Technical review guidelines

During technical review, your code is examined to detect the presence of viruses, malware, and any indication of plagiarism. The process also ensures that the extension package meets Composer packaging and format requirements and Adobe Commerce coding standards. App packages must meet React packaging requirements instead of Composer.

Submission

The technical review begins as soon as you upload a package on the Developer Portal. It consists of two mandatory steps to generate the submission ID and trigger further testing:

Malware Scan — Ensures that uploaded packages do not contain viruses or malware software.
Package Verification — Checks that the uploaded file is a zip archive. For extensions, the file must contain a Composer package. Additionally, the review will check for incomplete development indicators in the form of FIXME or TODO style comments.

App package verification

App package submissions must be a zip file that contains the following files:

install.yaml
package.json

The package.json file specifies:

name
version

Extension package verification

Non-app package submissions must contain a module, theme, language pack, or metapackage that meets Composer packaging and format requirements:

Code submitted as a zip archive.
Submitted package does not exceed 30 MB.
Submitted package contains a composer.json file.
The composer.json file specifies:
- name
- type
- version
The composer.json does not declare:
- extra.map
- extra.magento-root-dir
The package has valid Composer package type:
- for extensions, valid types are: magento2-module, magento2-language, metapackage
- for themes, valid types is only magento2-theme
- for shared libraries, valid types are: magento2-module, magento2-theme, magento2-language
The package does not restict a set of compatible PHP versions declared by supported Magento versions.
The package does not declare any of the following packages as a dependency:
- magento/magento-composer-installer
- magento/magento2-base
- magento/product-community-edition
- magento/magento2-ee-base
- magento/product-enterprise-edition
The package does not use * as a version restriction for Magento packages (packages with magento vendor). You must specify version restriction according to the recommendations in the Magento PHP Developer Guide.
Require inline aliases are not used in the composer.json file.

Additional requirements for package declarations are applied based on the package type:

Magento modules (packages with type magento2-module) must have valid etc/module.xml and registration.php files. Configured autoloading in composer.json: autoload.files must include at least a registration.php file and the autoload.psr-4 section must declare at least one namespace.
Magento themes (package type magento2-theme) must have valid theme.xml and registration.php files. You must include the registration file in the autoload.files section of composer.json. Do not include an autoload.psr-4 declaration in a theme package.
Magento language packages (type magento2-language) must have valid language.xml and registration.php files. You must include the registration file in the autoload.files section of composer.json. Do not include an autoload.psr-4 declaration in a language package.
Packages of type metapackage must declare at least one dependency in the require section.

See also:

Extension validation and QA

After accepting a package for Technical Review, a series of automated checks and manual checks are scheduled.

Code Sniffer: Check code quality/syntax

The Marketplace coding standard review uses a custom set of coding sniffs. If the submitted code fails the review, Marketplace generates a technical report that describes each issue found and its location in the codebase.

More details: Code Sniffer

See also: Coding Standards

Copy Paste Detector: Check for plagiarism

All code and marketing content that is submitted to Commerce Marketplace is checked for plagiarism to ensure that it has not been copied from existing Marketplace extensions or from the Commerce codebase.

If the extension contains source code from the Open Source Edition, the extension must be licensed under Open Source License v. 3.0 and properly credit Adobe, Inc.

More details: Copy Paste Detector

Installation and Varnish tests: Verify that product installs and caching works correctly

Extensions for Commerce are installed with Varnish Cache enabled for each supported version of PHP and switched from development to production mode. If you have shared packages and dependencies required for your extension, the Installation test also tests Commerce installation and usage with those packages included.

In addition, cacheable pages are accessed to ensure that they are served directly from Varnish Cache. You will be notified if your extension fails the test.

More details: Installation and Varnish Tests

See also:

MFTF Commerce-supplied tests

Extensions are tested with the Magento Functional Testing Framework with a set of tests from the Commerce codebase. The tests are executed for each supported version of PHP.

More_details: MFTF Commerce-supplied Tests

MFTF Vendor-supplied tests

The MFTF will execute any MFTF tests that are included in the extension submission. The tests are executed for each supported version of PHP. The MFTF tests and associated code from the supported Commerce version are available to the vendor-supplied tests.

More_details: MFTF Vendor-supplied Tests

Quality Assurance: Pass manual QA

This check verifies that the extension installs without error, is configurable (as applicable), and operates as expected.

Manual QA can be skipped if the Semantic Version Check confirms that only patch-level changes were introduced in a new version of an already listed extension.

Documentation and resources

Marketplace uses the documentation provided with the extension during manual QA. The submitted documentation must comply with the following requirements:

Submit the user guide in one of the following formats:
- A PDF that describes the extension setup and features.
- A PDF containing a link to a wiki or a similar page that describes the extension setup and features.
Extension documentation must cover all features of the extension.
Extension documentation must not direct users to make purchases on sites other than Marketplace.

Manual QA checklist

To pass Manual QA, the extension must meet the following requirements:

Installs with Composer.
Compiles without errors using the following command: deploy:mode:set production
Extension has all supporting documentation that complies with the documentation requirements
Works with each version of Magento that the extension claims to support in the extension product profile.
- Basic Commerce functionality works as expected with the installed extension.
- Basic test suite includes, but is not limited to the following scenarios:
  - Create order as guest user (Simple product, Configurable product)
  - Create a new customer
  - Create order as (Simple product, Configurable product)
  - Place an order via "Check Out with Multiple Addresses"
  - Create re-order from previously created order
  - Add product to Wishlist
  - Add product to Comparison list
  - As store admin: Create Invoice, Shipping, Credit Memo
  - As store admin: Create new order (re-order)
  - As store admin: Create new product with images (Simple product, Configurable product)
  - As store admin: Create new product category
Works with each version of PHP that is supported by the Commerce version that the extension claims to support in the extension product profile.
Has all functionality that is described in the extension documentation and vice versa.
Does not crash with unhandled errors.
Does not hang when invalid data is submitted.

See also:

Additional checks for Page Builder extensions

Extensions that claim to support Magento Page Builder are subject to the following additional checks:

New and extended content types can be dragged to the stage, edited, duplicated, moved, hidden, saved and deleted from the stage without errors.
New and extended content types are rendered on the storefront without errors.
Extensions that use Page Builder must also support correct operation of all Page Builder content creation functions. This includes, but is not limited to, all the functions previously described for new and extended content types rendered in the Admin stage and the storefront.

Exit criteria for testing

At least one major issue found in Magento functionality which was affected by an installed extension.
Blocking issue found that affects entire extension functionality.
For big extensions, where functionality is not concentrated in one particular area we can switch to the unaffected area and continue to test it in order to provide more errors to the developer. At the same time, we can stop testing once we have found 2 blockers in separate areas of an extension.

Overview

Malware scan