Skip to content

Release Checklist

Purpose

Concrete steps to run through before merging to main - since a merge is a production deploy, with no staging tier to catch anything first.

Before opening/merging the PR

  • [ ] npm install --no-audit --no-fund runs clean
  • [ ] npm run check:portal-styles-drift passes (run npm run sync:portal-styles first if it doesn't, and commit the result)
  • [ ] npm run build succeeds for all 7 apps
  • [ ] npx tsc -p workers/api/tsconfig.json has no type errors
  • [ ] npm test passes
  • [ ] If the change touches workers/api/migrations/: migration is additive (new table/column/index), not destructive - see Cloudflare → D1 for why this matters (no automated backup, no staging tier)
  • [ ] If the change touches an app's wrangler.jsonc bindings/routes: confirmed against Architecture → Data Platform that the binding change is intentional
  • [ ] If the change touches workers/api/src/index.ts CORS/ALLOWED_ORIGINS: confirmed the origin list still matches the apps that actually need it (see Infrastructure → Security - note Investors is intentionally excluded while it remains out of scope / inactive)
  • [ ] Ran locally end-to-end (see Local) for at least the app(s) directly touched

PR review

  • [ ] CI (validate) green on the PR
  • [ ] Reviewer has read the diff for anything matching password|secret|token|api_key|account_id|private_key (should be none - see Infrastructure → Security)

After merge (automatic deploy)

  • [ ] Watch the deploy-production run in the Actions tab
  • [ ] If it fails partway, see Operations → Rollback before merging anything else (the akshaya-production concurrency group will queue further deploys behind a stuck one)
  • [ ] On success, confirm the smoke test step passed (7/7) - or run npm run smoke:production yourself if using Path 2
  • [ ] Spot-check the specific app/route the change targeted, not just the smoke test's generic health checks