@ai-sdk/google-vertex

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which is a transparency caution; the organization-owned monorepo context makes a name mismatch understandable but does not fully remove the gap.

Workflow auditcaution

All 13 workflows were analyzed and actions are pinned, but one workflow combines workflow_run with an untrusted checkout, and two workflows use top-level write permissions. High-confidence blanket GitHub App permissions add workflow hygiene risk, while the repeated low-confidence cache findings are not decisive.