Code Review & Testing Checklist for Web Development

Use ESLint with your framework presets (airbnb, next, vue) and Prettier for consistent style. Block commits with lint-staged and Husky so CI does not waste cycles on avoidable failures.

Turn on strict, noImplicitAny, and noUncheckedIndexedAccess to catch runtime bugs at compile time. Run tsc -noEmit locally to ensure no type regressions slip into PRs.

Execute Jest or Vitest with --coverage and verify thresholds before pushing. Catch broken mocks and platform-specific failures early to avoid wasted review cycles.

Split large changes and keep diffs focused under roughly 400 lines. Use Conventional Commits to make history, changelogs, and revert operations more reliable.

Revise README, Storybook stories, and OpenAPI or GraphQL schemas when behavior changes. Prevent documentation drift and consumer breakage by updating examples alongside code.

Ensure .env files are gitignored and secrets are read from process.env. Scan staged changes with gitleaks in a pre-commit hook to detect accidental credential commits.

Use npm audit, pnpm audit, or Snyk CLI to surface known vulnerabilities. Document temporary ignores with justification to avoid long-term risk acceptance.

Run ESLint and Prettier in CI on every PR and fail fast. Use problem matchers in GitHub Actions or GitLab CI to post inline annotations for quick fixes.

Run a dedicated type-check step to catch cross-package type errors missed locally. Treat new warnings as errors to prevent gradual type decay.

Apply rules tailored for React XSS sinks, Node.js path traversal, unsafe eval, and cookie security. Enforce quality gates to block PRs with critical findings.

Combine Dependabot or Renovate with Snyk or npm audit in CI to block merges with high severity CVEs. Require an approved ignore file for time-bound exceptions.

Enable platform secret scanning or run gitleaks on changed files. Alert reviewers immediately when tokens, keys, or private endpoints appear.

If deploying Docker, scan images with Trivy and prefer distroless or Alpine bases. Fail builds that introduce high CVEs into runtime layers.

Use license-checker or FOSSA to enforce allowed license lists. Flag GPL-incompatible packages in client bundles and server dependencies before merge.

Set Jest or Vitest coverage thresholds per workspace and use Codecov or diff-coverage to prevent erosion. Block PRs that reduce coverage on changed lines.

Use React Testing Library or Vue Test Utils to test via accessible queries like getByRole rather than class names. Focus on user-observable behavior for robustness.

Build Cypress or Playwright tests for sign-in, payments, and settings save flows. Run against preview environments on every PR to validate integration points.

For REST use supertest with Express/Fastify, and validate OpenAPI changes. For microservices, enforce Pacts or schema validation to avoid breaking consumers.

Use Mock Service Worker in unit and component tests to simulate network boundaries. Reduce flakiness from third-party APIs while preserving realistic request shapes.

Limit snapshots to stable structures with custom serializers and explicitly review diffs. Reject snapshots that hide behavior changes behind noisy updates.

Enable retries in Cypress or Playwright for known flakes and tag them for quarantine. Open tracking issues and prioritize eliminating nondeterminism.

Set budgets for LCP, CLS, TBT, and PWA checks and run Lighthouse CI on preview builds. Fail PRs that exceed agreed performance thresholds.

Use webpack-bundle-analyzer or source-map-explorer to identify heavy modules. Ensure ESM builds tree-shake correctly and remove dev-only imports.

Check for AVIF/WebP, responsive srcset, and font-display swap or optional. Verify framework optimizers (Next.js, Nuxt) are configured for prod.

Run axe-core in Jest, Cypress, or Playwright to catch WCAG violations like missing labels or low contrast. Gate merges on critical a11y issues.

Execute Playwright across Chromium, WebKit, and Firefox and test breakpoints for mobile, tablet, and desktop. Catch vendor-specific and layout regressions.

Integrate Percy, Chromatic, or Loki for screenshot diffs against baseline. Review per-story or per-route changes and approve intentional deltas.

Automate tests for ICU message formatting, pluralization, and RTL alignment for locales like ar and he. Prevent text overflow and mirroring issues.

Require at least two reviewers and auto-request domain owners for security, database, or UI layers. Increase scrutiny where changes carry high blast radius.

Include sections for risks, screenshots, performance impact, and test plan. Reviewers can validate coverage quickly and agree on expected outcomes.

Gate merges on green lint, tests, coverage, and security scans. Require a fast-forward or rebase to keep main history clean and reproducible.

Spin up ephemeral environments on Vercel, Netlify, or Render and post the URL to the PR. Enable manual QA, product review, and a11y audits pre-merge.

Provide migration diffs, expected lock times, and a tested downgrade script. Use Prisma Migrate or Knex dry runs and validate on a staging snapshot.

Wrap risky features with server and client flags and deploy dark. Use percentage rollouts and a kill switch to recover quickly if metrics degrade.

Tie deploys to Sentry, Datadog, or OpenTelemetry dashboards with alert thresholds. Auto-create rollback tasks if error rate or latency SLOs are breached.