As for credentials issue it is a github issue where you can not add same deploy-key to two different repositories (If I am wrong here please let me know) .
As for a solution you are right, I would add flag that to the agent for example --submodules-pull <true|false>.

AstonishingSeaturtle47 yes it does. But I have to ask how come you have sub modules that one will have credentials for the master repo and not the sub ones? Also it sounds like a good solution would be for the trains-agent to try and pull the sub-modules and if it cannot, it should just print a warning and continue. What do you think?

I had a problem that related to deploy keys since each git repository needs a different deploy key. And both uses the same hostname, it failed, I hacked it using an alias of the submodule git host name

AstonishingSeaturtle47 How would the code run without the sub-modules? And what is the problem we are trying to solve? (Because unfortunately there is no switch to disable it)

AstonishingSeaturtle47 that's awesome! Could you explain the hack, it might be helpful for others (I assume :))

Wow very Nice thanks AgitatedDove14

AstonishingSeaturtle47 I think there's a workaround for the GitHub multiple repo issue. See https://gist.github.com/gubatron/d96594d982c5043be6d4

Well it is a bit ugly. I changed the hostname of my submodule then I added another key in the .ssh/config file. The problem is that now, who ever uses this repo needs to do something about that, so in order to avoid issues with the developers I added an alias in AWS (route 53 CNAME) from my-new-hostname to http://github.com . AgitatedDove14 Does that make sense to you?

FYI all the git pulls are cached even in docker mode so there is no "tax" to pay for pulling the sub-modules (only the first time of course)