{"record":{"id":"43cf9cce1973240d","repo":"denoland/deno","slug":"github-run-id-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_RUN_ID environment variable is not set","messagePattern":"GITHUB_RUN_ID environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":190,"sourceCode":"    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {\n          workflow: GhaWorkflow {\n            ref_: workflow_ref.to_string(),\n            repository: format!(\"{}/{}\", server_url, &repo),\n            path: workflow_path.to_string(),\n          },\n        },\n        internal_parameters: InternalParameters {\n          github: GithubInternalParameters {\n            event_name: std::env::var(\"GITHUB_EVENT_NAME\").unwrap_or_default(),\n            repository_id: std::env::var(\"GITHUB_REPOSITORY_ID\")","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L172-L208","documentation":"The provenance predicate embeds `GITHUB_RUN_ID` (the unique run identifier) in its run details so the attestation can link back to the exact workflow run. Missing `GITHUB_RUN_ID` at predicate-construction time fails the publish with this message. Like the sibling provenance env errors, it means the process does not see a complete GitHub Actions environment.","triggerScenarios":"`deno publish --provenance` inside a container/wrapper with partial env forwarding; processes spawned after `env -i`; a hand-rolled CI shim that sets GITHUB_REPOSITORY/SHA but not the run identifiers.","commonSituations":"Containerized publish jobs; scripts that reconstruct the GHA env manually; long-lived agents that snapshot env at boot before the run context exists.","solutions":["Run publish as a normal step in the GitHub Actions job so the runner injects GITHUB_RUN_ID (with GITHUB_RUN_ATTEMPT and the rest).","Explicitly forward GITHUB_RUN_ID into any container or subprocess used for publishing.","Skip `--provenance` if publishing outside a genuine GHA run."],"exampleFix":"# before\ndocker run --rm publisher deno publish --provenance\n\n# after\ndocker run --rm \\\n  -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT -e GITHUB_SHA -e GITHUB_REF \\\n  -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e RUNNER_ENVIRONMENT \\\n  -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \\\n  publisher deno publish --provenance","handlingStrategy":"validation","validationCode":"function ghaRunContextPresent(): boolean {\n  return !!Deno.env.get('GITHUB_RUN_ID') &&\n    !!Deno.env.get('GITHUB_RUN_ATTEMPT');\n}\nconst publishArgs = ghaRunContextPresent()\n  ? ['publish', '--provenance']\n  : ['publish'];","typeGuard":null,"tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_RUN_ID')) {\n    // run identifiers absent (scrubbed env); inherit full runner env or drop --provenance\n  }\n}","preventionTips":["Forward GITHUB_RUN_ID and GITHUB_RUN_ATTEMPT in containerized publish steps.","Run publish as a workflow step rather than a detached process.","Check for the complete env set once in a preflight helper instead of failing mid-publish."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}