{"record":{"id":"7d54e001d2b487f0","repo":"denoland/deno","slug":"not-running-in-github-actions","errorCode":null,"errorMessage":"Not running in GitHub Actions","messagePattern":"Not running in GitHub Actions","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":537,"sourceCode":"    let response = self\n      .http_client\n      .post_json(url.parse()?, &request_body)?\n      .send()\n      .await?;\n\n    let body: SigningCertificateResponse =\n      http_util::body_to_json(response).await?;\n\n    let key = body\n      .signed_certificate_embedded_sct\n      .or(body.signed_certificate_detached_sct)\n      .ok_or_else(|| anyhow::anyhow!(\"No certificate chain returned\"))?;\n    Ok(key.chain.certificates)\n  }\n\n  async fn gha_request_token(&self, aud: &str) -> Result<String, AnyError> {\n    let Ok(req_url) = env::var(\"ACTIONS_ID_TOKEN_REQUEST_URL\") else {\n      bail!(\"Not running in GitHub Actions\");\n    };\n\n    let Some(token) = gha_oidc_token() else {\n      bail!(\"No OIDC token available\");\n    };\n\n    let mut url = req_url.parse::<Url>()?;\n    url.query_pairs_mut().append_pair(\"audience\", aud);\n    let res_bytes = self\n      .http_client\n      .get(url)?\n      .header(\n        http::header::AUTHORIZATION,\n        format!(\"Bearer {}\", token)\n          .parse()\n          .map_err(http::Error::from)?,\n      )\n      .send()","sourceCodeStart":519,"sourceCodeEnd":555,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L519-L555","documentation":"To mint an audience-scoped OIDC token, Deno calls the endpoint the Actions runner injects as `ACTIONS_ID_TOKEN_REQUEST_URL`, appending the audience query parameter and the request token as bearer. This error fires when that env var is unset — the process is not running in a real GitHub Actions job context with token minting available.","triggerScenarios":"`gha_request_token` executed with `ACTIONS_ID_TOKEN_REQUEST_URL` missing: running outside a runner (e.g. locally after exporting GITHUB_ACTIONS=true), jobs without id-token permission on runner versions that omit the variable, or hardened runners that strip ACTIONS_* variables.","commonSituations":"Manually faking GHA env vars to test the provenance flow locally; self-hosted runners with sanitized environments; jobs migrated off GitHub-hosted runners.","solutions":["Run the step on GitHub Actions with `permissions: id-token: write` so the runner injects ACTIONS_ID_TOKEN_REQUEST_URL.","Don't hand-set GITHUB_ACTIONS outside real jobs — pass `--no-provenance` instead of simulating the environment.","Publishing from elsewhere: authenticate with `--token <JSR_TOKEN>` and skip provenance."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nif [ -z \"${ACTIONS_ID_TOKEN_REQUEST_URL:-}\" ]; then\n  echo \"no OIDC endpoint injected — not a GHA job with id-token permission; use --no-provenance or --token\" >&2\n  exit 1\nfi","typeGuard":"const hasOidcEndpoint = (\n  env: NodeJS.ProcessEnv,\n): env is NodeJS.ProcessEnv & { ACTIONS_ID_TOKEN_REQUEST_URL: string } =>\n  typeof env.ACTIONS_ID_TOKEN_REQUEST_URL === \"string\" &&\n  env.ACTIONS_ID_TOKEN_REQUEST_URL.length > 0;","tryCatchPattern":null,"preventionTips":["Check that ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are present in the job env before relying on OIDC.","Never simulate GHA by exporting the variables locally — the endpoint won't exist; use `--token` instead.","On self-hosted runners, ensure the runner service receives the OIDC config (id-token permission) rather than stripping ACTIONS_* variables."],"tags":["publish","oidc","github-actions","environment","env-var"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}