What causes "GITHUB_RUN_ID environment variable is not set" in denoland/deno?

Run publish as a normal step in the GitHub Actions job so the runner injects GITHUB_RUN_ID (with GITHUB_RUN_ATTEMPT and the rest).

denoland/deno · error · AnyError

GITHUB_RUN_ID environment variable is not set

Error message

GITHUB_RUN_ID environment variable is not set

What it means

The provenance predicate embeds `GITHUB_RUN_ID` (the unique run identifier) in its run details so the attestation can link back to the exact workflow run. Missing `GITHUB_RUN_ID` at predicate-construction time fails the publish with this message. Like the sibling provenance env errors, it means the process does not see a complete GitHub Actions environment.

Solutions

Run publish as a normal step in the GitHub Actions job so the runner injects GITHUB_RUN_ID (with GITHUB_RUN_ATTEMPT and the rest).
Explicitly forward GITHUB_RUN_ID into any container or subprocess used for publishing.
Skip `--provenance` if publishing outside a genuine GHA run.

Example fix

# before
docker run --rm publisher deno publish --provenance

# after
docker run --rm \
  -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT -e GITHUB_SHA -e GITHUB_REF \
  -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e RUNNER_ENVIRONMENT \
  -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
  publisher deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

function ghaRunContextPresent(): boolean {
  return !!Deno.env.get('GITHUB_RUN_ID') &&
    !!Deno.env.get('GITHUB_RUN_ATTEMPT');
}
const publishArgs = ghaRunContextPresent()
  ? ['publish', '--provenance']
  : ['publish'];

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_RUN_ID')) {
    // run identifiers absent (scrubbed env); inherit full runner env or drop --provenance
  }
}

Prevention

Forward GITHUB_RUN_ID and GITHUB_RUN_ATTEMPT in containerized publish steps.
Run publish as a workflow step rather than a detached process.
Check for the complete env set once in a preflight helper instead of failing mid-publish.

When it happens

Trigger: `deno publish --provenance` inside a container/wrapper with partial env forwarding; processes spawned after `env -i`; a hand-rolled CI shim that sets GITHUB_REPOSITORY/SHA but not the run identifiers.

Common situations: Containerized publish jobs; scripts that reconstruct the GHA env manually; long-lived agents that snapshot env at boot before the run context exists.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/43cf9cce1973240d. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:190

    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),
            path: workflow_path.to_string(),
          },
        },
        internal_parameters: InternalParameters {
          github: GithubInternalParameters {
            event_name: std::env::var("GITHUB_EVENT_NAME").unwrap_or_default(),
            repository_id: std::env::var("GITHUB_REPOSITORY_ID")

View on GitHub (pinned to 9ad36f7a2c)