Production Release Checklist

Use this checklist before every production deployment.

Code

Working tree is clean.
Latest commit is the intended release commit.
npm ci succeeds from a clean install.
Legacy tutorial redirects point to /en/support/tutorial.
npm run typecheck passes.
npm run build passes.
npm run payload:migrate:status shows all migrations as Yes on the release database.
payload_migrations has no batch = -1 dev marker before exporting/importing the database.
Admin login shows a verification code, invalid captcha fails before password validation, and /admin redirects to /admin/login when logged out.
Legacy tutorial redirects are present in CMS Redirects, not in next.config.mjs.
No new user-facing fallback copy was introduced without a CMS field.

NEXT_PUBLIC_SITE_URL is the final public domain.
PAYLOAD_SECRET is set and is not change-me or the example value.
DATABASE_URI points to the production PostgreSQL database.
PAYLOAD_DB_PUSH=false is set.
PAYLOAD_RUN_MIGRATIONS_ON_START=false is set unless a one-off controlled migration boot is intentionally planned.
Upload directories media/ and files/ are persistent and backed up.
Database dump and upload archive are generated from the same local release window.

Run:

npm run smoke -- "$NEXT_PUBLIC_SITE_URL"

Required manual spot checks:

Keep old production database and upload volume snapshots until the new release has passed smoke checks and editorial QA.
If schema push or migration prompts appear during app startup, stop. Production startup should not be running schema push or migrations.
If media thumbnails are missing, verify the upload volume before changing CMS records.