What causes "Not running in GitHub Actions" in denoland/deno?

Run the step on GitHub Actions with `permissions: id-token: write` so the runner injects ACTIONS_ID_TOKEN_REQUEST_URL.

Not running in GitHub Actions

Error message

Not running in GitHub Actions

What it means

To mint an audience-scoped OIDC token, Deno calls the endpoint the Actions runner injects as `ACTIONS_ID_TOKEN_REQUEST_URL`, appending the audience query parameter and the request token as bearer. This error fires when that env var is unset — the process is not running in a real GitHub Actions job context with token minting available.

Source

Thrown at cli/tools/publish/provenance.rs:537

    let response = self
      .http_client
      .post_json(url.parse()?, &request_body)?
      .send()
      .await?;

    let body: SigningCertificateResponse =
      http_util::body_to_json(response).await?;

    let key = body
      .signed_certificate_embedded_sct
      .or(body.signed_certificate_detached_sct)
      .ok_or_else(|| anyhow::anyhow!("No certificate chain returned"))?;
    Ok(key.chain.certificates)
  }

  async fn gha_request_token(&self, aud: &str) -> Result<String, AnyError> {
    let Ok(req_url) = env::var("ACTIONS_ID_TOKEN_REQUEST_URL") else {
      bail!("Not running in GitHub Actions");
    };

    let Some(token) = gha_oidc_token() else {
      bail!("No OIDC token available");
    };

    let mut url = req_url.parse::<Url>()?;
    url.query_pairs_mut().append_pair("audience", aud);
    let res_bytes = self
      .http_client
      .get(url)?
      .header(
        http::header::AUTHORIZATION,
        format!("Bearer {}", token)
          .parse()
          .map_err(http::Error::from)?,
      )
      .send()

View on GitHub (pinned to 9ad36f7a2c)

Solutions

Run the step on GitHub Actions with `permissions: id-token: write` so the runner injects ACTIONS_ID_TOKEN_REQUEST_URL.
Don't hand-set GITHUB_ACTIONS outside real jobs — pass `--no-provenance` instead of simulating the environment.
Publishing from elsewhere: authenticate with `--token <JSR_TOKEN>` and skip provenance.

Defensive patterns

Strategy: validation

Validate before calling

#!/usr/bin/env bash
if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ]; then
  echo "no OIDC endpoint injected — not a GHA job with id-token permission; use --no-provenance or --token" >&2
  exit 1
fi

Type guard

const hasOidcEndpoint = (
  env: NodeJS.ProcessEnv,
): env is NodeJS.ProcessEnv & { ACTIONS_ID_TOKEN_REQUEST_URL: string } =>
  typeof env.ACTIONS_ID_TOKEN_REQUEST_URL === "string" &&
  env.ACTIONS_ID_TOKEN_REQUEST_URL.length > 0;

Prevention

Check that ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN are present in the job env before relying on OIDC.
Never simulate GHA by exporting the variables locally — the endpoint won't exist; use `--token` instead.
On self-hosted runners, ensure the runner service receives the OIDC config (id-token permission) rather than stripping ACTIONS_* variables.

When it happens

Trigger: `gha_request_token` executed with `ACTIONS_ID_TOKEN_REQUEST_URL` missing: running outside a runner (e.g. locally after exporting GITHUB_ACTIONS=true), jobs without id-token permission on runner versions that omit the variable, or hardened runners that strip ACTIONS_* variables.

Common situations: Manually faking GHA env vars to test the provenance flow locally; self-hosted runners with sanitized environments; jobs migrated off GitHub-hosted runners.

Understand the failure class

Background: "environment variable is not set" and "Missing keys in environment" errors: what missing required env var messages mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/7d54e001d2b487f0. Report an issue: GitHub.