Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/wait-for-deployment-action →
// reviewed by pulllight

PullLight found 3 issues

vercel/wait-for-deployment-action #5 — Fix deployment ID resolution across environments by @NathanColosimo Jun 28, 2026
1 high 1 medium
🔍
// convert to your repo
PullLight caught 3 1 high, 1 medium on this PR.
Install on vercel/wait-for-deployment-action to get this on every PR automatically — 60 seconds.
Findings
3 issues
logic logic
When `vercelToken` is set, the `source` is `{ type: 'vercel', ... }` and the branch `source.type === 'vercel'` correctly calls `resolveDeploymentIdFromUrl`. However, the outer guard is still `if (config.statusContext)`, which means the Vercel path is silently skipped whenever `statusContext` is empty — even though the user explicitly provided a `vercel-token`. A user who sets `vercel-token` but leaves `status-context` empty (or sets it to `''`) will get no deployment ID resolved and no error, contrary to their intent.
// src/run.ts:151
high error-handling
`assert(response.ok, ...)` throws an `AssertionError` (not a plain `Error`) when the Vercel API returns a non-2xx status. The error message includes only the status code, not the response body, making it hard to diagnose auth failures (401/403) or rate-limit responses (429). More critically, the response body is never consumed, which can leave the underlying socket in a bad state in some Node.js fetch implementations. At minimum, read and include the body in the error message.
// src/vercel.ts:23
⚡ Suggested fix
const response = await fetch(url, {
	headers: { Authorization: `Bearer ${source.token}` },
});
if (!response.ok) {
	const body = await response.text().catch(() => '');
	throw new Error(
		`Vercel API returned ${response.status} for ${hostname}: ${body}`,
	);
}
medium auth
The Vercel token (`source.token`) is passed directly in the `Authorization` header and will appear in any uncaught exception message (e.g. from `assert`) or debug logs that print the full request object. Consider masking the token in error messages or ensuring it is never interpolated into log output.
// src/vercel.ts:14
model: claude-sonnet-4-5   input: 6094 tokens   output: 730 tokens