nodejs/node · error · Error

At least one permission flag is required (--allow-publish, -

Error message

At least one permission flag is required (--allow-publish, --allow-stage-publish)

What it means

Thrown by TrustCommand.createConfigCommand when neither `--allow-publish` nor `--allow-stage-publish` is set to true. A trust config must grant at least one publish permission to be meaningful; with both false the permissions array would be empty, so the command rejects the invocation before calling flagsToOptions.

Source

Thrown at deps/npm/lib/trust-cmd.js:215

  // generic
  static bodyToOptions (body) {
    return {
      ...(body.id) && { id: body.id },
      ...(body.type) && { type: body.type },
    }
  }

  async createConfigCommand ({ positionalArgs, flags }) {
    const { providerName, providerEntity, providerHostname } = this.constructor
    const dryRun = this.config.get('dry-run')
    const yes = this.config.get('yes') // deep-lore this allows for --no-yes

    const allowPublish = flags['allow-publish']
    const allowStagePublish = flags['allow-stage-publish']

    if (!allowPublish && !allowStagePublish) {
      throw new Error('At least one permission flag is required (--allow-publish, --allow-stage-publish)')
    }

    const permissions = []
    if (allowPublish) {
      permissions.push(PERMISSIONS.CREATE_PACKAGE)
    }
    if (allowStagePublish) {
      permissions.push(PERMISSIONS.CREATE_STAGED_PACKAGE)
    }

    const options = await this.flagsToOptions({ positionalArgs, flags, providerHostname })
    this.dialogue`Establishing trust between ${options.values.package} package and ${providerName}`
    this.dialogue`Anyone with ${providerEntity} write access can publish to ${options.values.package}`
    this.dialogue`Two-factor authentication is required for this operation`
    if (!this.registryIsDefault) {
      this.warn`Registry ${this.npm.config.get('registry')} may not support trusted publishing`
    }
    this.logOptions({ ...options, permissions })

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Add `--allow-publish` (to allow `npm publish`) and/or `--allow-stage-publish` (to allow staged publishing).
2. Check `npm trust gitlab --usage` / help output for the full flag set.
3. Run with `--dry-run --allow-publish` first to preview the body that would be sent.

Example fix

// before
npm trust gitlab --file .gitlab-ci.yml --project g/p
// after
npm trust gitlab --file .gitlab-ci.yml --project g/p --allow-publish

const allowPublish = flags['allow-publish']
const allowStagePublish = flags['allow-stage-publish']
if (!allowPublish && !allowStagePublish) {
  throw new Error('At least one of --allow-publish or --allow-stage-publish is required')
}

const hasPublishPermission = (flags) =>
  Boolean(flags && (flags['allow-publish'] || flags['allow-stage-publish']))

try {
  await createConfigCommand(...)
} catch (err) {
  if (/permission flag is required/i.test(err.message)) {
    // prompt: 'Allow publish? (y/N)' then set the flag and retry
  } else { throw err }
}

When it happens

Trigger: Running `npm trust gitlab --file .gitlab-ci.yml --project g/p` with no permission flag, or with `--no-allow-publish --no-allow-stage-publish`. The check reads flags['allow-publish'] and flags['allow-stage-publish'] which default to false.

Common situations: First-time users unfamiliar with the required flags; copy-paste from docs that omitted the permission flags; assuming the command would default to allow-publish.

Related errors

• ${this.constructor.providerEntity} must be specified in the
• GitLab CI/CD pipeline file must be just a file not a path
• Package name must be specified either as an argument or in t
• Package name must be specified either as an argument or in t
• ID of the trusted relationship to revoke must be specified w

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/ab916940b500c68d. Report an issue: GitHub.