Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/wait-for-deployment-action →
// reviewed by pulllight
PullLight found 3 issues
1 high
1 medium
// convert to your repo
PullLight caught 3 1 high, 1 medium on this PR.
Install on vercel/wait-for-deployment-action to get this on every PR automatically — 60 seconds.
Findings
3 issues
logic
logic
When `vercelToken` is set, the `source` is `{ type: 'vercel', ... }` and the branch `source.type === 'vercel'` correctly calls `resolveDeploymentIdFromUrl`. However, the outer guard is still `if (config.statusContext)`, which means the Vercel path is silently skipped whenever `statusContext` is empty — even though the user explicitly provided a `vercel-token`. A user who sets `vercel-token` but leaves `status-context` empty (or sets it to `''`) will get no deployment ID resolved and no error, contrary to their intent.
// src/run.ts:151
high
error-handling
`assert(response.ok, ...)` throws an `AssertionError` (not a plain `Error`) when the Vercel API returns a non-2xx status. The error message includes only the status code, not the response body, making it hard to diagnose auth failures (401/403) or rate-limit responses (429). More critically, the response body is never consumed, which can leave the underlying socket in a bad state in some Node.js fetch implementations. At minimum, read and include the body in the error message.
// src/vercel.ts:23
⚡ Suggested fix
const response = await fetch(url, {
headers: { Authorization: `Bearer ${source.token}` },
});
if (!response.ok) {
const body = await response.text().catch(() => '');
throw new Error(
`Vercel API returned ${response.status} for ${hostname}: ${body}`,
);
}
medium
auth
The Vercel token (`source.token`) is passed directly in the `Authorization` header and will appear in any uncaught exception message (e.g. from `assert`) or debug logs that print the full request object. Consider masking the token in error messages or ensuring it is never interpolated into log output.
// src/vercel.ts:14