{"record":{"id":"54f1016512b336b1","repo":"denoland/deno","slug":"github-run-attempt-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_RUN_ATTEMPT environment variable is not set","messagePattern":"GITHUB_RUN_ATTEMPT environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":192,"sourceCode":"      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {\n          workflow: GhaWorkflow {\n            ref_: workflow_ref.to_string(),\n            repository: format!(\"{}/{}\", server_url, &repo),\n            path: workflow_path.to_string(),\n          },\n        },\n        internal_parameters: InternalParameters {\n          github: GithubInternalParameters {\n            event_name: std::env::var(\"GITHUB_EVENT_NAME\").unwrap_or_default(),\n            repository_id: std::env::var(\"GITHUB_REPOSITORY_ID\")\n              .unwrap_or_default(),\n            repository_owner_id: std::env::var(\"GITHUB_REPOSITORY_OWNER_ID\")","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L174-L210","documentation":"`GITHUB_RUN_ATTEMPT` (1 for the first attempt of a run, incrementing on re-runs) is the last run-details variable the provenance predicate reads; its absence fails `deno publish --provenance` during `Predicate::new_github_actions()`. The error is symmetric with the other provenance env errors: the process is not seeing a complete GitHub Actions environment.","triggerScenarios":"Container actions or wrappers forwarding only a subset of GITHUB_*/RUNNER_* vars; scrubbed environments (`env -i`, minimal containers); re-implemented CI that mimics GHA variables but omits run-attempt.","commonSituations":"Moving a runner step into Docker and forwarding only the vars the previous error complained about, one at a time; publish scripts run from cron/systemd that inherit nothing.","solutions":["Forward the full set at once: GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_REF, GITHUB_SHA, RUNNER_ENVIRONMENT, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT plus the two ACTIONS_ID_TOKEN_REQUEST_* vars.","Simplify by running `deno publish --provenance` directly as a workflow step, where none of this forwarding is needed.","Drop `--provenance` when publishing outside GitHub Actions."],"exampleFix":"# before (one var at a time)\ndocker run --rm -e GITHUB_RUN_ID publisher deno publish --provenance\n\n# after (complete provenance env set)\ndocker run --rm \\\n  -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_REF -e GITHUB_SHA \\\n  -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT \\\n  -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \\\n  publisher deno publish --provenance","handlingStrategy":"validation","validationCode":"const REQUIRED = ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',\n  'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT',\n  'ACTIONS_ID_TOKEN_REQUEST_URL', 'ACTIONS_ID_TOKEN_REQUEST_TOKEN'];\n\nexport function canPublishWithProvenance(): boolean {\n  return Deno.env.get('GITHUB_ACTIONS') === 'true' &&\n    REQUIRED.every((k) => !!Deno.env.get(k));\n}","typeGuard":null,"tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_RUN_ATTEMPT')) {\n    // env forwarded piecemeal; fix the wrapper to pass the whole runner env, then retry\n  }\n}","preventionTips":["Forward the entire GHA environment block in one go; do not fix vars one error at a time.","Use a single preflight check covering all provenance env vars before adding --provenance.","Keep provenance publishing inside a normal GitHub Actions job."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}