Code Review & Testing Checklist for Web Development

Use @typescript-eslint with type-aware rules, eslint-plugin-import, and domain rules like no-floating-promises and no-explicit-any. Fail locally on warnings to prevent code review noise and keep diffs focused on logic.

Wire Prettier via lint-staged to auto-format only changed files and avoid style debates in PRs. Configure a single Prettier config across frontend and backend so formatting does not break blame and code owners can focus on substance.

Run tsc --noEmit in CI and locally with strict checks such as noImplicitAny, strictNullChecks, and exactOptionalPropertyTypes. Catching type drift early prevents runtime bugs and stabilizes contracts between layers.

Add git-secrets, gitleaks, or truffleHog to Husky pre-commit to stop credentials or tokens from ever leaving developer machines. Include entropy and allowlist rules to reduce false positives without weakening guardrails.

Run ts-prune or knip to remove unused exports and files, and use madge to flag circular deps that complicate bundling and SSR. Removing cruft improves test coverage ratios and reduces cognitive load during reviews.

Use stylelint with stylelint-config-standard and your design system rules to prevent !important, disallowed colors, or spacing violations. Consistent styling reduces UI regressions and eases cross-team collaboration.

Pin Node with .nvmrc or Volta and enforce npm ci or pnpm install --frozen-lockfile. A stable toolchain eliminates works on my machine failures and ensures tests and builds behave the same everywhere.

Require passing CI, code quality, and security checks before merge, and mandate at least one code owner approval for sensitive areas. This prevents accidental bypass of critical gates during crunch time.

Configure GitHub Actions or GitLab CI to test Node 18 and 20 and run Playwright against Chromium, Firefox, and WebKit. Cross-environment runs surface compatibility issues before they hit users.

Use actions/cache keyed by lockfile hash and cache pnpm store or npm cache directories. Include fallbacks and avoid caching dist artifacts that vary by environment to prevent heisenbugs.

Use nyc or c8 to generate coverage, and Codecov or Coveralls to enforce patch thresholds on changed lines and files. Diff-aware gating improves tests where they matter without blocking unrelated areas.

Scan for code smells, taint flows, and security hotspots using CodeQL for GitHub or SonarCloud for multi-repo views. Blocking high severity findings in PRs avoids costly remediation after release.

Wire npm audit, pnpm audit, or Snyk in CI and fail on high severity issues with clear upgrade paths. Maintain an allowlist process for known false positives to keep the signal clean.

Use DangerJS to flag oversized PRs, missing test files, and un-updated docs, and enforce Conventional Commits with commitlint. Automating review etiquette increases reviewer focus and throughput.

Prefer changes under a few hundred lines, grouped by concern, and include a concise checklist in the description. Small diffs reduce review latency and make it easier to request targeted tests.

Review OpenAPI version bumps, ensure schema evolution is backward compatible, and add zod or io-ts validation at the boundaries. Contract tests with Pact should fail if consumers would break.

Verify secure cookie flags, CSRF protections, and access control enforcement on the server. Check JWT lifetimes, refresh flows, and that sensitive routes never rely on client-side checks.

Ensure forward-only, idempotent migrations, and concurrent index creation for Postgres. Check query plans for potential full table scans and verify safe rollbacks or feature flag gating.

Confirm defensive error boundaries in the UI, structured logs with pino or winston, and OpenTelemetry traces across services. Review that external API errors are handled and surfaced with actionable context.

Verify ARIA attributes, keyboard navigation, focus order, and visible labels for new components. For string changes, ensure messages are externalized with i18n libraries and keys are stable.

New logic behind feature flags should default to off and degrade gracefully when the flag service is unavailable. Include a kill switch and ensure flags are targeted and time boxed.

Focus on pure functions and critical utilities using Arrange-Act-Assert and fast isolated runs. Use fake timers and deterministic seeds to avoid flaky tests and enforce per-module coverage targets.

Exercise behavior rather than implementation details and avoid shallow rendering that hides lifecycles. Include basic a11y assertions with jest-axe to catch regressions early.

Replace brittle hand-written fetch mocks with MSW so tests hit the same contract as production. Cover success, failure, and timeout cases to harden error handling paths.

Maintain a small smoke suite that runs on every PR and a broader nightly suite that covers complex paths. Record videos and traces to accelerate triage when failures occur.

Use Percy, Chromatic, or Playwright snapshots to track pixel changes and tune thresholds to reduce noise from anti-aliasing. Gate only high risk surfaces to keep build times in check.

Publish consumer contracts and validate providers in CI to catch breaking changes before deployment. Require providers to version endpoints or add compatibility shims when contracts evolve.

Use Lighthouse CI for LCP, CLS, and TBT budgets and k6 or Artillery for API throughput and latency. Fail PRs that push metrics over thresholds on representative test pages.

Enable retries and flake detection in Cypress or Playwright and auto-label flaky tests to avoid blocking merges while an investigation is opened. Track flake rate and enforce a budget to prevent decay.

Use Conventional Commits with semantic-release or Changesets to cut versions, publish artifacts, and generate accurate release notes. Consistent versioning improves rollback safety and consumer confidence.

Deploy to a small percentage or a canary environment and run Playwright smoke tests plus API health checks. Promote only after canary is stable to reduce blast radius for defects.

Integrate Sentry or New Relic to track errors by release and environment and create alert policies for high impact issues. Include sourcemaps and commit hashes to speed up root cause analysis.

Run Lighthouse CI against canary or production URLs and compare against stored budgets. Fail promotions or auto-rollback if key Web Vitals regress beyond agreed thresholds.

Use Trivy or Grype in CI to scan images and Syft to publish SBOMs for compliance and incident response. Block releases on critical CVEs and track remediation SLAs.

Practice rollbacks with blue-green or rolling strategies and ensure database backups and down migrations are tested. Pair rollbacks with feature flag kill switches for immediate mitigation.

Update README, ADRs, Storybook, and Typedoc, and publish OpenAPI docs to your developer portal after merges. Link documentation updates in PRs to keep users and teammates aligned.