{"record":{"id":"8f6b5f614977d960","repo":"denoland/deno","slug":"runner-environment-environment-variable-is-not-set","errorCode":null,"errorMessage":"RUNNER_ENVIRONMENT environment variable is not set","messagePattern":"RUNNER_ENVIRONMENT environment variable is not set","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":187,"sourceCode":"      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {\n          workflow: GhaWorkflow {\n            ref_: workflow_ref.to_string(),\n            repository: format!(\"{}/{}\", server_url, &repo),\n            path: workflow_path.to_string(),\n          },\n        },\n        internal_parameters: InternalParameters {","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/denoland/deno/blob/89f33cbef296a2b287f323d42de54c871fa69c77/cli/tools/publish/provenance.rs#L169-L205","documentation":"Provenance predicate construction reads `RUNNER_ENVIRONMENT` (github-hosted vs self-hosted) and throws this message when it is unset. GitHub runners always define it; self-hosted containers or wrappers that drop it will fail here even when the GITHUB_* variables are present.","triggerScenarios":"`deno publish --provenance` inside a containerized runner step that forwards GITHUB_* variables but not RUNNER_ENVIRONMENT.","commonSituations":"Docker-based GitHub Actions steps with selective env passthrough; hardened runner images pruning 'unnecessary' variables.","solutions":["Forward RUNNER_ENVIRONMENT into the publish container/process","Run the publish step without containerization on the runner","Drop `--provenance` if the environment cannot provide runner variables"],"exampleFix":"# before — RUNNER_ENVIRONMENT dropped\ndocker run -e GITHUB_SHA denoland/deno publish --provenance\n# after\ndocker run -e GITHUB_SHA -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID \\\n  -e GITHUB_RUN_ATTEMPT denoland/deno publish --provenance","handlingStrategy":"validation","validationCode":"if [ -z \"$RUNNER_ENVIRONMENT\" ]; then\n  echo \"RUNNER_ENVIRONMENT unset — publish --provenance needs the full Actions env\" >&2\n  exit 1\nfi","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Forward RUNNER_ENVIRONMENT into Dockerized runner steps","Do not prune 'unused' runner variables in hardened images","Verify the publish container sees the same env as the runner job (`env | grep -E 'GITHUB|RUNNER'`)"],"tags":["publish","provenance","github-actions","environment","sigstore"],"backgroundTag":null,"analyzedSha":"89f33cbef296a2b287f323d42de54c871fa69c77","analyzedAt":"2026-08-16T07:54:21.310Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}