defra-standards

name	defra-standards
description	Defra software development standards for the MMO FES Azure Functions (Node.js) app. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, or licensing on a Defra service.
license	OGL-UK-3.0
metadata	{"author":"mmo-fes","version":"1.0"}

Defra Standards

Canonical Defra guardrails for this service. The Defra software development standards repository is the single source of truth — this skill summarises the rules Copilot must apply and links back to them.

This is a serverless Azure Functions (Node.js) app: timer- and HTTP-triggered functions with retry/backoff, MongoDB reconciliation, and Application Insights telemetry. Apply the rules below to that context.

Non-negotiable rules

• Security: Follow OWASP Secure Coding Practices. Load secrets and connection strings from environment/App Settings (or Key Vault) only — never hard-code or commit them, and never commit a populated local.settings.json. Validate and sanitise all input. Use parameterised queries. Never use eval or dynamic Function() on user data.
• PII: Never log or expose PII — names, addresses, emails, phone numbers, NI numbers, bank details, usernames, passwords, API keys, tokens. This includes Application Insights telemetry and custom events.
• Logging: Structured logging with correlation propagated through Application Insights (operation/invocation ID). Levels: error, warn, info, debug.
• Serverless design: Design triggers to be idempotent and safe to retry. Implement retry/backoff for transient failures, check IsPastDue on timer triggers, and fail cleanly without leaking internals.
• Testing & coverage: Tests alongside code (Jest). Coverage ≥90% branches, functions, lines, and statements; ≥95% core business logic; 100% error-handling and security-critical paths. Never drop below the baseline. Test behaviour, not implementation. Mock external dependencies (MongoDB, HTTP/Axios, timers).
• Quality gates: All tests green (npm test / npm run test:ci), coverage thresholds met, SonarQube/SonarCloud quality gate passes (no new bugs/vulnerabilities/code smells, hotspots resolved), no duplicated code.
• Version control: Branch <type>/<brief-description>; Conventional Commits (feat:, fix:, docs:, test:, refactor:, chore:); main always shippable.
• Dependencies: Widely used, actively maintained, compatible with current Node.js LTS. Prefer native APIs and existing shared libraries over new dependencies.
• Licence: Publish under the Open Government Licence v3.0 unless an approved exception exists.
• MCP: Only use Defra-approved MCP servers.

References

• Defra software development standards
• Defra common coding standards
• Defra Node.js standards
• Defra JavaScript standards
• Defra logging standards
• Defra security standards
• Defra quality assurance standards
• GOV.UK Service Standard
• Technology Code of Practice
• OWASP Secure Coding Practices
• 12-factor app methodology
• Defra approved MCP servers