Use realpath.

npm/npm-push/action.yaml

@@ -32,15 +32,12 @@ runs:
       node-version: ${{ inputs.nodeVersion }}
   - name: "Publish package"
     run: |
-      # Ensure path starts with ./ so npm recognizes it as a file path
       TGZ_PATH="${{ inputs.tgz }}"
       # Trim whitespace
       TGZ_PATH=$(echo "$TGZ_PATH" | xargs)
 
-      if [[ ! "$TGZ_PATH" =~ ^(\./|/|~) ]]; then
-        echo "Path does not start with ./ / or ~, adding ./ prefix"
-        TGZ_PATH="./$TGZ_PATH"
-      fi
+      # Resolve to absolute path so npm never misinterprets it as a git shorthand
+      TGZ_PATH="$(realpath "$TGZ_PATH")"
 
       # Verify the tarball exists
       if [ ! -f "$TGZ_PATH" ]; then
@@ -55,8 +52,6 @@ runs:
 
       echo "Publishing $TGZ_PATH to ${{ inputs.registry }}"
       npm publish "$TGZ_PATH" --access ${{ inputs.access }}
-
-      echo "Package published successfully"
     working-directory: ${{ inputs.workingDirectory }}
     shell: bash
   - name: "Clean up npm authentication"