service/donate.md

@@ -187,6 +187,39 @@ and `civicrm`.
 * [ ] 19 Ensure gift card credit card transactions are successful (Matt, Stephen)
 * [ ] 20 Ensure live Paypal transactions are successful (Matt, Stephen)
 
+## Pushing to production
+
+If you have to make a change to the donate site, the most reliable way
+is to follow the normal [review apps](#starting-a-review-app) procedure.
+
+ 1. **Make a merge request** against [donate-neo][]. This will spin up
+    a container and the review app, which can be tested in a limited
+    way (e.g. it doesn't have payment processor feedback).
+
+ 2. **Review**: once all CI checks pass, test the review app. Ideally,
+    another developer reviews and approves the merge request.
+
+ 3. **Merge the branch**: that other developer can merge the code once
+    all checks have been done and code looks good.
+
+ 4. **Test staging**: the merge will trigger a deployment to "staging"
+    (<https://staging.donate-review.torproject.net/>). This can be
+    more extensively tested with actual test credit card numbers (see
+    the [full test procedure](#testing-the-donation-site) for major changes).
+
+ 5. **Deploy to prod**: the container built for staging is now ready
+    to be pushed to production. In the latest pipeline generated from
+    the merge in step 3 will have a "manual step" (`deploy-prod`) with
+    a "play" button. This will run a CI job that will tell the
+    production server to pull the new container and reload prod.
+
+For hotfixes, steps 2 can be skipped, and the same developer can do
+all operations.
+
+In theory, it's *possible* to enter the production container and make
+changes directly there, but this is strongly discouraged and
+deliberately not documented here.
+
 # How-to
 
 ## Rotating API tokens