What causes "GITHUB_SHA environment variable is not set" in denoland/deno?

Run the publish as a plain workflow step on the runner (all GITHUB_* vars are then present), or explicitly forward GITHUB_SHA into any container/subprocess.

denoland/deno · error · AnyError

GITHUB_SHA environment variable is not set

Error message

GITHUB_SHA environment variable is not set

What it means

The provenance predicate records `GITHUB_SHA` (the commit SHA the workflow run is building) as the subject-adjacent build metadata in the SLSA attestation. If the variable is not present in the process environment when `deno publish --provenance` builds its `Predicate`, the lookup fails with this error, aborting publish before any upload.

Solutions

Run the publish as a plain workflow step on the runner (all GITHUB_* vars are then present), or explicitly forward GITHUB_SHA into any container/subprocess.
Prefer `${{ github.sha }}`/`env:` mappings over hand-copied values so nothing is missed.
Drop `--provenance` for environments where you cannot provide the full GHA metadata set.

Example fix

# before
- run: docker run --rm publisher deno publish --provenance

# after
- run: docker run --rm -e GITHUB_SHA -e GITHUB_REF \
    -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_RUN_ID \
    -e GITHUB_RUN_ATTEMPT -e RUNNER_ENVIRONMENT \
    -e ACTIONS_ID_TOKEN_REQUEST_URL -e ACTIONS_ID_TOKEN_REQUEST_TOKEN \
    publisher deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

function hasFullGhaEnv(): boolean {
  return ['GITHUB_REPOSITORY', 'GITHUB_SERVER_URL', 'GITHUB_REF',
    'GITHUB_SHA', 'RUNNER_ENVIRONMENT', 'GITHUB_RUN_ID',
    'GITHUB_RUN_ATTEMPT'].every((k) => !!Deno.env.get(k));
}
if (!hasFullGhaEnv()) Deno.exit(1); // skip --provenance

Try / catch

try {
  await runDeno(['publish', '--provenance']);
} catch (e) {
  if (String(e.message).includes('GITHUB_SHA')) {
    // commit context missing; re-exec with inherited env or omit --provenance
  }
}

Prevention

Forward GITHUB_SHA (ideally the entire runner env) into any containerized publish.
Avoid re-exec wrappers that sanitize the environment.
Build the publish command's flags dynamically based on detected env, not statically.

When it happens

Trigger: Publish-with-provenance inside a container/wrapper that did not inherit `GITHUB_SHA`; a manually constructed environment that sets some GITHUB_* vars but not this one; a cleanup step or `env -i` stripping the runner context.

Common situations: Docker container actions without env passthrough; calling the publish from a spawned daemon that lost the parent env; CI systems other than GitHub Actions where someone faked the GHA vars but missed this one.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/b7bb6b45aeb3694e. Report an issue: GitHub.

Appendix: source

Thrown at cli/tools/publish/provenance.rs:185

    let rel_ref = std::env::var("GITHUB_WORKFLOW_REF")
      .unwrap_or_default()
      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),
            path: workflow_path.to_string(),
          },

View on GitHub (pinned to 9ad36f7a2c)