nodejs/node · error · Error

vcs-origin is required

Error message

vcs-origin is required

What it means

Thrown by the CircleCI trust provider's `flagsToOptions` when the `--vcs-origin` flag is missing or empty. The VCS origin (`provider/owner/repo`) anchors the OIDC claim to a source repository, so it is required.

Source

Thrown at deps/npm/lib/commands/trust/circleci.js:138

    const orgId = flags['org-id']
    const projectId = flags['project-id']
    const pipelineDefinitionId = flags['pipeline-definition-id']
    const vcsOrigin = flags['vcs-origin']
    const contextIds = flags['context-id']

    // Validate required flags
    if (!orgId) {
      throw new Error('org-id is required')
    }
    if (!projectId) {
      throw new Error('project-id is required')
    }
    if (!pipelineDefinitionId) {
      throw new Error('pipeline-definition-id is required')
    }
    if (!vcsOrigin) {
      throw new Error('vcs-origin is required')
    }

    // Validate formats
    this.validateUuid(orgId, 'org-id')
    this.validateUuid(projectId, 'project-id')
    this.validateUuid(pipelineDefinitionId, 'pipeline-definition-id')
    this.validateVcsOrigin(vcsOrigin)
    if (contextIds?.length > 0) {
      for (const contextId of contextIds) {
        this.validateUuid(contextId, 'context-id')
      }
    }

    return {
      values: {
        package: pkgName,
        orgId,
        projectId,

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Pass `--vcs-origin github.com/owner/repo` (no scheme; see the format validators).
2. Derive it from the checkout URL in CI and strip the scheme.
3. Ensure both presence and the `provider/owner/repo` format to avoid the follow-up validation errors.

Example fix

// before
npm trust circleci mypkg --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid>
// after
npm trust circleci mypkg --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid> --vcs-origin github.com/owner/repo

function assertRequiredFlag(flags, name) {
  if (!flags[name]) throw new Error(`${name} is required`)
  return flags[name]
}
assertRequiredFlag(flags, 'vcs-origin')

function hasVcsOrigin(flags) {
  return Boolean(flags && flags['vcs-origin'])
}

When it happens

Trigger: `flags['vcs-origin']` is falsy during required-flag validation (the last required check before format validation).

Common situations: Forgetting the flag; assuming it is derived from the project; CI templates that don't forward the repository coordinates.

Related errors

• vcs-origin must not include a scheme (e.g., use 'github.com/
• vcs-origin must be in format 'provider/owner/repo'
• org-id is required
• project-id is required
• pipeline-definition-id is required

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/9c18683289b02229. Report an issue: GitHub.