Require --config files to be next to the package.json file

docs/06-configuration.md

@@ -119,6 +119,8 @@ Note that the final configuration must not be a promise.
 
 The [CLI] lets you specify a specific configuration file, using the `--config` flag. This file is processed just like an `ava.config.js` file would be. When the `--config` flag is set, the provided file will override all configuration from the `package.json` and `ava.config.js` files. The configuration is not merged.
 
+The configuration file *must* be in the same directory as the `package.json` file.
+
 You can use this to customize configuration for a specific test run. For instance, you may want to run unit tests separately from integration tests:
 
 `ava.config.js`:

lib/load-config.js

@@ -7,14 +7,23 @@ const pkgConf = require('pkg-conf');
 const NO_SUCH_FILE = Symbol('no ava.config.js file');
 const MISSING_DEFAULT_EXPORT = Symbol('missing default export');
 
-function loadConfig({configFile, resolveFrom = process.cwd(), defaults = {}} = {}) {
+function loadConfig({configFile, resolveFrom = process.cwd(), defaults = {}} = {}) { // eslint-disable-line complexity
 	let packageConf = pkgConf.sync('ava', {cwd: resolveFrom});
 	const filepath = pkgConf.filepath(packageConf);
 	const projectDir = filepath === null ? resolveFrom : path.dirname(filepath);
 
 	const fileForErrorMessage = configFile || 'ava.config.js';
 	const allowConflictWithPackageJson = Boolean(configFile);
 
+	if (configFile) {
+		configFile = path.resolve(configFile); // Relative to CWD
+		if (path.basename(configFile) !== path.relative(projectDir, configFile)) {
+			throw new Error('Config files must be located next to the package.json file');
+		}
+	} else {
+		configFile = path.join(projectDir, 'ava.config.js');
+	}
+
 	let fileConf;
 	try {
 		({default: fileConf = MISSING_DEFAULT_EXPORT} = esm(module, {
@@ -29,7 +38,7 @@ function loadConfig({configFile, resolveFrom = process.cwd(), defaults = {}} = {
 			},
 			force: true,
 			mode: 'all'
-		})(configFile ? path.resolve(configFile) : path.join(projectDir, 'ava.config.js')));
+		})(configFile));
 	} catch (error) {
 		if (error && error.code === 'MODULE_NOT_FOUND') {
 			fileConf = NO_SUCH_FILE;

test/fixture/load-config/package-yes-explicit-yes/nested/explicit.js

@@ -0,0 +1,3 @@
+export default {
+	files: 'package-yes-explicit-yes-nested-test-value'
+};

test/load-config.js

@@ -41,6 +41,12 @@ test('explicit configFile option overrides package.json config', t => {
 	t.end();
 });
 
+test('throws if configFile option is not in the same directory as the package.json file', t => {
+	changeDir('package-yes-explicit-yes');
+	t.throws(() => loadConfig({configFile: 'nested/explicit.js'}), /Config files must be located next to the package.json file/);
+	t.end();
+});
+
 test('merges in defaults passed with initial call', t => {
 	changeDir('package-only');
 	const defaults = {