[jhnns]

deno publish fails after uploading the package with Invalid symbol 45, offset N. when generating provenance in GitHub Actions. The package is published, but the command exits 1 and no provenance is recorded.

Cause

extract_jwt_subject decodes the OIDC token payload with STANDARD_NO_PAD, but JWT segments are base64url (RFC 7519). The two alphabets differ in +/ vs. -_, so any token whose encoded payload contains - or _ is rejected (45 is -).

This is triggered when the workflow name: contains emoji: the workflow claim then contains UTF-8 bytes that base64url-encode to - (e.g. 🚀 → 8J-agA). For a given workflow the claim offsets are essentially fixed, so such workflows fail on every run.

Fix

Decode with URL_SAFE_NO_PAD. Adds a unit test using a token whose payload contains - (workflow name 🧪 Test and 🚀 Release).

References

• Original issue: Publishing package to JSR via github fails on provenance #29671 (also: Publishing package to JSR via github fails on provenance #29671 (comment) analysis pointing at the JWT decode)
• jsr issue: Provenance fails with cryptic error "Invalid symbol 45, offset 1238." jsr-io/jsr#1312. The fix merged there (fix(provenance): accept URL-safe base64 in DSSE payload jsr-io/jsr#1418) changes the server-side DSSE payload decoding, which doesn't address this client-side decode.
• Failed run: https://github.com/peerigon/parse-domain/actions/runs/42531082763 (Test and Release workflow, deno 2.6.7, Invalid symbol 45, offset 1174.)

---

🤖 Disclosure: this PR (the code change, test and description) was generated with Claude Code and reviewed by a human before submission.

[CLAassistant]

All committers have signed the CLA.