{"record":{"id":"47e24cb27ac4201d","repo":"denoland/deno","slug":"no-means-to-authenticate-pass-a-token-to-token","errorCode":null,"errorMessage":"No means to authenticate. Pass a token to `--token`, or enable tokenless publishing from GitHub Actions using OIDC. Learn more at https://deno.co/ghoidc","messagePattern":"No means to authenticate\\. Pass a token to `--token`, or enable tokenless publishing from GitHub Actions using OIDC\\. Learn more at https://deno\\.co/ghoidc","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/publish/auth.rs","lineNumber":36,"sourceCode":"}\n\npub(crate) fn is_gha() -> bool {\n  std::env::var(\"GITHUB_ACTIONS\").unwrap_or_default() == \"true\"\n}\n\npub(crate) fn gha_oidc_token() -> Option<String> {\n  std::env::var(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\")\n    .ok()\n    .filter(|s| !s.is_empty())\n}\n\nfn get_gh_oidc_env_vars() -> Option<Result<(String, String), AnyError>> {\n  if std::env::var(\"GITHUB_ACTIONS\").unwrap_or_default() == \"true\" {\n    let url = std::env::var(\"ACTIONS_ID_TOKEN_REQUEST_URL\");\n    let token = std::env::var(\"ACTIONS_ID_TOKEN_REQUEST_TOKEN\");\n    match (url, token) {\n      (Ok(url), Ok(token)) => Some(Ok((url, token))),\n      (Err(_), Err(_)) => Some(Err(anyhow::anyhow!(\n        \"No means to authenticate. Pass a token to `--token`, or enable tokenless publishing from GitHub Actions using OIDC. Learn more at https://deno.co/ghoidc\"\n      ))),\n      _ => None,\n    }\n  } else {\n    None\n  }\n}\n\npub fn get_auth_method(\n  maybe_token: Option<String>,\n  dry_run: bool,\n) -> Result<AuthMethod, AnyError> {\n  if dry_run {\n    // We don't authenticate in dry-run mode.\n    return Ok(AuthMethod::Interactive);\n  }\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/cli/tools/publish/auth.rs#L18-L54","documentation":"When publishing from GitHub Actions without --token, Deno attempts tokenless OIDC auth using the ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN env vars that Actions injects when the job has the id-token permission. This error means GITHUB_ACTIONS=true but both vars are absent — the workflow never granted OIDC — and no other credential was supplied.","triggerScenarios":"`deno publish` in a GitHub Actions workflow with no --token where the job is missing permissions: id-token: write, or where OIDC is disabled at the enterprise/organization level.","commonSituations":"Publish workflows copied without the permissions block; org policies restricting id-token; self-hosted or non-GitHub runners where the ACTIONS_ID_TOKEN_* vars are never set.","solutions":["Add `permissions: id-token: write` (plus `contents: read`) to the publishing job so Actions provides the OIDC vars","Or pass a credential explicitly: deno publish --token $DENO_TOKEN","Verify the vars exist in the job: env | grep ACTIONS_ID_TOKEN","If OIDC is blocked by policy, store a PAT as a secret and use --token"],"exampleFix":"# .github/workflows/publish.yml — before\njobs:\n  publish:\n    steps:\n      - run: deno publish\n# after\njobs:\n  publish:\n    permissions:\n      id-token: write\n      contents: read\n    steps:\n      - uses: denoland/setup-deno@v2\n      - run: deno publish","handlingStrategy":"validation","validationCode":"# CI preflight: detect missing OIDC grant before publishing\nif [ \"${GITHUB_ACTIONS:-}\" = \"true\" ] && [ -z \"${ACTIONS_ID_TOKEN_REQUEST_URL:-}\" ]; then\n  echo '::error::job needs permissions: id-token: write for tokenless publish'\n  exit 1\nfi\ndeno publish","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the permissions block (id-token: write) in the publish workflow template","Verify with env | grep ACTIONS_ID_TOKEN when wiring a new publish workflow","Store a PAT secret as a fallback for runners without OIDC"],"tags":["publish","auth","oidc","github-actions","ci"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}