{"record":{"id":"450d8d7b1d0450fc","repo":"nodejs/node","slug":"gitlab-ci-cd-pipeline-file-must-be-just-a-file-not","errorCode":null,"errorMessage":"GitLab CI/CD pipeline file must be just a file not a path","messagePattern":"GitLab CI/CD pipeline file must be just a file not a path","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"deps/npm/lib/commands/trust/gitlab.js","lineNumber":65,"sourceCode":"    globalDefinitions.yes,\n  ]\n\n  getEntityUrl ({ providerHostname, file, entity }) {\n    if (file) {\n      return new URL(`${entity}/-/blob/HEAD/${file}`, providerHostname).toString()\n    }\n    return new URL(entity, providerHostname).toString()\n  }\n\n  validateEntity (entity) {\n    if (entity.split('/').length < 2) {\n      throw new Error(`${this.constructor.providerEntity} must be specified in the format group/project or group/subgroup/project`)\n    }\n  }\n\n  validateFile (file) {\n    if (file !== path.basename(file)) {\n      throw new Error('GitLab CI/CD pipeline file must be just a file not a path')\n    }\n  }\n\n  static optionsToBody (options) {\n    const { file, project, environment } = options\n    const trustConfig = {\n      type: 'gitlab',\n      claims: {\n        project_path: project,\n        // this looks off, but this is correct\n        /** The ref path to the top-level pipeline definition, for example, gitlab.example.com/my-group/my-project//.gitlab-ci.yml@refs/heads/main. Introduced in GitLab 16.2. This claim is null unless the pipeline definition is located in the same project. */\n        ci_config_ref_uri: {\n          file,\n        },\n        ...(environment) && { environment },\n      },\n    }\n    return trustConfig","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/commands/trust/gitlab.js#L47-L83","documentation":"Thrown by GitLab trust provider's validateFile() when the --file value is not equal to its own path.basename, i.e. it contains path separators. GitLab's trusted-publishing claim references a single top-level pipeline filename inside the project, not an arbitrary relative path, so a value like 'ci/pipeline.yml' or './.gitlab-ci.yml' is rejected before optionsToBody builds the ci_config_ref_uri.","triggerScenarios":"Calling `npm trust gitlab --file ci/.gitlab-ci.yml ...` or `--file ./config/pipeline.yaml`. Also triggered by a leading './' since basename strips it but the raw string differs. validateFile runs after the .yml/.yaml extension check in flagsToOptions.","commonSituations":"Migrating from a CI setup where the pipeline lives in a subfolder; assuming the flag accepts a path like most CLI file flags; IDE autocomplete inserting a relative path.","solutions":["Use just the filename, e.g. `--file .gitlab-ci.yml`, and ensure the file sits at the repository root.","If you genuinely need a nested pipeline file, move/include it at the repo root since GitLab trusted publishing only supports top-level files.","Strip any './' prefix or directory component before passing the value."],"exampleFix":"// before\nnpm trust gitlab --file ci/.gitlab-ci.yml --project group/proj\n// after\nnpm trust gitlab --file .gitlab-ci.yml --project group/proj","handlingStrategy":"validation","validationCode":"const path = require('node:path')\nconst assertPipelineFile = (file) => {\n  if (file !== path.basename(file)) {\n    throw new TypeError(`Pipeline file must be a bare filename, got: ${file}`)\n  }\n}","typeGuard":"const path = require('node:path')\nconst isBareFilename = (v) => typeof v === 'string' && v === path.basename(v)","tryCatchPattern":"try {\n  await trustGitlab.exec([...])\n} catch (err) {\n  if (/must be just a file/i.test(err.message)) {\n    // strip the directory component and retry with path.basename(file)\n  } else { throw err }\n}","preventionTips":["Keep your pipeline definition at the repository root.","Pass only the filename to --file, never a relative path.","In scripts, normalize with path.basename() before invoking the command."],"tags":["validation","trust","gitlab","cli-args","filepath"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}