Go Private Module Auth - Fix "terminal prompts disabled" in CI
Go tried to fetch a private module over Git and had no credentials. In CI there is no terminal to prompt for a password, so the clone fails outright - and without GOPRIVATE, Go may also try the public proxy and checksum database, which cannot see your private repo.
What this error means
A module fetch fails with fatal: could not read Username for https://github.com: terminal prompts disabled, or a 403/404 for a private path. Public modules resolve fine; only the private ones fail.
go: github.com/yourorg/internal@v1.2.0: git ls-remote ... in
/home/runner/go/pkg/mod/cache/vcs/...: exit status 128:
fatal: could not read Username for 'https://github.com': terminal prompts disabledCommon causes
No Git credentials on the runner
The private repo needs authentication, but CI has no token or SSH key wired into Git, so the clone has nothing to authenticate with.
GOPRIVATE not set
Without GOPRIVATE, Go routes private paths through the public proxy and sum database, which return not-found and add confusing errors on top of the auth failure.
How to fix it
Set GOPRIVATE and inject a token
Mark the org private and give Git a token-based credential for HTTPS clones.
export GOPRIVATE=github.com/yourorg/*
git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/"
go mod downloadOr authenticate over SSH
export GOPRIVATE=github.com/yourorg/*
git config --global url."git@github.com:".insteadOf "https://github.com/"
# with the deploy key / SSH agent already configuredDisable terminal prompts for a clean failure
- Set
GIT_TERMINAL_PROMPT=0so a missing credential fails fast instead of hanging. - Confirm
GOPRIVATEcovers every private path (comma-separated globs). - Test with
go mod download github.com/yourorg/internalin isolation.
How to prevent it
- Set
GOPRIVATEfor all internal module paths. - Provide a scoped token or SSH key via CI secrets and
insteadOfrewrites. - Keep credentials out of go.mod and logs.