Change Management
Last updated: March 2026
This document describes HAIEC's software development lifecycle, deployment process, code review requirements, and rollback procedures.
1. Source Control
- Repository: Single GitHub repository for the entire platform.
- Workflow: Feature branch workflow. All changes go through pull requests.
- Branch naming: Feature branches named by purpose (e.g.,
feat/,fix/,security/). - Pre-commit hooks: Link checking script runs on staged files. Warns on broken internal links.
- Merge target: Changes merge to
mainbranch, which triggers production deployment.
2. CI/CD Pipeline
- Deployment platform: Vercel. Automatic deployment on merge to
main. - Build checks:
next buildenforces TypeScript strict mode compilation. CI workflows also runtsc --noEmit(non-blocking in some workflows). - Pre-commit: Link checker script (
scripts/check-links.ts). Runs in warning mode — does not block commits. - Post-deploy: Sentry release tracking. Error monitoring active immediately.
Honest gap: HAIEC does not currently have a staging environment. All merges deploy directly to production. A staging environment is on our roadmap. We mitigate this risk through TypeScript strict mode, pre-commit checks, and Vercel instant rollback.
3. Code Review
- PR-based review: At least one approver required before merge.
- Automated checks: TypeScript compilation, link checker, ESLint.
- Security review: No mandatory automated security review step yet. Security-sensitive changes (auth, API routes, database schema) are reviewed manually with security focus.
- Commit messages: Conventional commits with descriptive messages. Generated commits include co-author attribution.
4. Environment Separation
| Environment | Hosting | Database | Purpose |
|---|---|---|---|
| Production | Vercel (haiec.com) | Neon (production) | Live customer platform |
| Development | localhost:3000 | Neon (development branch) or local | Local development |
| Staging | Not yet available | Not yet available | Roadmap item |
Environment variables managed via Vercel dashboard (production) and .env.local (development). No secrets committed to repository.
5. Dependency Management
- Package manager: npm with
package.jsonandpackage-lock.json. - Version pinning: Versions pinned in lockfile. No floating ranges like
latestor*. - Vulnerability alerts: GitHub Dependabot alerts enabled. Alerts reviewed and acted upon.
- Update process: Manual dependency review. No automated update pipeline yet.
Honest gap: Dependency updates are reviewed manually. We do not have an automated dependency update pipeline (e.g., Renovate bot). This is a roadmap item.
6. Rollback Procedure
- Application rollback: Vercel instant rollback to previous deployment. Takes effect within seconds. No code changes required.
- Database migrations: Prisma Migrate (forward-only migrations). Schema changes are additive where possible.
- Schema rollback: No automated rollback for schema changes. Breaking migrations require manual intervention.
- Configuration rollback: Environment variables can be reverted via Vercel dashboard.