denoland/deno · error · anyhow::Error

GITHUB_RUN_ATTEMPT environment variable is not set

Error message

GITHUB_RUN_ATTEMPT environment variable is not set

What it means

The last of the required runner variables: provenance predicate construction reads `GITHUB_RUN_ATTEMPT` and throws this message when it is unset. Reaching this particular check means every earlier variable (GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_REF, GITHUB_SHA, RUNNER_ENVIRONMENT, GITHUB_RUN_ID) was present — only this one is missing.

Source

Thrown at cli/tools/publish/provenance.rs:192

      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),
            path: workflow_path.to_string(),
          },
        },
        internal_parameters: InternalParameters {
          github: GithubInternalParameters {
            event_name: std::env::var("GITHUB_EVENT_NAME").unwrap_or_default(),
            repository_id: std::env::var("GITHUB_REPOSITORY_ID")
              .unwrap_or_default(),
            repository_owner_id: std::env::var("GITHUB_REPOSITORY_OWNER_ID")

View on GitHub (pinned to 89f33cbef2)

Solutions

Add GITHUB_RUN_ATTEMPT to the forwarded environment
Prefer forwarding the entire runner env instead of a hand-picked list
Drop `--provenance` outside GitHub Actions

Defensive patterns

Strategy: validation

Validate before calling

if [ -z "$GITHUB_RUN_ATTEMPT" ]; then
  echo "GITHUB_RUN_ATTEMPT unset — publish --provenance needs the full Actions env" >&2
  exit 1
fi

Prevention

Forward GITHUB_RUN_ATTEMPT (re-check your list after Deno upgrades — requirements grow over time)
Prefer forwarding the entire runner env over a static whitelist
Add a CI preflight that fails before the publish step if any required variable is missing

When it happens

Trigger: `deno publish --provenance` where all other runner variables were forwarded but GITHUB_RUN_ATTEMPT was omitted.

Common situations: Hand-maintained env whitelists in wrappers that predate this variable being required; partial env snapshots in containers.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/54f1016512b336b1. Report an issue: GitHub.