{"record":{"id":"2899e434648f2297","repo":"denoland/deno","slug":"github-repository-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_REPOSITORY environment variable is not set","messagePattern":"GITHUB_REPOSITORY environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":165,"sourceCode":"\n#[derive(Serialize)]\n#[serde(rename_all = \"camelCase\")]\nstruct RunDetails {\n  builder: Builder,\n  metadata: Metadata,\n}\n\n#[derive(Serialize)]\n#[serde(rename_all = \"camelCase\")]\nstruct Predicate {\n  build_definition: BuildDefinition,\n  run_details: RunDetails,\n}\n\nimpl Predicate {\n  pub fn new_github_actions() -> Result<Self, AnyError> {\n    let repo = std::env::var(\"GITHUB_REPOSITORY\").map_err(|_| {\n      anyhow!(\"GITHUB_REPOSITORY environment variable is not set\")\n    })?;\n    let rel_ref = std::env::var(\"GITHUB_WORKFLOW_REF\")\n      .unwrap_or_default()\n      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L147-L183","documentation":"Building the SLSA provenance predicate for `deno publish --provenance` reads GitHub Actions runner metadata from the environment; `GITHUB_REPOSITORY` (owner/repo of the running workflow) is the first variable fetched and its absence means the process is not running with full GitHub Actions context. Provenance attestation only works inside a GitHub Actions run.","triggerScenarios":"Running `deno publish --provenance` on a local machine or non-GHA CI (GitLab, self-hosted scripts); a GHA step where env vars were scrubbed by a wrapper container; invoking the CLI through a service that sanitizes the environment.","commonSituations":"Testing the provenance flag locally before wiring CI; Docker actions that drop the default runner env; fork PRs where the workflow context differs.","solutions":["Move the publish step into a GitHub Actions workflow — provenance fundamentally requires GHA as the build system.","If the step runs in a container, pass runner env through (`env:` mapping or `--env` on docker run) so GITHUB_REPOSITORY and siblings are visible.","Do not use `--provenance` when publishing outside GitHub Actions; drop the flag for local/non-GHA publishing."],"exampleFix":"# before (local terminal)\ndeno publish --provenance\n\n# after (inside .github/workflows/publish.yml)\n- run: deno publish --provenance\n  env:\n    GITHUB_REPOSITORY: ${{ github.repository }}","handlingStrategy":"validation","validationCode":"function assertGhaContext(): void {\n  if (!Deno.env.get('GITHUB_REPOSITORY')) {\n    throw new Error(\n      'deno publish --provenance requires a GitHub Actions runner (GITHUB_REPOSITORY unset)',\n    );\n  }\n}","typeGuard":"const inGithubActions = (): boolean =>\n  !!Deno.env.get('GITHUB_REPOSITORY') &&\n  Deno.env.get('GITHUB_ACTIONS') === 'true';","tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_REPOSITORY')) {\n    // publish without --provenance, or move the step into GitHub Actions\n  }\n}","preventionTips":["Only pass --provenance inside a real GitHub Actions job.","If steps run in containers, forward the full GITHUB_*/RUNNER_* environment.","Make provenance conditional in scripts: add the flag only when the GHA context is detected."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}