Deno "PermissionDenied: Requires run access" in CI

Deno blocked a subprocess spawn because --allow-run was not granted. The message names the executable the program tried to launch.

What this error means

The run fails with "PermissionDenied: Requires run access to \"git\", run again with the --allow-run flag" when the program calls Deno.Command or Deno.run.

error: Uncaught (in promise) PermissionDenied: Requires run access to "git", run again with the --allow-run flag
    at Object.spawn (ext:deno_process/40_process.js:...)

Common causes

No --allow-run in the CI command

The program shells out to a binary but the invocation grants no run permission, so the spawn is denied.

The binary is outside a scoped run grant

A scoped --allow-run=git does not cover a second executable the program also invokes.

How to fix it

Grant run access to the binaries you spawn

1. Read the executable name Deno reports.
2. Add --allow-run=<binary> for each subprocess the program launches.
3. Confirm those binaries are on PATH in the runner.

deno run --allow-run=git,node mod.ts

Prefer scoped run over allow-all

List the exact executables rather than granting unrestricted subprocess access, especially in CI that handles secrets.

deno run --allow-run=deno mod.ts

How to prevent it

• Scope --allow-run to named executables, not blanket run access.
• Ensure spawned binaries exist on the runner PATH.
• Keep run flags aligned with the subprocesses the program starts.

Related guides