Automatic provenance is only available in GitHub Actions

Error message

Automatic provenance is only available in GitHub Actions

What it means

JSR provenance attestations are signed through GitHub Actions' OIDC identity (Fulcio/Rekor signing), which only exists inside Actions. `generate_provenance` therefore refuses to run when `GITHUB_ACTIONS` is not 'true' — there is no identity to attest with. In normal publishes this is backstopped earlier: provenance is only auto-enabled when `is_gha()` and an OIDC token are present.

Source

Thrown at cli/tools/publish/provenance.rs:311

pub struct VerificationMaterial {
  pub content: VerificationMaterialContent,
  pub tlog_entries: [TlogEntry; 1],
}

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ProvenanceBundle {
  pub media_type: &'static str,
  pub content: SignatureBundle,
  pub verification_material: VerificationMaterial,
}

pub async fn generate_provenance(
  http_client: &HttpClient,
  subjects: Vec<Subject>,
) -> Result<ProvenanceBundle, AnyError> {
  if !is_gha() {
    bail!("Automatic provenance is only available in GitHub Actions");
  }

  if gha_oidc_token().is_none() {
    bail!(
      "Provenance generation in Github Actions requires 'id-token' permission"
    );
  };

  let slsa = ProvenanceAttestation::new_github_actions(subjects)?;

  let attestation = serde_json::to_string(&slsa)?;
  let bundle = attest(http_client, &attestation, INTOTO_PAYLOAD_TYPE).await?;

  Ok(bundle)
}

pub async fn attest(
  http_client: &HttpClient,

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Run the publish step inside GitHub Actions if you want provenance attestations.
Outside GitHub Actions, pass `--no-provenance` to skip attestation entirely.
Ensure `GITHUB_ACTIONS=true` is preserved in the publishing job's environment.

Example fix

# before: outside GHA, provenance path fails
deno publish   # error: Automatic provenance is only available in GitHub Actions
# after: skip attestation outside CI
deno publish --no-provenance

Defensive patterns

Strategy: validation

Validate before calling

#!/usr/bin/env bash
if [ "${GITHUB_ACTIONS:-}" != "true" ]; then
  echo "provenance unavailable outside GitHub Actions — add --no-provenance" >&2
  deno publish --no-provenance
else
  deno publish
fi

Type guard

const isGitHubActions = (
  env: NodeJS.ProcessEnv,
): env is NodeJS.ProcessEnv & { GITHUB_ACTIONS: "true" } =>
  env.GITHUB_ACTIONS === "true";

Prevention

Branch provenance on `GITHUB_ACTIONS === "true"` and pass `--no-provenance` everywhere else.
Don't hand-export GITHUB_ACTIONS outside real runners — it only moves the failure deeper into the OIDC flow.
Keep the publish workflow on GitHub Actions if attestations are a release requirement.

When it happens

Trigger: Provenance generation reached outside GitHub Actions — env stripped or `GITHUB_ACTIONS` unset after the earlier enable-check, self-hosted setups renaming GitHub variables, or programmatic reuse of the provenance code path.

Common situations: Runners that sanitize GitHub env vars; migrating CI off GitHub Actions while keeping provenance expectations; locally testing with manually exported GHA variables.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/594fe2e89b246b90. Report an issue: GitHub.