{"record":{"id":"2462c942d58deded","repo":"nodejs/node","slug":"github-actions-workflow-must-be-just-a-file-not-a","errorCode":null,"errorMessage":"GitHub Actions workflow must be just a file not a path","messagePattern":"GitHub Actions workflow must be just a file not a path","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"deps/npm/lib/commands/trust/github.js","lineNumber":66,"sourceCode":"    globalDefinitions.yes,\n  ]\n\n  getEntityUrl ({ providerHostname, file, entity }) {\n    if (file) {\n      return new URL(`${entity}/blob/HEAD/.github/workflows/${file}`, providerHostname).toString()\n    }\n    return new URL(entity, providerHostname).toString()\n  }\n\n  validateEntity (entity) {\n    if (entity.split('/').length !== 2) {\n      throw new Error(`${this.constructor.providerEntity} must be specified in the format owner/repository`)\n    }\n  }\n\n  validateFile (file) {\n    if (file !== path.basename(file)) {\n      throw new Error('GitHub Actions workflow must be just a file not a path')\n    }\n  }\n\n  static optionsToBody (options) {\n    const { file, repository, environment } = options\n    const trustConfig = {\n      type: 'github',\n      claims: {\n        repository,\n        workflow_ref: {\n          file,\n        },\n        ...(environment) && { environment },\n      },\n    }\n    return trustConfig\n  }\n","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/commands/trust/github.js#L48-L84","documentation":"Thrown by the GitHub trust provider's `validateFile` when the `--file` value is not equal to its own basename, i.e. it contains path separators. The trust record references a single workflow file inside `.github/workflows/`, so only a bare filename is accepted — not a relative or absolute path.","triggerScenarios":"`file !== path.basename(file)` — the value contains a `/` (or, on Windows, a `\\`) making it more than a filename.","commonSituations":"Passing `.github/workflows/deploy.yml`, `./deploy.yml`, or an absolute path instead of just `deploy.yml`; templating that injects a directory prefix.","solutions":["Pass only the filename, e.g. `--file deploy.yml`.","Strip any directory: `path.basename(file)` before passing.","Ensure the value has no leading `./`, no subdirectory, and no path separator."],"exampleFix":"// before\n--file .github/workflows/deploy.yml\n// after\n--file deploy.yml","handlingStrategy":"validation","validationCode":"const path = require('path')\nfunction normalizeWorkflowFile(file) {\n  const base = path.basename(file)\n  if (base !== file) {\n    throw new Error(`--file must be a bare filename (e.g. deploy.yml), got \"${file}\"`)\n  }\n  return base\n}","typeGuard":"function isBareFilename(file) {\n  return path.basename(file) === file\n}","tryCatchPattern":null,"preventionTips":["Pass only the workflow filename (e.g. `deploy.yml`), never a path.","In CI templates, apply `path.basename()` to any templated value.","Avoid leading `./` or `.github/workflows/` prefixes in --file."],"tags":["trust","github","workflow","argument-validation","oidc"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}