{"record":{"id":"594fe2e89b246b90","repo":"denoland/deno","slug":"automatic-provenance-is-only-available-in-github-a","errorCode":null,"errorMessage":"Automatic provenance is only available in GitHub Actions","messagePattern":"Automatic provenance is only available in GitHub Actions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":311,"sourceCode":"pub struct VerificationMaterial {\n  pub content: VerificationMaterialContent,\n  pub tlog_entries: [TlogEntry; 1],\n}\n\n#[derive(Serialize)]\n#[serde(rename_all = \"camelCase\")]\npub struct ProvenanceBundle {\n  pub media_type: &'static str,\n  pub content: SignatureBundle,\n  pub verification_material: VerificationMaterial,\n}\n\npub async fn generate_provenance(\n  http_client: &HttpClient,\n  subjects: Vec<Subject>,\n) -> Result<ProvenanceBundle, AnyError> {\n  if !is_gha() {\n    bail!(\"Automatic provenance is only available in GitHub Actions\");\n  }\n\n  if gha_oidc_token().is_none() {\n    bail!(\n      \"Provenance generation in Github Actions requires 'id-token' permission\"\n    );\n  };\n\n  let slsa = ProvenanceAttestation::new_github_actions(subjects)?;\n\n  let attestation = serde_json::to_string(&slsa)?;\n  let bundle = attest(http_client, &attestation, INTOTO_PAYLOAD_TYPE).await?;\n\n  Ok(bundle)\n}\n\npub async fn attest(\n  http_client: &HttpClient,","sourceCodeStart":293,"sourceCodeEnd":329,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L293-L329","documentation":"JSR provenance attestations are signed through GitHub Actions' OIDC identity (Fulcio/Rekor signing), which only exists inside Actions. `generate_provenance` therefore refuses to run when `GITHUB_ACTIONS` is not 'true' — there is no identity to attest with. In normal publishes this is backstopped earlier: provenance is only auto-enabled when `is_gha()` and an OIDC token are present.","triggerScenarios":"Provenance generation reached outside GitHub Actions — env stripped or `GITHUB_ACTIONS` unset after the earlier enable-check, self-hosted setups renaming GitHub variables, or programmatic reuse of the provenance code path.","commonSituations":"Runners that sanitize GitHub env vars; migrating CI off GitHub Actions while keeping provenance expectations; locally testing with manually exported GHA variables.","solutions":["Run the publish step inside GitHub Actions if you want provenance attestations.","Outside GitHub Actions, pass `--no-provenance` to skip attestation entirely.","Ensure `GITHUB_ACTIONS=true` is preserved in the publishing job's environment."],"exampleFix":"# before: outside GHA, provenance path fails\ndeno publish   # error: Automatic provenance is only available in GitHub Actions\n# after: skip attestation outside CI\ndeno publish --no-provenance","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nif [ \"${GITHUB_ACTIONS:-}\" != \"true\" ]; then\n  echo \"provenance unavailable outside GitHub Actions — add --no-provenance\" >&2\n  deno publish --no-provenance\nelse\n  deno publish\nfi","typeGuard":"const isGitHubActions = (\n  env: NodeJS.ProcessEnv,\n): env is NodeJS.ProcessEnv & { GITHUB_ACTIONS: \"true\" } =>\n  env.GITHUB_ACTIONS === \"true\";","tryCatchPattern":null,"preventionTips":["Branch provenance on `GITHUB_ACTIONS === \"true\"` and pass `--no-provenance` everywhere else.","Don't hand-export GITHUB_ACTIONS outside real runners — it only moves the failure deeper into the OIDC flow.","Keep the publish workflow on GitHub Actions if attestations are a release requirement."],"tags":["publish","provenance","github-actions","oidc","environment"],"backgroundTag":"ci-only-feature","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}