denoland/deno · error · anyhow::Error

GITHUB_REPOSITORY environment variable is not set

Error message

GITHUB_REPOSITORY environment variable is not set

What it means

`deno publish --provenance` builds a SLSA predicate from GitHub Actions runner environment variables. `Predicate::new_github_actions` reads `GITHUB_REPOSITORY` first and throws this exact message when it is unset. On a real GitHub-hosted (or correctly configured self-hosted) runner this variable always exists, so hitting it means provenance signing is running outside a genuine GitHub Actions job or in a stripped environment.

Source

Thrown at cli/tools/publish/provenance.rs:165

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
struct RunDetails {
  builder: Builder,
  metadata: Metadata,
}

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
struct Predicate {
  build_definition: BuildDefinition,
  run_details: RunDetails,
}

impl Predicate {
  pub fn new_github_actions() -> Result<Self, AnyError> {
    let repo = std::env::var("GITHUB_REPOSITORY").map_err(|_| {
      anyhow!("GITHUB_REPOSITORY environment variable is not set")
    })?;
    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;

View on GitHub (pinned to 89f33cbef2)

Solutions

1. Move the publish step into a GitHub Actions workflow — Deno provenance is GitHub-Actions-only
2. If containerized, forward the runner env (GITHUB_*, RUNNER_ENVIRONMENT, ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN)
3. Drop `--provenance` when publishing outside GitHub Actions

Example fix

# before
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - run: deno publish --provenance
# after
jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: denoland/setup-deno@v2
      - run: deno publish --provenance

if [ -z "$GITHUB_REPOSITORY" ]; then
  echo "deno publish --provenance requires a GitHub Actions runner (GITHUB_REPOSITORY unset)" >&2
  exit 1
fi

When it happens

Trigger: `deno publish --provenance` executed on a dev machine or in non-GitHub CI; running inside a container or wrapper where the Actions-provided environment variables were not forwarded into the process.

Common situations: Testing the provenance flag locally; calling publish from Docker with a minimal env; GitLab/Jenkins pipelines attempting Sigstore provenance.

Related errors

• GITHUB_SERVER_URL environment variable is not set
• GITHUB_REF environment variable is not set
• GITHUB_SHA environment variable is not set
• RUNNER_ENVIRONMENT environment variable is not set
• GITHUB_RUN_ID environment variable is not set

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/2899e434648f2297. Report an issue: GitHub.