| name | defra-standards |
| description | Defra software development standards for MMO FES Node.js/TypeScript services. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, containers, or licensing on a Defra service. |
| license | OGL-UK-3.0 |
| metadata | {"author":"mmo-fes","version":"1.0"} |
Defra Standards
Canonical Defra guardrails for this service. The Defra software development standards repository is the single source of truth — this skill summarises the rules Copilot must apply and links back to them.
Non-negotiable rules
- Security: Follow OWASP Secure Coding Practices. Load secrets from environment/config only — never hard-code or commit them. Validate and sanitise all input. Use parameterised queries. Never use
eval or dynamic Function() on user data.
- PII: Never log or expose PII — names, addresses, emails, phone numbers, NI numbers, bank details, usernames, passwords, API keys, tokens.
- Logging: Structured JSON logging with correlation IDs. Levels:
error, warn, info, debug.
- Testing & coverage: Tests alongside code. Tiered coverage — ≥90% global, ≥95% core business logic, 100% error-handling and security-critical paths. Never drop below the baseline. Test behaviour, not implementation. Mock external dependencies.
- Quality gates: Lint clean, all tests green, SonarQube/SonarCloud quality gate passes (no new bugs/vulnerabilities/code smells, hotspots resolved), no duplicated code.
- Version control: Branch
<type>/<brief-description>; Conventional Commits (feat:, fix:, docs:, test:, refactor:, chore:); main always shippable.
- Containers: Defra base images (
defradigital/node, defradigital/node-development); run as non-root; multi-stage builds; no secrets in images.
- Dependencies: Widely used, actively maintained, compatible with current Node.js LTS. Prefer native APIs and existing shared libraries over new dependencies.
- Licence: Publish under the Open Government Licence v3.0 unless an approved exception exists.
- MCP: Only use Defra-approved MCP servers.
- Tech stack: These MMO FES services use TypeScript (an approved exception to the default vanilla-JavaScript standard). Keep strict typing.
References
