nodejs/node · error · Error

vcs-origin must not include a scheme (e.g., use 'github.com/

Error message

vcs-origin must not include a scheme (e.g., use 'github.com/owner/repo' not 'https://github.com/owner/repo')

What it means

Thrown by the CircleCI trust provider's `validateVcsOrigin` when the `--vcs-origin` value contains `://`, i.e. it includes a URL scheme. The expected format is a bare host path (`provider/owner/repo`) because the tool prepends `https://` itself.

Source

Thrown at deps/npm/lib/commands/trust/circleci.js:64

      description: 'CircleCI context UUID to match',
    }),
    trustDefinitions['allow-publish'],
    trustDefinitions['allow-stage-publish'],
    // globals are alphabetical
    globalDefinitions['dry-run'],
    globalDefinitions.json,
    globalDefinitions.registry,
    globalDefinitions.yes,
  ]

  validateUuid (value, fieldName) {
    validateUUID(value, fieldName)
  }

  validateVcsOrigin (value) {
    // Expected format: provider/owner/repo (e.g., github.com/owner/repo, bitbucket.org/owner/repo)
    if (value.includes('://')) {
      throw new Error("vcs-origin must not include a scheme (e.g., use 'github.com/owner/repo' not 'https://github.com/owner/repo')")
    }
    const parts = value.split('/')
    if (parts.length < 3) {
      throw new Error("vcs-origin must be in format 'provider/owner/repo'")
    }
  }

  // Generate a URL from vcs-origin (e.g., github.com/npm/repo -> https://github.com/npm/repo)
  getVcsOriginUrl (vcsOrigin) {
    if (!vcsOrigin) {
      return null
    }
    // vcs-origin format: github.com/owner/repo or bitbucket.org/owner/repo
    return `https://${vcsOrigin}`
  }

  static optionsToBody (options) {
    const { orgId, projectId, pipelineDefinitionId, vcsOrigin, contextIds } = options

View on GitHub (pinned to 1b2de5e052)

Solutions

1. Strip the scheme and trailing slash: pass `github.com/owner/repo`.
2. Use the helper `getVcsOriginUrl` mentally — the tool adds `https://` for you.
3. If scripting, normalize with `value.replace(/^https?:\/\//, '').replace(/\/$/, '')` before passing.

Example fix

// before
--vcs-origin https://github.com/npm/repo
// after
--vcs-origin github.com/npm/repo

function normalizeVcsOrigin(value) {
  let v = String(value).trim().replace(/^https?:\/\//, '').replace(/\/$/, '')
  if (v.includes('://')) throw new Error('vcs-origin must not include a scheme')
  return v
}

When it happens

Trigger: Calling the trust command with `--vcs-origin https://github.com/owner/repo` (or any `scheme://...` value); `value.includes('://')` is true.

Common situations: Copy-pasting the repository URL directly from a browser; CI config templating that injects a full URL; confusion with the GitHub provider which accepts a different shape.

Related errors

• vcs-origin must be in format 'provider/owner/repo'
• vcs-origin is required
• Package name must be specified either as an argument or in p
• org-id is required
• project-id is required

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/45f3f91883190db2. Report an issue: GitHub.