Deno "PermissionDenied: Requires net access" in CI

Deno runs untrusted code with no permissions by default. The program tried to open a network connection and Deno stopped it because the CI invocation did not pass --allow-net.

What this error means

The run aborts with "PermissionDenied: Requires net access to \"host:port\", run again with the --allow-net flag". It appears the first time code does fetch, listen, or connect.

error: Uncaught (in promise) PermissionDenied: Requires net access to "deno.land:443", run again with the --allow-net flag
    at async fetch (ext:deno_fetch/26_fetch.js:...)

Common causes

The CI command omits --allow-net

Locally you may run deno run -A, but the CI step runs deno run mod.ts with no flags, so the first network call is denied.

A dependency reaches the network at import or startup

A module fetches remote data or opens a socket during initialization, so the denial fires even before your own code runs.

How to fix it

Grant least-privilege network access

1. Read the host and port named in the error message.
2. Add --allow-net=host:port scoped to exactly what the program needs.
3. Re-run the step to confirm the connection is now permitted.

deno run --allow-net=deno.land:443 mod.ts

Set the flag in the workflow step

Pass the permission in the CI command so the job matches how the program actually runs.

- run: deno run --allow-net=api.example.com mod.ts

How to prevent it

• Grant scoped --allow-net=host rather than blanket access where practical.
• Keep the CI command in sync with the permissions the program requires.
• Reserve -A (allow all) for trusted first-party scripts only.

Related guides