denoland/deno · error · AnyError

GITHUB_REPOSITORY environment variable is not set

Error message

GITHUB_REPOSITORY environment variable is not set

What it means

Building the SLSA provenance predicate for `deno publish --provenance` reads GitHub Actions runner metadata from the environment; `GITHUB_REPOSITORY` (owner/repo of the running workflow) is the first variable fetched and its absence means the process is not running with full GitHub Actions context. Provenance attestation only works inside a GitHub Actions run.

Solutions

Move the publish step into a GitHub Actions workflow — provenance fundamentally requires GHA as the build system.
If the step runs in a container, pass runner env through (`env:` mapping or `--env` on docker run) so GITHUB_REPOSITORY and siblings are visible.
Do not use `--provenance` when publishing outside GitHub Actions; drop the flag for local/non-GHA publishing.

Example fix

# before (local terminal)
deno publish --provenance

# after (inside .github/workflows/publish.yml)
- run: deno publish --provenance
  env:
    GITHUB_REPOSITORY: ${{ github.repository }}

Defensive patterns

Strategy: validation

Validate before calling

function assertGhaContext(): void {
  if (!Deno.env.get('GITHUB_REPOSITORY')) {
    throw new Error(
      'deno publish --provenance requires a GitHub Actions runner (GITHUB_REPOSITORY unset)',
    );
  }
}

Type guard

const inGithubActions = (): boolean =>
  !!Deno.env.get('GITHUB_REPOSITORY') &&
  Deno.env.get('GITHUB_ACTIONS') === 'true';

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_REPOSITORY')) {
    // publish without --provenance, or move the step into GitHub Actions
  }
}

Prevention

Only pass --provenance inside a real GitHub Actions job.
If steps run in containers, forward the full GITHUB_*/RUNNER_* environment.
Make provenance conditional in scripts: add the flag only when the GHA context is detected.

When it happens

Trigger: Running `deno publish --provenance` on a local machine or non-GHA CI (GitLab, self-hosted scripts); a GHA step where env vars were scrubbed by a wrapper container; invoking the CLI through a service that sanitizes the environment.

Common situations: Testing the provenance flag locally before wiring CI; Docker actions that drop the default runner env; fork PRs where the workflow context differs.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/2899e434648f2297. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:165

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
struct RunDetails {
  builder: Builder,
  metadata: Metadata,
}

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
struct Predicate {
  build_definition: BuildDefinition,
  run_details: RunDetails,
}

impl Predicate {
  pub fn new_github_actions() -> Result<Self, AnyError> {
    let repo = std::env::var("GITHUB_REPOSITORY").map_err(|_| {
      anyhow!("GITHUB_REPOSITORY environment variable is not set")
    })?;
    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;

View on GitHub (pinned to 9ad36f7a2c)