vercel/serve
main · 37b3a74Cached · audited 10 September 2026serve installs, builds, and passes its full test suite in under 25 seconds, but its documented type-check command never runs in CI and the CLI's entry point is completely untested, so "green locally" is not a reliable predictor of "green in CI".
The core loop (install, build, unit tests, help) is fast and clean, and supported Node versions are all exercised in CI. The debt sits one layer down: package.json advertises pnpm run test:tsc as a required check but no workflow runs it, source/main.ts (the actual CLI entry point) has 0% coverage despite housing all the exit-code and error-logging logic, and there is no machine-readable output mode, documented exit-code contract, or agent entry file to make the tool scriptable or debuggable by…
Nine areas
Findings
Six, ranked by severity. Every one carries the command that proves it and a prompt that closes it.
test:tsc is documented in package.json but absent from all three CI workflows
package.json exposes pnpm run test:tsc as part of the documented test suite, but ci.yaml, release-snapshot.yaml, and release.yaml never invoke it, so a contributor's clean local type-check run gives no signal about whether CI will pass.
grep for 'test:tsc' (or the underlying tsc invocation) inside a CI workflow file that triggers on pull_request, and confirm the job fails when a type error is introduced.
Hard gates
A gate fires only on an observed failure. Our execution budget is 10 minutes; the standard allows 15; a gate the budget cut before it could be observed reads unverified.