{"record":{"id":"025c61d40ea92033","repo":"denoland/deno","slug":"github-ref-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_REF environment variable is not set","messagePattern":"GITHUB_REF environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":183,"sourceCode":"      anyhow!(\"GITHUB_REPOSITORY environment variable is not set\")\n    })?;\n    let rel_ref = std::env::var(\"GITHUB_WORKFLOW_REF\")\n      .unwrap_or_default()\n      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {\n          workflow: GhaWorkflow {\n            ref_: workflow_ref.to_string(),\n            repository: format!(\"{}/{}\", server_url, &repo),","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L165-L201","documentation":"Provenance predicate construction reads `GITHUB_REF` (the branch/tag ref that triggered the workflow, e.g. `refs/tags/v1.2.3`) to record what triggered the build in the SLSA attestation. GitHub-hosted and self-hosted runners set it automatically; if it is missing the Actions context is incomplete and Deno cannot produce a valid predicate.","triggerScenarios":"`deno publish --provenance` executed with a scrubbed/partial environment (container actions, `env -i`, re-exec through a service); custom CI that sets GITHUB_REPOSITORY/GITHUB_SERVER_URL but not the full trigger context; scripts sourcing only a subset of runner vars.","commonSituations":"Containerized or wrapped publish steps that forward only auth-related env vars; forked workflows with reduced context; locally emulating CI by exporting a few GITHUB_* vars by hand.","solutions":["Forward the complete Actions environment into the publish process (container `env:` mappings or `--env-file` including GITHUB_REF).","Run the publish step as a normal workflow step so the runner injects all default env vars.","Omit `--provenance` when the environment cannot provide full GHA metadata."],"exampleFix":"# before (partial env forwarded)\ndocker run -e GITHUB_REPOSITORY my-publisher deno publish --provenance\n\n# after (full trigger context forwarded)\ndocker run -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_REF \\\n  -e GITHUB_SHA -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT \\\n  -e RUNNER_ENVIRONMENT my-publisher deno publish --provenance","handlingStrategy":"validation","validationCode":"const needed = ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',\n  'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT'];\nconst missing = needed.filter((k) => !Deno.env.get(k));\nif (missing.length) {\n  console.error(`Missing provenance env vars: ${missing.join(', ')}`);\n  Deno.exit(1);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_REF')) {\n    // the trigger context is absent; run inside the workflow or drop --provenance\n  }\n}","preventionTips":["Run publish as a first-class workflow step so the runner injects GITHUB_REF and friends.","Do not hand-pick a subset of GITHUB_* vars when wrapping publish; forward the whole set.","Gate --provenance on detecting a complete GHA environment."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}