the day, so I thought I'd do a write-up on the solution I arrived at.
I like this one because it isn't very intrusive and scales well without having the security concerns you get with Personal Access Tokens.