GitLab CI "fatal: could not read Username" - CI_JOB_TOKEN Clone Fails
A git command tried to authenticate interactively in CI, where there is no terminal. It needs the CI_JOB_TOKEN baked into the URL, and the target project must allow this project’s job token.
What this error means
Cloning a dependency repo, fetching a private submodule, or pulling from another project fails with "fatal: could not read Username for ...: No such device or address" - git has no credentials and nowhere to prompt.
Cloning into 'shared-lib'...
fatal: could not read Username for 'https://gitlab.com': No such device or addressCommon causes
No token in the clone URL
A plain git clone https://gitlab.com/group/private.git has no credentials. In CI there is no prompt, so git fails immediately.
Job token not authorized for the target project
Even with CI_JOB_TOKEN, the target project must list this project in its CI/CD job-token allowlist, or the token is rejected.
How to fix it
Authenticate with CI_JOB_TOKEN
Embed the job token in the clone URL (or rewrite the host) so git authenticates non-interactively.
git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/group/private-lib.git
# or rewrite for submodules
git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/".insteadOf "https://gitlab.com/"Allow the job token in the target project
- In the target project: Settings → CI/CD → Job token permissions.
- Add the source project to the allowlist so its
CI_JOB_TOKENis accepted. - For submodules, set
GIT_SUBMODULE_STRATEGY: recursiveand theinsteadOfrewrite.
How to prevent it
- Use
CI_JOB_TOKEN(or a deploy token) for cross-project clones, never interactive auth. - Maintain the job-token allowlist when projects depend on each other.
- Configure submodule URL rewrites once via
before_script.