Testing policy

To avoid potential security incidents, Vihanti requires testing of its software to ensure that it functions as expected.

Scope

This policy applies to code developed by Vihanti for its clients or run on its production servers.

Code changes

Changes to production code which alter Vihanti’s product functionality should be tested by Vihanti’s continuous integration (CI) system prior to being merged. Testing should not be conducted locally in a development environment or in production.

Exceptionally, changes to production code may be merged without first testing them, such as to resolve an incident. See the Change management policy.

Changes to production code which do not alter product functionality, e.g., changes to documentation, may be but do not need to be tested.

Client releases

When a new version is built, it should be tested prior to being released. This includes testing major product features on supported platforms.

Infrastructure changes

Changes to Vihanti’s production infrastructure should be tested where possible.

Where possible, infrastructure should be implemented ‘as code’, so that it can be reviewed, approved, and tested as other code changes are.