Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/wait-for-deployment-action →
// reviewed by pulllight
PullLight found 3 issues
1 high
2 medium
// convert to your repo
PullLight caught 3 1 high, 2 medium on this PR.
Install on vercel/wait-for-deployment-action to get this on every PR automatically — 60 seconds.
Findings
3 issues
high
logic
When `vercelToken` is set, `source.type === 'vercel'` but the outer guard is still `if (config.statusContext)`. This means if a user sets `vercel-token` but leaves `status-context` empty (or clears it), the Vercel path is never entered and `deploymentId` stays empty — even though the Vercel token makes `statusContext` irrelevant. The condition should be `if (config.statusContext || config.vercelToken)` to allow the Vercel path to execute independently of `statusContext`.
// src/run.ts:151
⚡ Suggested fix
let deploymentId = '';
if (config.statusContext || config.vercelToken) {
medium
error-handling
`assert` from `node:assert/strict` throws an `AssertionError` (not a plain `Error`) when the response is not ok. The error message includes only the status code and hostname, but not the response body, making it hard to diagnose Vercel API errors (e.g. invalid token, rate limit). Consider reading the response body and including it in the error message.
// src/vercel.ts:23
medium
other
The Vercel token (`source.token`) is interpolated directly into the `Authorization` header and will appear in any error/debug logs that dump request headers. If the `assert` on line 23 fires and the AssertionError is logged with the request context, the token could be exposed. Consider masking the token in logs (e.g. via `core.setSecret`) before use.
// src/vercel.ts:14