GitHub Actions "Invalid pattern" in a paths / branches Filter
A filter pattern is not a legal glob. An empty entry, a stray character, or an unsupported construct in paths/branches/tags makes the workflow invalid.
What this error means
The workflow is invalid with "Invalid pattern 'x'", naming the bad entry in a paths, paths-ignore, branches, or tags filter.
Invalid workflow file: .github/workflows/ci.yml
Invalid pattern '[src': the pattern is malformedDiagnose it: print the context before you change anything
Most workflow-expression bugs are not syntax errors, they are an expression reading something that is empty. GitHub resolves a missing property to an empty string instead of failing the run, so a wrong reference looks like a logic bug rather than a mistake. Dump the contexts first and you will usually see the answer immediately.
- name: Dump contexts
run: |
echo '--- github ---' ; echo '${{ toJSON(github) }}'
echo '--- needs ---' ; echo '${{ toJSON(needs) }}'
echo '--- steps ---' ; echo '${{ toJSON(steps) }}'
echo '--- matrix ---' ; echo '${{ toJSON(matrix) }}'
echo '--- inputs ---' ; echo '${{ toJSON(inputs) }}'Check the context is allowed where you used it
Contexts are not available everywhere. The same expression can be valid in a step if and invalid in a job if, which is why an expression that works in one workflow fails when moved.
| Where you wrote it | Contexts available there |
|---|---|
run-name | github, inputs, vars |
concurrency | github, inputs, vars |
Top-level env | github, secrets, inputs, vars |
jobs.<id>.if | github, needs, vars, inputs |
jobs.<id>.steps.if | github, needs, strategy, matrix, job, runner, env, vars, steps, inputs |
jobs.<id>.outputs | Full access, including secrets |
Reusable workflow outputs | github, jobs, vars, inputs |
Common causes
Malformed or empty glob entry
An unclosed character class, an empty string in the list, or a stray quote produces an invalid pattern the filter cannot compile.
Unsupported glob construct
Filter globs support *, **, ?, +, !, and character ranges. Using a construct outside the supported set (or escaping wrong) is rejected.
How to fix it
Use valid filter glob syntax
Write well-formed patterns with supported wildcards, and quote entries that start with special characters.
on:
push:
paths:
- 'src/**'
- '!src/**/*.md'
branches:
- 'release/**'Fix the named pattern
- Open the named entry and close any unbalanced brackets or quotes.
- Use ** for recursive directory matches and ! for negation within paths.
- Remove blank list items that resolve to an empty pattern.
Catch it before it reaches CI
Every failure in this cluster is statically detectable. actionlint parses workflow expressions, checks context availability against the same rules above, and validates needs references, so these bugs never need to cost you a run.
# one-off
docker run --rm -v "$(pwd):/repo" --workdir /repo rhysd/actionlint:latest -color
# as a job, before anything expensive runs
- uses: actions/checkout@v4
- run: |
bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
./actionlint -colorHow to prevent it
- Quote patterns beginning with special characters.
- Stick to supported glob wildcards (*, **, ?, +, !, ranges).
- Validate filters with actionlint before pushing.