Formaos Deploy

Pre-Deploy Checklist

# 1. Code quality (run in parallel)
npm run lint              # ESLint — must pass
npm run type-check        # TypeScript — zero errors

# 2. Tests
npm run test              # Unit tests — must pass
npm run qa:smoke          # Smoke E2E — must pass

# 3. Build
npm run build             # Next.js build — must succeed

# 4. Full QA (for major releases)
npm run qa:full           # All test suites
npm run test:compliance:all  # Compliance checks
npm run test:security     # Security baseline

CI/CD Pipelines

Environment Variables (Critical)

Workflow

Standard Deploy

1. Ensure all CI checks pass on PR
2. Merge to main → Vercel auto-deploys
3. Monitor Sentry for new errors post-deploy
4. Check health endpoint: /api/health

Database Migration Deploy

1. Write migration in supabase/migrations/
2. Test migration locally
3. Apply to staging Supabase instance
4. Verify RLS policies work
5. Apply to production
6. Deploy application code that depends on new schema

Mobile App Release

1. Follow mobile/ build scripts
2. Use Capacitor for iOS + Android builds
3. Follow App Store / Play Store submission guides
4. Update capacitor.config.json version

Production Incident Response

1. Check Sentry for error details and stack trace
2. Check Vercel function logs for timeouts/crashes
3. Check Upstash Redis dashboard for rate limiting issues
4. Check Supabase dashboard for database issues
5. Check Trigger.dev dashboard for background job failures
6. Roll back via Vercel instant rollback if needed

Cron Jobs

Rules

• Vercel deploys automatically on merge to main — ensure CI passes first
• Stripe keys are LIVE production — never test with prod checkout
• Database migrations are irreversible once deployed — test thoroughly
• Follow RELEASE_DISCIPLINE_CHECKLIST.md for major releases
• Monitor Sentry after every deploy — catch regressions early
• Health check (/api/health) must return 200 post-deploy
• Function timeouts: billing/auth = 60s, default = 30s (in vercel.json)
• Never commit .env.local — it contains production secrets
• Background jobs (Trigger.dev) — verify webhook delivery after deploy
• Mobile releases require separate App Store / Play Store review cycles
• Rollback via Vercel if critical errors detected — don't debug in production