Deno "PermissionDenied: Requires read access" in CI

Deno denied a filesystem read because the CI invocation did not grant --allow-read. The message names the exact path the program tried to open.

What this error means

The program stops with "PermissionDenied: Requires read access to \"/path\", run again with the --allow-read flag" when it opens a config, fixture, or data file.

error: Uncaught (in promise) PermissionDenied: Requires read access to "config.json", run again with the --allow-read flag
    at Object.readFileSync (ext:deno_fs/30_fs.js:...)

Common causes

No --allow-read in the CI command

The step runs the program without read permission, so the first Deno.readTextFile or readFileSync is denied.

The needed path is outside the granted scope

You granted --allow-read=./src but the program reads from /tmp or the home directory, which the scope does not cover.

How to fix it

Grant read access to the paths you use

1. Note the path in the error.
2. Add --allow-read=<path> covering the directories the program reads.
3. Re-run to confirm the read is permitted.

deno run --allow-read=./config,./data mod.ts

Widen the scope for tests that touch many files

Test suites often read fixtures from several directories; scope read to the project root rather than a single subfolder.

deno test --allow-read=.

How to prevent it

• Scope --allow-read to the directories the program actually reads.
• Keep the CI permission flags aligned with fixture and config locations.
• Prefer explicit paths over broad read grants when feasible.

Related guides