denoland/deno · error · AnyError

GITHUB_REF environment variable is not set

Error message

GITHUB_REF environment variable is not set

What it means

Provenance predicate construction reads `GITHUB_REF` (the branch/tag ref that triggered the workflow, e.g. `refs/tags/v1.2.3`) to record what triggered the build in the SLSA attestation. GitHub-hosted and self-hosted runners set it automatically; if it is missing the Actions context is incomplete and Deno cannot produce a valid predicate.

Solutions

  1. Forward the complete Actions environment into the publish process (container `env:` mappings or `--env-file` including GITHUB_REF).
  2. Run the publish step as a normal workflow step so the runner injects all default env vars.
  3. Omit `--provenance` when the environment cannot provide full GHA metadata.

Example fix

# before (partial env forwarded)
docker run -e GITHUB_REPOSITORY my-publisher deno publish --provenance

# after (full trigger context forwarded)
docker run -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_REF \
  -e GITHUB_SHA -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT \
  -e RUNNER_ENVIRONMENT my-publisher deno publish --provenance
Defensive patterns

Strategy: validation

Validate before calling

const needed = ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',
  'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT'];
const missing = needed.filter((k) => !Deno.env.get(k));
if (missing.length) {
  console.error(`Missing provenance env vars: ${missing.join(', ')}`);
  Deno.exit(1);
}

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_REF')) {
    // the trigger context is absent; run inside the workflow or drop --provenance
  }
}

Prevention

When it happens

Trigger: `deno publish --provenance` executed with a scrubbed/partial environment (container actions, `env -i`, re-exec through a service); custom CI that sets GITHUB_REPOSITORY/GITHUB_SERVER_URL but not the full trigger context; scripts sourcing only a subset of runner vars.

Common situations: Containerized or wrapped publish steps that forward only auth-related env vars; forked workflows with reduced context; locally emulating CI by exporting a few GITHUB_* vars by hand.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/025c61d40ea92033. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:183

      anyhow!("GITHUB_REPOSITORY environment variable is not set")
    })?;
    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),

View on GitHub (pinned to 9ad36f7a2c)