{"record":{"id":"2899e434648f2297","repo":"denoland/deno","slug":"github-repository-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_REPOSITORY environment variable is not set","messagePattern":"GITHUB_REPOSITORY environment variable is not set","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":165,"sourceCode":"\n#[derive(Serialize)]\n#[serde(rename_all = \"camelCase\")]\nstruct RunDetails {\n  builder: Builder,\n  metadata: Metadata,\n}\n\n#[derive(Serialize)]\n#[serde(rename_all = \"camelCase\")]\nstruct Predicate {\n  build_definition: BuildDefinition,\n  run_details: RunDetails,\n}\n\nimpl Predicate {\n  pub fn new_github_actions() -> Result<Self, AnyError> {\n    let repo = std::env::var(\"GITHUB_REPOSITORY\").map_err(|_| {\n      anyhow!(\"GITHUB_REPOSITORY environment variable is not set\")\n    })?;\n    let rel_ref = std::env::var(\"GITHUB_WORKFLOW_REF\")\n      .unwrap_or_default()\n      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/cli/tools/publish/provenance.rs#L147-L183","documentation":"`deno publish --provenance` builds a SLSA predicate from GitHub Actions runner environment variables. `Predicate::new_github_actions` reads `GITHUB_REPOSITORY` first and throws this exact message when it is unset. On a real GitHub-hosted (or correctly configured self-hosted) runner this variable always exists, so hitting it means provenance signing is running outside a genuine GitHub Actions job or in a stripped environment.","triggerScenarios":"`deno publish --provenance` executed on a dev machine or in non-GitHub CI; running inside a container or wrapper where the Actions-provided environment variables were not forwarded into the process.","commonSituations":"Testing the provenance flag locally; calling publish from Docker with a minimal env; GitLab/Jenkins pipelines attempting Sigstore provenance.","solutions":["Move the publish step into a GitHub Actions workflow — Deno provenance is GitHub-Actions-only","If containerized, forward the runner env (GITHUB_*, RUNNER_ENVIRONMENT, ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)","Drop `--provenance` when publishing outside GitHub Actions"],"exampleFix":"# before\njobs:\n  publish:\n    runs-on: ubuntu-latest\n    steps:\n      - run: deno publish --provenance\n# after\njobs:\n  publish:\n    runs-on: ubuntu-latest\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      - uses: denoland/setup-deno@v2\n      - run: deno publish --provenance","handlingStrategy":"validation","validationCode":"if [ -z \"$GITHUB_REPOSITORY\" ]; then\n  echo \"deno publish --provenance requires a GitHub Actions runner (GITHUB_REPOSITORY unset)\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only pass --provenance inside GitHub Actions workflows","Grant the workflow `permissions: id-token: write` so the OIDC token is available","Guard CI with an env preflight for the GITHUB_*/RUNNER_* variables before the publish step"],"tags":["publish","provenance","github-actions","environment","sigstore"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}