What does go:go_private_repo_auth_failed mean?

Go reached the VCS layer, but Git could not authenticate or authorize the private repository without interactive input.

How can I manually validate go:go_private_repo_auth_failed?

Run `go env GOPROXY GOPRIVATE GONOPROXY` to confirm why Go selected direct VCS. Copy the repository URL from the `git ls-remote` or fetch failure and test it with `GIT_TERMINAL_PROMPT=0 git ls-remote ` in the same runner. Inspect URL rewrites with `git config --show-origin --get-regexp "^url\..*\.insteadOf$"` and confirm the key or credential helper is available without printing secrets.

Go error: private repository authentication failed and terminal prompts disabled

Q: How do I prevent go:go_private_repo_auth_failed in CI?

Test non-interactive Git access during runner-image validation. Use secret stores and short-lived credentials instead of repository URLs containing tokens. Document whether each private namespace is fetched through RepoFlow or directly from Git.

Fix it fast

Most likely: The runner lacks a usable non-interactive Git credential for the repository URL Go selected.

Confirm this is your error

Match the output and confirm you are troubleshooting the same failure.

fatal: could not read Username for 'https://github.com': terminal prompts disabled
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Check the cause

Run focused checks to identify what is failing in this environment.

go env GOPROXY GOPRIVATE GONOPROXY
git config --show-origin --get-regexp "^url\..*\.insteadOf$"
GIT_TERMINAL_PROMPT=0 git ls-remote <repository-url>

Apply the safe fix

Use the smallest safe change that addresses the confirmed cause.

# Direct VCS: configure HTTPS credentials or SSH keys through the secret store.
# Intended RepoFlow path: correct GOPROXY/GONOPROXY instead of adding GOPRIVATE.

Verify it works

Repeat the relevant checks and confirm the original error is gone.

GIT_TERMINAL_PROMPT=0 git ls-remote <repository-url>
go mod download <module>@<version>
go build ./...

What This Error Means

Read this as a precise clue about which part of the workflow broke first. Once you know the failing layer, the fix path gets much shorter.

How to Fix It

The fastest fixes here come from checking the immediate failing layer before you change anything unrelated. Make one correction at a time and re-test from the same environment.

HTTPS:configure a secret-backed credential helper or .netrc entry for the exact host.

SSH:provision the job-scoped key, known-hosts entry, and approved HTTPS-to-SSH rewrite.

Wrong repository or scope:correct the module path or grant least-privilege read access to the automation identity.

Wrong route:align GOPRIVATE, GONOPROXY, and GOPROXY with the approved VCS or RepoFlow strategy.

Container mismatch:configure credentials for the user running Go. Do not copy a developer home directory into the image.

Why It Happens

HTTPS credentials are missing, expired, for another host, or unavailable to the container user.

The SSH key is missing from the runner, the agent is not forwarded, or host-key verification is incomplete.

The repository path is wrong or the authenticated identity lacks access, which some hosts intentionally report as not found.

CI has different GOPRIVATE, GONOPROXY, or Git URL-rewrite configuration from the developer machine.

Verify the Fix

Run the non-interactive git ls-remote check, then go mod download <module>@<version> in the same environment.

Repeat the build and confirm the error is gone and no secret appears in logs.

Confirm the repository URL, transport, and non-interactive identity

Run go env GOPROXY GOPRIVATE GONOPROXY to confirm why Go selected direct VCS, copy the repository URL from the git ls-remote or fetch failure and test it with GIT_TERMINAL_PROMPT=0 git ls-remote <repository-url> in the same runner, and inspect URL rewrites with git config --show-origin --get-regexp "^url\..*\.insteadOf$" and confirm the key or credential helper is available without printing secrets.

How Go hands a private module fetch to Git

For a direct module fetch, Go invokes Git or another VCS client. Git uses its own HTTPS helpers, .netrc, SSH keys, known-hosts data, and URL rewrites. Proxy credentials do not authenticate Git. Go disables Git prompts by default, so CI credentials must work non-interactively.

Prevent It From Coming Back

To prevent this, test non-interactive Git access during runner-image validation, use secret stores and short-lived credentials instead of repository URLs containing tokens, and document whether each private namespace is fetched through RepoFlow or directly from Git.

Docs and source code

Go Modules Reference

Official reference for module files, version selection, proxies, private modules, checksums, workspaces, and vendoring. - Source

The go command uses module paths and versions to resolve, download, and authenticate dependencies.

Go FAQ: Git and private modules

Official guidance for HTTPS credentials, .netrc, SSH URL rewrites, and GOPRIVATE. - Source

Git authentication can use HTTPS credentials or an SSH rewrite, while GOPRIVATE classifies private paths.