|
1 | 1 | --- |
2 | 2 | description: "Improve code quality, apply security best practices, and enhance design whilst maintaining green tests and GitHub issue compliance." |
3 | 3 | name: "TDD Refactor Phase - Improve Quality & Security" |
4 | | -tools: ["github", "findTestFiles", "edit/editFiles", "runTests", "runCommands", "codebase", "filesystem", "search", "problems", "testFailure", "terminalLastCommand"] |
| 4 | +tools: ["github/*", "search/fileSearch", "edit/editFiles", "execute/runTests", "execute/runInTerminal", "execute/getTerminalOutput", "execute/testFailure", "read/readFile", "read/terminalLastCommand", "read/terminalSelection", "read/problems", "search/codebase"] |
5 | 5 | --- |
6 | 6 |
|
7 | 7 | # TDD Refactor Phase - Improve Quality & Security |
@@ -39,24 +39,24 @@ Clean up code, apply security best practices, and enhance design whilst keeping |
39 | 39 | - **Authentication/Authorisation** - Implement proper access controls if specified in issue |
40 | 40 | - **Data protection** - Encrypt sensitive data, use secure connection strings |
41 | 41 | - **Error handling** - Avoid information disclosure through exception details |
42 | | -- **Dependency scanning** - Check for vulnerable NuGet packages |
43 | | -- **Secrets management** - Use Azure Key Vault or user secrets, never hard-code credentials |
| 42 | +- **Dependency scanning** - Check for vulnerable packages (`npm audit`, `pip audit`, `dotnet list package --vulnerable`, etc.) |
| 43 | +- **Secrets management** - Use environment variables or a secrets manager; never hard-code credentials |
44 | 44 | - **OWASP compliance** - Address security concerns mentioned in issue or related security tickets |
45 | 45 |
|
46 | 46 | ### Design Excellence |
47 | 47 |
|
48 | 48 | - **Design patterns** - Apply appropriate patterns (Repository, Factory, Strategy, etc.) |
49 | | -- **Dependency injection** - Use DI container for loose coupling |
50 | | -- **Configuration management** - Externalise settings using IOptions pattern |
51 | | -- **Logging and monitoring** - Add structured logging with Serilog for issue troubleshooting |
52 | | -- **Performance optimisation** - Use async/await, efficient collections, caching |
| 49 | +- **Dependency injection** - Use DI container or constructor injection for loose coupling |
| 50 | +- **Configuration management** - Externalise settings using environment variables or config files |
| 51 | +- **Logging and monitoring** - Add structured logging appropriate to your stack for issue troubleshooting |
| 52 | +- **Performance optimisation** - Use async/await or equivalent concurrency primitives, efficient collections, caching |
53 | 53 |
|
54 | | -### C# Best Practices |
| 54 | +### Language Best Practices (Polyglot) |
55 | 55 |
|
56 | | -- **Nullable reference types** - Enable and properly configure nullability |
57 | | -- **Modern C# features** - Use pattern matching, switch expressions, records |
58 | | -- **Memory efficiency** - Consider Span<T>, Memory<T> for performance-critical code |
59 | | -- **Exception handling** - Use specific exception types, avoid catching Exception |
| 56 | +- **Null safety** - Enable strict null checks (TypeScript), nullable reference types (C#), or Optional types (Java/Kotlin) |
| 57 | +- **Modern language features** - Use pattern matching, destructuring, and idiomatic constructs for your language |
| 58 | +- **Memory & performance** - Apply language-specific optimisations only when profiling reveals a bottleneck |
| 59 | +- **Error handling** - Use specific error/exception types; avoid swallowing errors silently |
60 | 60 |
|
61 | 61 | ## Security Checklist |
62 | 62 |
|
|
0 commit comments