denoland/deno · error · anyhow::Error

RUNNER_ENVIRONMENT environment variable is not set

Error message

RUNNER_ENVIRONMENT environment variable is not set

What it means

Provenance predicate construction reads `RUNNER_ENVIRONMENT` (github-hosted vs self-hosted) and throws this message when it is unset. GitHub runners always define it; self-hosted containers or wrappers that drop it will fail here even when the GITHUB_* variables are present.

Source

Thrown at cli/tools/publish/provenance.rs:187

      .replace(&format!("{}/", &repo), "");

    let (workflow_path, workflow_ref) = if let Some(delimn) = rel_ref.find('@')
    {
      let (path, ref_) = rel_ref.split_at(delimn);
      (path, &ref_[1..])
    } else {
      (rel_ref.as_str(), "")
    };

    let server_url = std::env::var("GITHUB_SERVER_URL").map_err(|_| {
      anyhow!("GITHUB_SERVER_URL environment variable is not set")
    })?;
    let github_ref = std::env::var("GITHUB_REF")
      .map_err(|_| anyhow!("GITHUB_REF environment variable is not set"))?;
    let github_sha = std::env::var("GITHUB_SHA")
      .map_err(|_| anyhow!("GITHUB_SHA environment variable is not set"))?;
    let runner_env = std::env::var("RUNNER_ENVIRONMENT").map_err(|_| {
      anyhow!("RUNNER_ENVIRONMENT environment variable is not set")
    })?;
    let run_id = std::env::var("GITHUB_RUN_ID")
      .map_err(|_| anyhow!("GITHUB_RUN_ID environment variable is not set"))?;
    let run_attempt = std::env::var("GITHUB_RUN_ATTEMPT").map_err(|_| {
      anyhow!("GITHUB_RUN_ATTEMPT environment variable is not set")
    })?;

    Ok(Self {
      build_definition: BuildDefinition {
        build_type: GITHUB_BUILD_TYPE,
        external_parameters: ExternalParameters {
          workflow: GhaWorkflow {
            ref_: workflow_ref.to_string(),
            repository: format!("{}/{}", server_url, &repo),
            path: workflow_path.to_string(),
          },
        },
        internal_parameters: InternalParameters {

View on GitHub (pinned to 89f33cbef2)

Solutions

Forward RUNNER_ENVIRONMENT into the publish container/process
Run the publish step without containerization on the runner
Drop `--provenance` if the environment cannot provide runner variables

Example fix

# before — RUNNER_ENVIRONMENT dropped
docker run -e GITHUB_SHA denoland/deno publish --provenance
# after
docker run -e GITHUB_SHA -e RUNNER_ENVIRONMENT -e GITHUB_RUN_ID \
  -e GITHUB_RUN_ATTEMPT denoland/deno publish --provenance

Defensive patterns

Strategy: validation

Validate before calling

if [ -z "$RUNNER_ENVIRONMENT" ]; then
  echo "RUNNER_ENVIRONMENT unset — publish --provenance needs the full Actions env" >&2
  exit 1
fi

Prevention

Forward RUNNER_ENVIRONMENT into Dockerized runner steps
Do not prune 'unused' runner variables in hardened images
Verify the publish container sees the same env as the runner job (`env | grep -E 'GITHUB|RUNNER'`)

When it happens

Trigger: `deno publish --provenance` inside a containerized runner step that forwards GITHUB_* variables but not RUNNER_ENVIRONMENT.

Common situations: Docker-based GitHub Actions steps with selective env passthrough; hardened runner images pruning 'unnecessary' variables.

Related errors

AI-assisted analysis of denoland/deno@89f33cbef2 (2026-08-16). Data as JSON: /api/errors/8f6b5f614977d960. Report an issue: GitHub.