What causes "GITHUB_SERVER_URL environment variable is not set" in denoland/deno?

Run the publish step directly on the runner or pass the full Actions env into the container (map `GITHUB_*` and `RUNNER_*` variables).

denoland/deno · error · AnyError

GITHUB_SERVER_URL environment variable is not set

Error message

GITHUB_SERVER_URL environment variable is not set

What it means

Part of the provenance predicate construction: `GITHUB_SERVER_URL` (the base URL of the GitHub instance, normally `https://github.com`) is read to build the repository URL recorded in the SLSA attestation. It is always set on real GitHub-hosted runners, so its absence means the Actions environment is incomplete — typically a container or wrapper that did not inherit the runner env, or a non-GHA environment.

Solutions

Run the publish step directly on the runner or pass the full Actions env into the container (map `GITHUB_*` and `RUNNER_*` variables).
In GitHub Enterprise Server ensure the runner sets GITHUB_SERVER_URL (it does by default); do not override env with a partial list.
Drop `--provenance` if you cannot guarantee a full GHA environment.

Example fix

# before
- run: docker run --rm my-publisher deno publish --provenance

# after
- run: docker run --rm \
    -e GITHUB_SERVER_URL -e GITHUB_REPOSITORY -e GITHUB_REF \
    -e GITHUB_SHA -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID \
    -e GITHUB_RUN_ATTEMPT -e ACTIONS_ID_TOKEN_REQUEST_URL \
    -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
    my-publisher deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

const PROVENANCE_ENV = [
  'GITHUB_REPOSITORY',
  'GITHUB_SERVER_URL',
  'GITHUB_REF',
  'GITHUB_SHA',
  'RUNNER_ENVIRONMENT',
  'GITHUB_RUN_ID',
  'GITHUB_RUN_ATTEMPT',
] as const;

const missing = PROVENANCE_ENV.filter((k) => !Deno.env.get(k));
if (missing.length > 0) {
  throw new Error(`Cannot use --provenance; missing env: ${missing.join(', ')}`);
}

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_SERVER_URL')) {
    // env was scrubbed (container/wrapper); re-run with full env passthrough
  }
}

Prevention

Avoid env -i and stripped containers around publish steps; inherit the runner environment.
When containerizing, forward all GITHUB_* and RUNNER_* vars explicitly.
Reserve --provenance for genuine GitHub Actions runners.

When it happens

Trigger: `deno publish --provenance` in a Docker container action that did not inherit runner env; a step that explicitly clears the environment (`env: {}` scrubbing or `sudo -i`); enterprise proxies/wrappers that re-exec the CLI with a sanitized env.

Common situations: Containerized publish steps; actions that drop to a shell with `env -i`; copying a publish command into a script run outside the runner context.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/484426bca4e33224. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:180

impl Predicate {
  pub fn new_github_actions() -> Result<Self, AnyError> {
    let repo = std::env::var("GITHUB_REPOSITORY").map_err(|_| {
      anyhow!("GITHUB_REPOSITORY environment variable is not set")
    })?;
    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {

View on GitHub (pinned to 9ad36f7a2c)