| name | defra-standards |
| description | Defra software development standards for the MMO FES Azure Functions (Node.js) app. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, or licensing on a Defra service. |
| license | OGL-UK-3.0 |
| metadata | {"author":"mmo-fes","version":"1.0"} |
Defra Standards
Canonical Defra guardrails for this service. The Defra software development standards repository is the single source of truth — this skill summarises the rules Copilot must apply and links back to them.
This is a serverless Azure Functions (Node.js) app: timer- and HTTP-triggered functions with retry/backoff, MongoDB reconciliation, and Application Insights telemetry. Apply the rules below to that context.
Non-negotiable rules
- Security: Follow OWASP Secure Coding Practices. Load secrets and connection strings from environment/App Settings (or Key Vault) only — never hard-code or commit them, and never commit a populated
local.settings.json. Validate and sanitise all input. Use parameterised queries. Never use eval or dynamic Function() on user data.
- PII: Never log or expose PII — names, addresses, emails, phone numbers, NI numbers, bank details, usernames, passwords, API keys, tokens. This includes Application Insights telemetry and custom events.
- Logging: Structured logging with correlation propagated through Application Insights (operation/invocation ID). Levels:
error, warn, info, debug.
- Serverless design: Design triggers to be idempotent and safe to retry. Implement retry/backoff for transient failures, check
IsPastDue on timer triggers, and fail cleanly without leaking internals.
- Testing & coverage: Tests alongside code (Jest). Coverage ≥90% branches, functions, lines, and statements; ≥95% core business logic; 100% error-handling and security-critical paths. Never drop below the baseline. Test behaviour, not implementation. Mock external dependencies (MongoDB, HTTP/Axios, timers).
- Quality gates: All tests green (
npm test / npm run test:ci), coverage thresholds met, SonarQube/SonarCloud quality gate passes (no new bugs/vulnerabilities/code smells, hotspots resolved), no duplicated code.
- Version control: Branch
<type>/<brief-description>; Conventional Commits (feat:, fix:, docs:, test:, refactor:, chore:); main always shippable.
- Dependencies: Widely used, actively maintained, compatible with current Node.js LTS. Prefer native APIs and existing shared libraries over new dependencies.
- Licence: Publish under the Open Government Licence v3.0 unless an approved exception exists.
- MCP: Only use Defra-approved MCP servers.
References
