What causes "GITHUB_SERVER_URL environment variable is not set" in denoland/deno?

Run the publish step directly on the GitHub Actions runner rather than in a stripped container

denoland/deno · error · anyhow::Error

GITHUB_SERVER_URL environment variable is not set

Error message

GITHUB_SERVER_URL environment variable is not set

What it means

Part of the provenance predicate construction: after resolving the workflow ref, `Predicate::new_github_actions` reads `GITHUB_SERVER_URL` and throws this message when it is unset. This and the other runner variables are always set inside real GitHub Actions jobs, so the error indicates publish-with-provenance ran where the Actions environment was absent or only partially forwarded.

Source

Thrown at cli/tools/publish/provenance.rs:180

impl Predicate {
  pub fn new_github_actions() -> Result<Self, AnyError> {
    let repo = std::env::var("GITHUB_REPOSITORY").map_err(|_| {
      anyhow!("GITHUB_REPOSITORY environment variable is not set")
    })?;
    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {

View on GitHub (pinned to 89f33cbef2)

Solutions

Run the publish step directly on the GitHub Actions runner rather than in a stripped container
If containerized, forward GITHUB_SERVER_URL along with the other GITHUB_*/RUNNER_* variables
Drop `--provenance` if not publishing from GitHub Actions

Example fix

# before — only some runner env forwarded
docker run -e GITHUB_REPOSITORY denoland/deno publish --provenance
# after — forward the full Actions environment
docker run -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_REF \
  -e GITHUB_SHA -e GITHUB_RUN_ID -e GITHUB_RUN_ATTEMPT \
  -e RUNNER_ENVIRONMENT -e ACTIONS_ID_TOKEN_REQUEST_URL \
  -e ACTIONS_ID_TOKEN_REQUEST_TOKEN denoland/deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

if [ -z "$GITHUB_SERVER_URL" ]; then
  echo "GITHUB_SERVER_URL unset — publish --provenance needs the full Actions env" >&2
  exit 1
fi

Prevention

Run the publish step directly on the runner rather than in an env-stripped container
Forward the complete Actions environment when containerization is required
Add a preflight loop over the required GITHUB_*/RUNNER_* variables in CI

When it happens

Trigger: `deno publish --provenance` where GITHUB_REPOSITORY was present but GITHUB_SERVER_URL was not — e.g. a container or subprocess that forwards only a subset of the runner environment.

Common situations: Dockerized publish steps with hand-picked `-e` env forwards; scripts that sanitize the environment before invoking deno.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/484426bca4e33224. Report an issue: GitHub.