vercel/workflow
main · 7740388Cached · audited 10 September 2026no score
not scoredUNVERIFIED
vercel/workflow could not be verified end to end inside DX Score's execution budget.
StageCommandOutcome
understandcat packages/workflow/README.md0 · 0 s
installpnpm install0 · 46 s
buildpnpm run buildcut at 7 s
testpnpm test1 · 7 s
executenpx workflow webcut at 30 s
What you can do
1Re-run once the tree has changed — every audit gets the same 2 vCPU machine, so the budget only clears if the repository got cheaper to build. Sign in with GitHub to re-run
2Take the static findings anyway — two were produced without execution and are labelled Reviewed. See them
3Point us at a smaller workspace member: append /tree/main/<package> to the URL.
EXECUTION_BUDGET_EXCEEDED · recorded as P2 · no gate fired
Nine areas
Observedwe executed it — can reach 100
Reviewedread the code and its generated output — capped at 84
Estimatedprose only — capped at 69
AreaWeightScore barEvidenceScore
Time to first value20 → 22Observed
API15 → 17Observed
SDK10 → 0fewer than two SDK packages sharing the product namenot scored—
CLI and configuration10 → 11Observed
Errors and recovery12 → 13Observed
Documentation10 → 11Observed
Local development8 → 9Observed
Testing and quality8 → 9Observed
Release and compatibility7 → 8Observed
Findings
Three, ranked by severity. Every one carries the command that proves it and a prompt that closes it.
P2local development · build stage · developer-experience-auditor
pnpm run build was not observed within DX Score's 10-minute execution budget
pnpm run build was still running when our 10-minute execution budget ended; the standard allows 15 min for the magic path and 10 min for local development. Nothing here has failed — we did not see the end of it, so the affected gates and areas are UNVERIFIED rather than scored.
not scored
runner exit 1
wall 1 m 30 s
pnpm run build
Closes when
Point DX Score at a smaller workspace member, or reduce first-build time; every planned step completes inside the 10-minute budget and the affected gates read pass or fired.
DX Score could not finish pnpm run build within its 10-minute execution budget. Look for the slowest part of the install or build path (dependency count, native compilation, network fetches) and reduce it, or document a lighter path for a first run.
We never modify your repository. · Disagree with this finding?
P2
docs/content/docs/v4/api-reference/workflow-globals.mdx line 55 contains a secret-shaped string (generic_password_or_secret)
configureP2
docs/content/docs/v5/api-reference/workflow-globals.mdx line 56 contains a secret-shaped string (generic_password_or_secret)
configureHard gates
A gate fires only on an observed failure. Our execution budget is 10 minutes; the standard allows 15; a gate the budget cut before it could be observed reads unverified.
GateResultWhat we checked
BROKEN_CANONICAL_INSTALLpasspnpm install exits 0 from a clean clone with no credential prompt
NON_REPRODUCIBLE_BUILDunverifiedinstall, build and test did not finish inside our 10-minute execution budget — the standard allows 10 min, so nothing here has failed; we just didn't see the end of it
BROKEN_QUICKSTARTunverifiednpx workflow web was still running at 1 m 30 s when our 10-minute execution budget ended — the standard allows 15 min, so nothing here has failed; we just didn't see the end of it
UNVERIFIABLE_CI_PARITYpassthe package.json test command pnpm test appears in .github/workflows/backport.yml, .github/workflows/benchmarks.yml, .github/workflows/bundle-size.yml, .github/workflows/debug-windows.yml, .github/workflows/docs-checks.yml, .github/workflows/e2e-community-world.yml, .github/workflows/event-log-race-repro.yml, .github/workflows/issue-digest.yml, doc:packages/workflow/README.md
UNTESTED_SUPPORTED_VERSIONpassevery version the repository claims to support appears in the CI matrix
UNSAFE_EXAMPLESpass2 secret-shaped strings found, none judged to encourage unsafe handling — P2, no gate
UNEXPLAINED_ERRORunverifiedno break or diagnose step executed — inventory-only evidence yields P2 findings, never this gate
UNDOCUMENTED_BREAKING_APInot yetneeds two versions to compare — coming in v2
SDK_API_DRIFTnot yetneeds an OpenAPI JSON spec and an SDK language to compare — not in v1
STALE_PUBLIC_REFERENCEnot yetneeds a generated reference to compare against behaviour — not in v1
engine 0.5.0devex-skills 2.9.4+de1abc8anthropic/claude-sonnet-5 · temperature 0runner dx_journey.pyjourney plannedsandbox universal · 2 vCPUno hard gate fired