Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/wait-for-deployment-action →
// reviewed by pulllight
PullLight found 3 issues
1 high
2 medium
// convert to your repo
PullLight caught 3 1 high, 2 medium on this PR.
Install on vercel/wait-for-deployment-action to get this on every PR automatically — 60 seconds.
Findings
3 issues
high
logic
When `vercelToken` is set, `source.type === 'vercel'` and the deployment ID is resolved via the Vercel API — but the outer guard is still `if (config.statusContext)`. This means that if a user supplies `vercel-token` but leaves `status-context` empty (or clears it), the Vercel path is never entered and `deploymentId` stays `''`. The condition should be `if (config.statusContext || config.vercelToken)` so the Vercel path is reachable independently of `statusContext`.
// src/run.ts:151
⚡ Suggested fix
let deploymentId = '';
if (config.statusContext || config.vercelToken) {
medium
error-handling
`assert` from `node:assert/strict` throws an `AssertionError` whose `message` is the second argument string. However, the error message for a non-OK response does not include the response body, making it hard to diagnose Vercel API errors (e.g. 401 Unauthorized, 403 Forbidden, 404 Not Found). Consider reading `response.text()` and including it in the assertion message.
// src/vercel.ts:23
medium
auth
The Vercel token (`source.token`) is passed in the `Authorization` header. If `deploymentUrl` is not an `https://` URL (e.g. an attacker-controlled redirect or a misconfigured `environment_url` pointing to a non-Vercel host), the token will be sent to an unintended host. Consider validating that the resolved hostname ends with `.vercel.app` or matches an expected pattern before making the request.
// src/vercel.ts:14