fix(githttp): skip limited repo check for action tokens

Action tokens have their access already validated earlier in the flow, so they should bypass the limited visibility repository check for clone/pull operations.

routers/web/repo/githttp.go

@@ -221,7 +221,8 @@ func httpBase(ctx *context.Context) *serviceHandler {
 			}
 
 			// Block clone/pull for limited visibility repos if user is not a collaborator
-			if repo.IsLimited && isPull && !isWiki {
+			// Skip this check for action tokens — their access was already validated above
+			if repo.IsLimited && isPull && !isWiki && ctx.Data["IsActionsToken"] != true {
 				allowed := ctx.Doer.IsAdmin || ctx.Doer.ID == repo.OwnerID
 				if !allowed {
 					if isCollab, _ := repo_model.IsCollaborator(ctx, repo.ID, ctx.Doer.ID); isCollab {