Skip to content
Latchkey

Go Private Module Auth - Fix "terminal prompts disabled" in CI

Go tried to fetch a private module over Git and had no credentials. In CI there is no terminal to prompt for a password, so the clone fails outright - and without GOPRIVATE, Go may also try the public proxy and checksum database, which cannot see your private repo.

What this error means

A module fetch fails with fatal: could not read Username for https://github.com: terminal prompts disabled, or a 403/404 for a private path. Public modules resolve fine; only the private ones fail.

go output
go: github.com/yourorg/internal@v1.2.0: git ls-remote ... in
/home/runner/go/pkg/mod/cache/vcs/...: exit status 128:
	fatal: could not read Username for 'https://github.com': terminal prompts disabled

Common causes

No Git credentials on the runner

The private repo needs authentication, but CI has no token or SSH key wired into Git, so the clone has nothing to authenticate with.

GOPRIVATE not set

Without GOPRIVATE, Go routes private paths through the public proxy and sum database, which return not-found and add confusing errors on top of the auth failure.

How to fix it

Set GOPRIVATE and inject a token

Mark the org private and give Git a token-based credential for HTTPS clones.

Terminal
export GOPRIVATE=github.com/yourorg/*
git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
go mod download

Or authenticate over SSH

Terminal
export GOPRIVATE=github.com/yourorg/*
git config --global url."git@github.com:".insteadOf "https://github.com/"
# with the deploy key / SSH agent already configured

Disable terminal prompts for a clean failure

  1. Set GIT_TERMINAL_PROMPT=0 so a missing credential fails fast instead of hanging.
  2. Confirm GOPRIVATE covers every private path (comma-separated globs).
  3. Test with go mod download github.com/yourorg/internal in isolation.

How to prevent it

  • Set GOPRIVATE for all internal module paths.
  • Provide a scoped token or SSH key via CI secrets and insteadOf rewrites.
  • Keep credentials out of go.mod and logs.

Related guides

Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →