denoland/deno · error

Provenance generation in Github Actions requires 'id-token'

Error message

Provenance generation in Github Actions requires 'id-token' permission

What it means

Even inside GitHub Actions, an OIDC token only exists when the job declares `permissions: id-token: write` — the default `GITHUB_TOKEN` cannot mint one. `generate_provenance` bails with this message when `ACTIONS_ID_TOKEN_REQUEST_TOKEN` is missing or empty, i.e. the runner never injected an OIDC request token.

Source

Thrown at cli/tools/publish/provenance.rs:315

#[derive(Serialize)]
#[serde(rename_all = "camelCase")]
pub struct ProvenanceBundle {
  pub media_type: &'static str,
  pub content: SignatureBundle,
  pub verification_material: VerificationMaterial,
}

pub async fn generate_provenance(
  http_client: &HttpClient,
  subjects: Vec<Subject>,
) -> Result<ProvenanceBundle, AnyError> {
  if !is_gha() {
    bail!("Automatic provenance is only available in GitHub Actions");
  }

  if gha_oidc_token().is_none() {
    bail!(
      "Provenance generation in Github Actions requires 'id-token' permission"
    );
  };

  let slsa = ProvenanceAttestation::new_github_actions(subjects)?;

  let attestation = serde_json::to_string(&slsa)?;
  let bundle = attest(http_client, &attestation, INTOTO_PAYLOAD_TYPE).await?;

  Ok(bundle)
}

pub async fn attest(
  http_client: &HttpClient,
  data: &str,
  type_: &str,
) -> Result<ProvenanceBundle, AnyError> {
  // DSSE Pre-Auth Encoding (PAE) payload

View on GitHub (pinned to 9ad36f7a2c)

Solutions

1. Add to the publishing job (or workflow) `permissions: id-token: write` plus `contents: read` as needed.
2. If OIDC is unavailable in your context (fork PR, enterprise policy), publish with `--no-provenance` or use `--token <JSR_TOKEN>`.

Example fix

# .github/workflows/publish.yml (before)
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - run: deno publish   # error: requires 'id-token' permission
# after
jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - run: deno publish

# CI step placed before `deno publish` in the publishing job
- name: Check OIDC availability
  run: |
    [ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ] || { \
      echo "job cannot mint OIDC tokens — add permissions: id-token: write" >&2; exit 1; }

When it happens

Trigger: Publishing in GitHub Actions with provenance enabled (default when an OIDC token is detectable) from a workflow/job without `id-token: write`, or where GitHub restricts OIDC (some enterprise policies, fork PRs).

Common situations: First provenance-enabled release from a workflow using default permissions; a workflow-level `permissions:` block that overrides the job's; pull_request runs from forks where OIDC tokens are unavailable.

Related errors

• Automatic provenance is only available in GitHub Actions
• Not running in GitHub Actions
• No means to authenticate. Pass a token to `--token`, or enab
• GITHUB_REPOSITORY environment variable is not set
• GITHUB_SERVER_URL environment variable is not set

AI-assisted analysis of denoland/deno@9ad36f7a2c (2026-08-20). Data as JSON: /api/errors/886b16132af61594. Report an issue: GitHub.