Clone the wolfSSL ref instead of fetching into a shallow submodule

Author: aidangarske

.github/workflows/android.yml

@@ -67,10 +67,15 @@ jobs:
           # silently skipped this and every job built the 2024 submodule pin
           # while claiming to test master
           test -e wolfssl/.git || { echo "FAIL: wolfssl submodule not checked out"; exit 1; }
-          cd wolfssl
-          git fetch -q --depth 1 origin '${{ matrix.wolfssl_ref }}'
-          git checkout -q FETCH_HEAD
-          echo "wolfssl now at ${{ matrix.wolfssl_ref }}: $(git rev-parse --short HEAD)"
+          # Replace the tree rather than fetching into it: checkout@v5 clones the
+          # submodule shallow, and `git fetch --depth 1` then rewrites
+          # .git/modules/*/shallow under git's own read -- "fatal: shallow file has
+          # changed since we read it", which struck 1 leg in 6 while its identical
+          # sibling passed.
+          rm -rf wolfssl
+          git clone -q --depth 1 --branch '${{ matrix.wolfssl_ref }}' \
+            https://github.com/wolfSSL/wolfssl.git wolfssl
+          echo "wolfssl now at ${{ matrix.wolfssl_ref }}: $(git -C wolfssl rev-parse --short HEAD)"
 
       # The job title claims a ref; prove the tree matches it rather than
       # trusting that the checkout above did anything.