One way to allow building vendor archive (or even to download dependencies) when private repos are involved is to use an authenticating proxy (ie: https://github.com/goproxy/goproxy).
It uses environment variables to define the proxy address (GOPROXY) and the private repos (GONOSUMDB) (see https://go.dev/ref/mod#private-modules).
It especially useful for private instances owners that want to build using go packages hosted on private repos by setting up the authentication for those repos at the goproxy level.
One way to allow building vendor archive (or even to download dependencies) when private repos are involved is to use an authenticating proxy (ie: https://github.com/goproxy/goproxy). It uses environment variables to define the proxy address (GOPROXY) and the private repos (GONOSUMDB) (see https://go.dev/ref/mod#private-modules).
It especially useful for private instances owners that want to build using go packages hosted on private repos by setting up the authentication for those repos at the goproxy level.