{"record":{"id":"b7bb6b45aeb3694e","repo":"denoland/deno","slug":"github-sha-environment-variable-is-not-set","errorCode":null,"errorMessage":"GITHUB_SHA environment variable is not set","messagePattern":"GITHUB_SHA environment variable is not set","errorType":"exception","errorClass":"AnyError","httpStatus":null,"severity":"error","filePath":"cli/tools/publish/provenance.rs","lineNumber":185,"sourceCode":"    let rel_ref = std::env::var(\"GITHUB_WORKFLOW_REF\")\n      .unwrap_or_default()\n      .replace(&format!(\"{}/\", &repo), \"\");\n\n    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')\n    {\n      let (path, ref_) = rel_ref.split_at(delimn);\n      (path, &ref_[1..])\n    } else {\n      (rel_ref.as_str(), \"\")\n    };\n\n    let server_url = std::env::var(\"GITHUB_SERVER_URL\").map_err(|_| {\n      anyhow!(\"GITHUB_SERVER_URL environment variable is not set\")\n    })?;\n    let github_ref = std::env::var(\"GITHUB_REF\")\n      .map_err(|_| anyhow!(\"GITHUB_REF environment variable is not set\"))?;\n    let github_sha = std::env::var(\"GITHUB_SHA\")\n      .map_err(|_| anyhow!(\"GITHUB_SHA environment variable is not set\"))?;\n    let runner_env = std::env::var(\"RUNNER_ENVIRONMENT\").map_err(|_| {\n      anyhow!(\"RUNNER_ENVIRONMENT environment variable is not set\")\n    })?;\n    let run_id = std::env::var(\"GITHUB_RUN_ID\")\n      .map_err(|_| anyhow!(\"GITHUB_RUN_ID environment variable is not set\"))?;\n    let run_attempt = std::env::var(\"GITHUB_RUN_ATTEMPT\").map_err(|_| {\n      anyhow!(\"GITHUB_RUN_ATTEMPT environment variable is not set\")\n    })?;\n\n    Ok(Self {\n      build_definition: BuildDefinition {\n        build_type: GITHUB_BUILD_TYPE,\n        external_parameters: ExternalParameters {\n          workflow: GhaWorkflow {\n            ref_: workflow_ref.to_string(),\n            repository: format!(\"{}/{}\", server_url, &repo),\n            path: workflow_path.to_string(),\n          },","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/cli/tools/publish/provenance.rs#L167-L203","documentation":"The provenance predicate records `GITHUB_SHA` (the commit SHA the workflow run is building) as the subject-adjacent build metadata in the SLSA attestation. If the variable is not present in the process environment when `deno publish --provenance` builds its `Predicate`, the lookup fails with this error, aborting publish before any upload.","triggerScenarios":"Publish-with-provenance inside a container/wrapper that did not inherit `GITHUB_SHA`; a manually constructed environment that sets some GITHUB_* vars but not this one; a cleanup step or `env -i` stripping the runner context.","commonSituations":"Docker container actions without env passthrough; calling the publish from a spawned daemon that lost the parent env; CI systems other than GitHub Actions where someone faked the GHA vars but missed this one.","solutions":["Run the publish as a plain workflow step on the runner (all GITHUB_* vars are then present), or explicitly forward GITHUB_SHA into any container/subprocess.","Prefer `${{ github.sha }}`/`env:` mappings over hand-copied values so nothing is missed.","Drop `--provenance` for environments where you cannot provide the full GHA metadata set."],"exampleFix":"# before\n- run: docker run --rm publisher deno publish --provenance\n\n# after\n- run: docker run --rm -e GITHUB_SHA -e GITHUB_REF \\\n    -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_RUN_ID \\\n    -e GITHUB_RUN_ATTEMPT -e RUNNER_ENVIRONMENT \\\n    -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \\\n    publisher deno publish --provenance","handlingStrategy":"validation","validationCode":"function hasFullGhaEnv(): boolean {\n  return ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',\n    'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID',\n    'GITHUB_RUN_ATTEMPT'].every((k) => !!Deno.env.get(k));\n}\nif (!hasFullGhaEnv()) Deno.exit(1); // skip --provenance","typeGuard":null,"tryCatchPattern":"try {\n  await runDeno(['publish', '--provenance']);\n} catch (e) {\n  if (String(e.message).includes('GITHUB_SHA')) {\n    // commit context missing; re-exec with inherited env or omit --provenance\n  }\n}","preventionTips":["Forward GITHUB_SHA (ideally the entire runner env) into any containerized publish.","Avoid re-exec wrappers that sanitize the environment.","Build the publish command's flags dynamically based on detected env, not statically."],"tags":["publish","provenance","github-actions","environment","slsa"],"backgroundTag":"missing-env-var","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","contentChangedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}