Code Review & Testing Checklist for E-Commerce

Name branches like feat/checkout-3ds-BFCM-1234 so reviewers see scope and seasonal risk immediately. This helps prioritize reviews during code freezes and reduces confusion when multiple promo features overlap.

Map checkout, payments, catalog, and analytics folders to specific reviewers using CODEOWNERS so critical owners are auto-requested on every PR. This avoids misses on sensitive paths like pricing or tax logic.

Require PRs to include a test plan, affected routes or components, screenshots for mobile and desktop, and a before and after for structured data. This reduces back-and-forth and keeps reviewers focused on revenue-critical surfaces.

Block or require additional approvals for large diffs during BFCM or promo windows, and label PRs with risk levels. This keeps hot paths like checkout from getting destabilized right before campaigns.

Adopt conventional commit messages and enforce semantic-release so storefront, design system, and shared package versions reflect breaking changes. This helps downstream app compatibility and safer rollback decisions.

Lockfile updates should be controlled by Renovate or Dependabot with pinned ranges and scheduled windows, especially ahead of big promotions. This limits surprise breakage from transitive dependency updates.

Run ESLint, Stylelint, and Prettier with project specific rules for SSR and hydration quirks common in headless storefronts. Diff annotations in CI make violations obvious and avoid regressions.

Enable TypeScript strict mode and use money primitives like Dinero.js to prevent floating point rounding errors in cart totals and discounts. Block PRs that bypass strong typing for currency math.

Use SonarQube or Code Climate to set higher coverage thresholds for checkout, payments, and pricing modules than for marketing pages. Fail the build if critical modules drop below agreed baselines.

Run Gitleaks or TruffleHog to block commits that expose API keys, JWTs, or private keys, and require environment variable references for credentials. This protects payment integrations and marketplace tokens.

Lint Terraform, Pulumi, or Helm charts for CDN cache TTLs, Vary headers, and path based rules that affect product pages and carts. A misconfigured edge rule can tank conversion during spikes.

Use GraphQL Inspector or OpenAPI diff to detect breaking changes to product, pricing, or customer endpoints used by mobile apps and partner marketplaces. Fail the PR if client contracts would break.

Add Jest or PHPUnit tests that validate tax inclusive and exclusive prices, rounding rules, and discount stacking for currencies like JPY and CHF. Use fixtures based on real catalog price points.

Use Pact to verify that your app and Stripe, Adyen, or PayPal stubs agree on request and response contracts for authorizations, 3DS, and refunds. This prevents silent checkout failures after SDK updates.

Run Cypress or Playwright tests for guest and logged in checkout, various shipping methods, gift cards, and 3DS challenges, and cover Apple Pay or Google Pay where supported. Assert against final transaction events.

Use MSW or MirageJS to mock out of stock, backorders, and partial fulfillments from OMS or ERP. Add tests that assert cart and PDP correctly reflect real time availability and do not allow oversell.

Create Algolia or Elasticsearch test suites for typo tolerance, synonyms, and boost rules for seasonal collections. Guard against changes that bury top converting SKUs or break merchandising rules.

Write tests that validate order confirmation templates, localized content, and correct UTM propagation, and use MailHog or Mailpit in CI. Assert GA4 and server side GTM events are emitted once with correct values.

Verify that PANs never touch your servers and that Stripe or Adyen tokenization is used end to end, and assert logs are scrubbed with redaction filters. Add CI checks that block code touching card data paths.

Check Secure, HttpOnly, and SameSite flags on session and cart cookies, enforce HTTPS redirects, and set HSTS. Add CSRF protection tests on cart and account endpoints to prevent cross site attacks.

Run automated tests that ensure GA4, Meta Pixel, and other trackers do not fire until consent is granted via OneTrust or your CMP. Validate that server side GTM honors consent state for all destinations.

Use OIDC federation for cloud deploys so CI does not store long lived keys, and restrict roles by environment. Add automated checks that ensure staging and prod credentials are not mixed.

Enable Snyk, Dependabot security updates, or Trivy on container images and set SLAs for high severity fixes on payment and auth paths. Fail builds that introduce critical CVEs in runtime images.

Configure Cloudflare or Fastly to rate limit add to cart and login endpoints, add reCAPTCHA or Turnstile where abuse is observed, and test flows to avoid blocking legitimate buyers. Monitor false positives.

Set Lighthouse CI budgets for LCP, INP, and CLS on PDP and checkout, and block regressions over agreed thresholds. Add WebPageTest runs on a mobile profile to catch real network constraints.

Use Cloudinary or imgix with AVIF or WebP formats and responsive srcset for product galleries, and enforce lazy loading below the fold. Validate fallbacks for Safari and older Android devices.

Assert CDN cache keys include currency and locale, and that Vary headers are set to avoid serving the wrong prices. Use stale while revalidate for PDP to absorb flash sale traffic without stale carts.

Test Product, Offer, BreadcrumbList, and Review schema for correct availability, priceCurrency, and priceValidUntil during promos. Validate with Google Rich Results Test in CI to prevent SEO regressions.

Add tests for localized price formatting, decimal separators, and rounding rules for tax inclusive markets, and verify hreflang and canonical tags across locales. Catch currency conversion errors early.

Run axe core and pa11y on cart and checkout to validate focus order, keyboard navigation, labels, and color contrast in promo banners and timers. Fixes here directly improve conversion and legal compliance.

Gate payments, search, and promotion engines behind LaunchDarkly, GrowthBook, or Optimizely, and default to safe behavior when off. Require a documented rollback and percentage based rollout plan in the PR.

Design migrations that can run online, add columns before reads, and avoid destructive changes until new code is live. Test coupon and promotion rule migrations with real snapshots to prevent null pricing.

Attach release versions to Sentry and Datadog, alert on checkout error rate, payment declines due to integration issues, and increases in 5xx on cart. Add dashboards for Web Vitals by template.

Use blue green or weighted routing to canary a small slice of traffic, then run Playwright smoke tests on PDP, cart, and checkout. Auto rollback if error budgets or conversion KPIs regress.

Unit test dataLayer pushes for GA4, ensure server side GTM dedupes events with client side via event name and ID, and verify purchase values and currency codes match transaction records. Block PRs that alter schemas without mapping updates.

Verify Shopify, Magento, or BigCommerce app versions, webhook schemas, and idempotency keys for fulfillment and refund handlers. Add retries with exponential backoff and tests for duplicate webhook delivery.