{"record":{"id":"484426bca4e33224","repo":"denoland/deno","slug":"github-server-url-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_SERVER_URL environment variable is not set","messagePattern":"GITHUB_SERVER_URL environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":180,"sourceCode":"impl Predicate {\n  pub fn new_github_actions() -> Result<Self, AnyError> {\n    let repo = std::env::var(\"GITHUB_REPOSITORY\").map_err(|_| {\n      anyhow!(\"GITHUB_REPOSITORY environment variable is not set\")\n    })?;\n    let rel_ref = std::env::var(\"GITHUB_WORKFLOW_REF\")\n      .unwrap_or_default()\n      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L162-L198","documentation":"Part of the provenance predicate construction: `GITHUB_SERVER_URL` (the base URL of the GitHub instance, normally `https://github.com`) is read to build the repository URL recorded in the SLSA attestation. It is always set on real GitHub-hosted runners, so its absence means the Actions environment is incomplete — typically a container or wrapper that did not inherit the runner env, or a non-GHA environment.","triggerScenarios":"`deno publish --provenance` in a Docker container action that did not inherit runner env; a step that explicitly clears the environment (`env: {}` scrubbing or `sudo -i`); enterprise proxies/wrappers that re-exec the CLI with a sanitized env.","commonSituations":"Containerized publish steps; actions that drop to a shell with `env -i`; copying a publish command into a script run outside the runner context.","solutions":["Run the publish step directly on the runner or pass the full Actions env into the container (map `GITHUB_*` and `RUNNER_*` variables).","In GitHub Enterprise Server ensure the runner sets GITHUB_SERVER_URL (it does by default); do not override env with a partial list.","Drop `--provenance` if you cannot guarantee a full GHA environment."],"exampleFix":"# before\n- run: docker run --rm my-publisher deno publish --provenance\n\n# after\n- run: docker run --rm \\\n    -e GITHUB_SERVER_URL -e GITHUB_REPOSITORY -e GITHUB_REF \\\n    -e GITHUB_SHA -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID \\\n    -e GITHUB_RUN_ATTEMPT -e ACTIONS_ID_TOKEN_REQUEST_URL \\\n    -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \\\n    my-publisher deno publish --provenance","handlingStrategy":"validation","validationCode":"const PROVENANCE_ENV = [\n  'GITHUB_REPOSITORY',\n  'GITHUB_SERVER_URL',\n  'GITHUB_REF',\n  'GITHUB_SHA',\n  'RUNNER_ENVIRONMENT',\n  'GITHUB_RUN_ID',\n  'GITHUB_RUN_ATTEMPT',\n] as const;\n\nconst missing = PROVENANCE_ENV.filter((k) => !Deno.env.get(k));\nif (missing.length > 0) {\n  throw new Error(`Cannot use --provenance; missing env: ${missing.join(', ')}`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_SERVER_URL')) {\n    // env was scrubbed (container/wrapper); re-run with full env passthrough\n  }\n}","preventionTips":["Avoid env -i and stripped containers around publish steps; inherit the runner environment.","When containerizing, forward all GITHUB_* and RUNNER_* vars explicitly.","Reserve --provenance for genuine GitHub Actions runners."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}