go mod tidy with Private GitLab

When you run go mod tidy and your go.mod has dependencies from a private GitLab instance, Go will fail to fetch them because it can't authenticate.

go: module git.your-company.com/team/pkg: reading ...: 401 Unauthorized

Fix: Create a .netrc File

nano ~/.netrc

Add this:

machine git.your-company.com
login your-username
password your-access-token

Use a Personal Access Token with read_api scope, not your account password. Generate one from Profile → Access Tokens in GitLab.

Set Permissions

chmod 600 ~/.netrc

Tell Go to Skip the Proxy for Private Modules (Optional)

By default Go routes all module fetches through proxy.golang.org, which can't reach your private server. If .netrc alone isn't enough, add this to your shell profile (.zshrc or .bashrc):

export GONOSUMCHECK=git.your-company.com
export GOFLAGS="-mod=mod"
go env -w GONOSUMDB="git.your-company.com"
go env -w GOPRIVATE="git.your-company.com"

Run Again

go mod tidy

No more 401. Go will now fetch private modules directly using your .netrc credentials.