defra-standards

name	defra-standards
description	Defra software development standards for MMO FES Node.js/TypeScript services. Use when writing, reviewing, or refactoring code, or when checking compliance, security, logging, testing, containers, or licensing on a Defra service.
license	OGL-UK-3.0
metadata	{"author":"mmo-fes","version":"1.0"}

Defra Standards

Canonical Defra guardrails for this service. The Defra software development standards repository is the single source of truth — this skill summarises the rules Copilot must apply and links back to them.

Non-negotiable rules

• Security: Follow OWASP Secure Coding Practices. Load secrets from environment/config only — never hard-code or commit them. Validate and sanitise all input. Use parameterised queries. Never use eval or dynamic Function() on user data.
• PII: Never log or expose PII — names, addresses, emails, phone numbers, NI numbers, bank details, usernames, passwords, API keys, tokens.
• Logging: Structured JSON logging with correlation IDs. Levels: error, warn, info, debug.
• Testing & coverage: Tests alongside code. Tiered coverage — ≥90% global, ≥95% core business logic, 100% error-handling and security-critical paths. Never drop below the baseline. Test behaviour, not implementation. Mock external dependencies.
• Quality gates: Lint clean, all tests green, SonarQube/SonarCloud quality gate passes (no new bugs/vulnerabilities/code smells, hotspots resolved), no duplicated code.
• Version control: Branch <type>/<brief-description>; Conventional Commits (feat:, fix:, docs:, test:, refactor:, chore:); main always shippable.
• Containers: Defra base images (defradigital/node, defradigital/node-development); run as non-root; multi-stage builds; no secrets in images.
• Dependencies: Widely used, actively maintained, compatible with current Node.js LTS. Prefer native APIs and existing shared libraries over new dependencies.
• Licence: Publish under the Open Government Licence v3.0 unless an approved exception exists.
• MCP: Only use Defra-approved MCP servers.
• Tech stack: These MMO FES services use TypeScript (an approved exception to the default vanilla-JavaScript standard). Keep strict typing.

References

• Defra software development standards
• Defra common coding standards
• Defra Node.js standards
• Defra JavaScript standards
• Defra logging standards
• Defra security standards
• Defra container standards
• Defra quality assurance standards
• GOV.UK Service Standard
• Technology Code of Practice
• OWASP Secure Coding Practices
• 12-factor app methodology
• Defra approved MCP servers