denoland/deno · error · AnyError

GITHUB_RUN_ATTEMPT environment variable is not set

Error message

GITHUB_RUN_ATTEMPT environment variable is not set

What it means

`GITHUB_RUN_ATTEMPT` (1 for the first attempt of a run, incrementing on re-runs) is the last run-details variable the provenance predicate reads; its absence fails `deno publish --provenance` during `Predicate::new_github_actions()`. The error is symmetric with the other provenance env errors: the process is not seeing a complete GitHub Actions environment.

Solutions

Forward the full set at once: GITHUB_REPOSITORY, GITHUB_SERVER_URL, GITHUB_REF, GITHUB_SHA, RUNNER_ENVIRONMENT, GITHUB_RUN_ID, GITHUB_RUN_ATTEMPT plus the two ACTIONS_ID_TOKEN_REQUEST_* vars.
Simplify by running `deno publish --provenance` directly as a workflow step, where none of this forwarding is needed.
Drop `--provenance` when publishing outside GitHub Actions.

Example fix

# before (one var at a time)
docker run --rm -e GITHUB_RUN_ID publisher deno publish --provenance

# after (complete provenance env set)
docker run --rm \
  -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_REF -e GITHUB_SHA \
  -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT \
  -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
  publisher deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

const REQUIRED = ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',
  'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID', 'GITHUB_RUN_ATTEMPT',
  'ACTIONS_ID_TOKEN_REQUEST_URL', 'ACTIONS_ID_TOKEN_REQUEST_TOKEN'];

export function canPublishWithProvenance(): boolean {
  return Deno.env.get('GITHUB_ACTIONS') === 'true' &&
    REQUIRED.every((k) => !!Deno.env.get(k));
}

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_RUN_ATTEMPT')) {
    // env forwarded piecemeal; fix the wrapper to pass the whole runner env, then retry
  }
}

Prevention

Forward the entire GHA environment block in one go; do not fix vars one error at a time.
Use a single preflight check covering all provenance env vars before adding --provenance.
Keep provenance publishing inside a normal GitHub Actions job.

When it happens

Trigger: Container actions or wrappers forwarding only a subset of GITHUB_*/RUNNER_* vars; scrubbed environments (`env -i`, minimal containers); re-implemented CI that mimics GHA variables but omits run-attempt.

Common situations: Moving a runner step into Docker and forwarding only the vars the previous error complained about, one at a time; publish scripts run from cron/systemd that inherit nothing.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/54f1016512b336b1. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:192

      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),
            path: workflow_path.to_string(),
          },
        },
        internal_parameters: InternalParameters {
          github: GithubInternalParameters {
            event_name: std::env::var("GITHUB_EVENT_NAME").unwrap_or_default(),
            repository_id: std::env::var("GITHUB_REPOSITORY_ID")
              .unwrap_or_default(),
            repository_owner_id: std::env::var("GITHUB_REPOSITORY_OWNER_ID")

View on GitHub (pinned to 9ad36f7a2c)