# actions/checkout "could not read Username: terminal prompts disabled" in CI

> Fix git "fatal: could not read Username for 'https://github.com': terminal prompts disabled" in CI - a private repo or submodule was fetched over HTTPS with no token, so git tried to prompt.

Source: https://latchkey.dev/learn/git/gcs-checkout-could-not-read-username-terminal-prompts-disabled-in-ci  
Updated: 2026-06-30

git needs credentials for a private HTTPS remote and found none, so it tried to prompt for a username. CI has no terminal, so git aborts with "terminal prompts disabled". The remote is private and no token was supplied to that fetch.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes actions/checkout "could not read Username: terminal prompts disabled" in CI?

There are 2 common causes: the default github_token cannot read another private repo and a raw git clone step ran without embedding a token. actions/checkout authenticates the main repo with the automatic GITHUB_TOKEN, but that token is scoped to the current repository.

### How do I fix actions/checkout "could not read Username: terminal prompts disabled" in CI?

There are 2 fixes depending on which cause you have: pass a token that can read every repo you fetch and rewrite https to an authenticated url for raw clones. Work through them in order, since the first is the most common.

### What does actions/checkout "could not read Username: terminal prompts disabled" in CI actually mean?

A checkout or submodule fetch fails with "fatal: could not read Username for 'https://github.com': terminal prompts disabled".

### How do I stop actions/checkout "could not read Username: terminal prompts disabled" in CI happening again?

Use a token with read scope for every private repo a job touches, not just the current one. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt