Code Review & Testing Checklist for Agency & Consulting

Adopt a pattern like client-acme/JIRA-123-short-summary to enable filtering, reporting, and fast context switching across accounts. Enforce via a pre-push hook or CI regex check.

Update your branch from main before opening a PR to surface conflicts early and reduce noisy review diffs. Automate with a CI check that fails if the branch is behind by more than N commits.

Execute ESLint, Stylelint, and Prettier (or Black/flake8 for Python) via a single npm/yarn or make command before pushing. Add pre-commit hooks to stop avoidable style churn that wastes reviewer time.

Require a PR template that captures problem statement, scope, acceptance criteria, and risk notes tied to the client's SOW. Link the Jira/Linear ticket and include testing instructions for reviewers.

Include before/after screenshots, short Looms, or Storybook links for any UI work to reduce back-and-forth with account managers. Standardize naming so client-facing QA can reuse assets.

Block merges unless CI passes, reviews are approved, and conversations are resolved using GitHub/GitLab branch protection. This reduces regressions and makes quality non-negotiable across clients.

Run ESLint, Stylelint, and language analyzers (e.g., golangci-lint, Pylint) in CI with centrally managed configs. Fail the build on rule violations to keep code quality consistent across accounts.

Execute TypeScript tsc, webpack/Vite builds, or language-specific compiles to catch breaking changes early. Cache dependencies and builds to keep pipelines fast enough for agency SLAs.

Run Jest, Vitest, PyTest, or RSpec and enforce coverage on changed files (e.g., 80 percent patch coverage) using Codecov or Sonar coverage on new code. Targeted gates improve quality without slowing delivery.

Use SonarQube/SonarCloud to fail PRs that introduce critical bugs, code smells, or reduce coverage on new code. Share dashboards by client to make quality visible to account stakeholders.

Enable Dependabot, Renovate, or Snyk to detect CVEs and open remediation PRs with severity-based merge policies. Gate merges if critical vulnerabilities touch runtime paths.

Activate GitHub secret scanning or Gitleaks in CI to block leaked tokens and keys. Add pre-commit hooks and revoke any detected credentials immediately to protect client environments.

Run OWASP ZAP or Burp Suite automated scans on staging URLs and attach the report to the PR. Require a clean report or documented risk acceptance for high/critical findings.

Scan Docker images with Trivy or Grype and enforce a policy that blocks images with unfixed critical vulnerabilities. Prefer distroless or minimal base images to shrink the attack surface.

Scan Terraform/CloudFormation with tfsec or Checkov for misconfigurations like public S3 buckets or open security groups. Fail builds that violate client-specific guardrails and tagging policies.

Configure CODEOWNERS per domain (e.g., auth, billing, frontend) so the right specialists are auto-requested. This reduces review latency and surfaces implicit knowledge on client nuances.

Prioritize changes that modify public interfaces, shared libraries, or cross-service contracts. Add a checklist item to inspect backward compatibility and deprecation notes.

Spot N+1s, missing indexes, and unbounded loops by reviewing ORM queries or adding EXPLAIN plans to PRs. For web apps, attach a Lighthouse diff to flag perf regressions early.

Verify tenant scoping on queries and API handlers, and ensure authorization checks guard every boundary. This is vital for agencies running shared platforms across clients.

Label PRs as low/medium/high risk and route high risk to senior reviewers with faster SLA per the client's SOW. Use automation to ping the right channel when high risk work arrives.

Capture regressions by adding a unit or integration test that reproduces the issue, then fix it. This creates a permanent safety net and verifiable proof of work for client reports.

Use Pact, Spring Cloud Contract, or MSW to assert consumer-provider contracts and prevent breaking API changes. Run contract verification in both consumer and provider pipelines.

Define Playwright/Cypress flows that mirror key client roles, like admin checkout or content publishing. Trigger these on every release candidate to guard revenue-critical paths.

Maintain seed scripts and sanitized fixtures so staging can be rebuilt quickly without exposing PII. Prefer ephemeral databases on CI to keep tests isolated and fast.

Run axe-core or pa11y in CI and fix WCAG 2.1 AA violations on modified pages. Include contrast, focus order, and ARIA checks to reduce client QA churn and legal risk.

Use Conventional Commits and squash merges to keep history clean and enable automated changelog generation. Consistent commit messages make client-facing notes faster to produce.

Tag versions and generate release notes via semantic-release or GitLab Releases, then post to the client's Slack channel with ticket links. This builds trust and reduces account manager load.

Wrap risky changes in LaunchDarkly, Unleash, or OpenFeature flags and ship dark to a small cohort first. This de-risks deployments while maintaining delivery speed.

Monitor with Sentry, Datadog, or New Relic and enforce SLOs with error budgets that pause rollouts on spikes. Alert the project channel automatically when thresholds are breached.

Store CI logs, security scan reports, and approval records keyed by PR ID for each client. This speeds compliance responses and supports fixed-fee engagements with clear proof of work.