Deno "PermissionDenied" / "Requires ... access" in CI

Deno runs with no ambient permissions by default. When your program tries to read a file, open a socket, or read an env var without the matching --allow-* flag, Deno refuses with a PermissionDenied error.

What this error means

A run fails with "PermissionDenied: Requires net access to \"api.example.com\", run again with the --allow-net flag" (or read/write/env). In CI it surfaces because the command omits the permission flags the program needs.

deno output

error: Uncaught (in promise) PermissionDenied: Requires net access to
"api.example.com:443", run again with the --allow-net flag
    at file:///app/fetch.ts:3:20

Common causes

Missing --allow flags for the program’s needs

Deno’s sandbox blocks net, file, env, and run access unless explicitly granted. A program that fetches or reads files needs the corresponding --allow-* flag.

Permissions differ between local and CI

Locally you may have run with broad permissions interactively. In CI the exact flags must be in the command, or the program is denied.

How to fix it

Grant only the permissions you need

Add the specific --allow-* flags, scoped as narrowly as possible.

Terminal

deno run --allow-net=api.example.com --allow-read=./config --allow-env main.ts

Declare permissions in a task

Put the flags in a deno.json task so CI and local runs stay consistent.

deno.json

{
  "tasks": {
    "start": "deno run --allow-net --allow-read=./config main.ts"
  }
}

How to prevent it

Define run commands with explicit --allow-* flags in deno.json tasks.
Scope permissions to specific hosts/paths rather than using -A.
Run the same task locally and in CI so permissions do not drift.