From d5890e900b4c0b486ca72e8635719009ddd20217 Mon Sep 17 00:00:00 2001
From: Scion <scion@studiowhy.net>
Date: Thu, 12 Mar 2026 22:05:20 -0700
Subject: [PATCH] Use realpath.

---
 npm/npm-push/action.yaml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/npm/npm-push/action.yaml b/npm/npm-push/action.yaml
index 6494136..e54252b 100644
--- a/npm/npm-push/action.yaml
+++ b/npm/npm-push/action.yaml
@@ -32,15 +32,12 @@ runs:
       node-version: ${{ inputs.nodeVersion }}
   - name: "Publish package"
     run: |
-      # Ensure path starts with ./ so npm recognizes it as a file path
       TGZ_PATH="${{ inputs.tgz }}"
       # Trim whitespace
       TGZ_PATH=$(echo "$TGZ_PATH" | xargs)
 
-      if [[ ! "$TGZ_PATH" =~ ^(\./|/|~) ]]; then
-        echo "Path does not start with ./ / or ~, adding ./ prefix"
-        TGZ_PATH="./$TGZ_PATH"
-      fi
+      # Resolve to absolute path so npm never misinterprets it as a git shorthand
+      TGZ_PATH="$(realpath "$TGZ_PATH")"
 
       # Verify the tarball exists
       if [ ! -f "$TGZ_PATH" ]; then
@@ -55,8 +52,6 @@ runs:
 
       echo "Publishing $TGZ_PATH to ${{ inputs.registry }}"
       npm publish "$TGZ_PATH" --access ${{ inputs.access }}
-
-      echo "Package published successfully"
     working-directory: ${{ inputs.workingDirectory }}
     shell: bash
   - name: "Clean up npm authentication"