vercel-ci-integration

The configuration is a conventional release workflow and contains no direct evidence of malware. It presents a supply-chain security risk because a production Vercel secret is available to npm installation, test, and build scripts, and because a tag push automatically performs npm publish. Restrict the secret to the single step that requires it, use least-privilege credentials, enforce protected release tags and approvals, and pin third-party actions to immutable commit SHAs.