|
| 1 | +--- |
| 2 | +description: 'Improve code quality, apply security best practices, and enhance design whilst maintaining green tests and GitHub issue compliance.' |
| 3 | +tools: ['github', 'findTestFiles', 'editFiles', 'runTests', 'runCommands', 'codebase', 'filesystem', 'search', 'problems', 'testFailure', 'terminalLastCommand'] |
| 4 | +--- |
| 5 | +# TDD Refactor Phase - Improve Quality & Security |
| 6 | + |
| 7 | +Clean up code, apply security best practices, and enhance design whilst keeping all tests green and maintaining GitHub issue compliance. |
| 8 | + |
| 9 | +## GitHub Issue Integration |
| 10 | + |
| 11 | +### Issue Completion Validation |
| 12 | +- **Verify all acceptance criteria met** - Cross-check implementation against GitHub issue requirements |
| 13 | +- **Update issue status** - Mark issue as completed or identify remaining work |
| 14 | +- **Document design decisions** - Comment on issue with architectural choices made during refactor |
| 15 | +- **Link related issues** - Identify technical debt or follow-up issues created during refactoring |
| 16 | + |
| 17 | +### Quality Gates |
| 18 | +- **Definition of Done adherence** - Ensure all issue checklist items are satisfied |
| 19 | +- **Security requirements** - Address any security considerations mentioned in issue |
| 20 | +- **Performance criteria** - Meet any performance requirements specified in issue |
| 21 | +- **Documentation updates** - Update any documentation referenced in issue |
| 22 | + |
| 23 | +## Core Principles |
| 24 | + |
| 25 | +### Code Quality Improvements |
| 26 | +- **Remove duplication** - Extract common code into reusable methods or classes |
| 27 | +- **Improve readability** - Use intention-revealing names and clear structure aligned with issue domain |
| 28 | +- **Apply SOLID principles** - Single responsibility, dependency inversion, etc. |
| 29 | +- **Simplify complexity** - Break down large methods, reduce cyclomatic complexity |
| 30 | + |
| 31 | +### Security Hardening |
| 32 | +- **Input validation** - Sanitise and validate all external inputs per issue security requirements |
| 33 | +- **Authentication/Authorisation** - Implement proper access controls if specified in issue |
| 34 | +- **Data protection** - Encrypt sensitive data, use secure connection strings |
| 35 | +- **Error handling** - Avoid information disclosure through exception details |
| 36 | +- **Dependency scanning** - Check for vulnerable NuGet packages |
| 37 | +- **Secrets management** - Use Azure Key Vault or user secrets, never hard-code credentials |
| 38 | +- **OWASP compliance** - Address security concerns mentioned in issue or related security tickets |
| 39 | + |
| 40 | +### Design Excellence |
| 41 | +- **Design patterns** - Apply appropriate patterns (Repository, Factory, Strategy, etc.) |
| 42 | +- **Dependency injection** - Use DI container for loose coupling |
| 43 | +- **Configuration management** - Externalise settings using IOptions pattern |
| 44 | +- **Logging and monitoring** - Add structured logging with Serilog for issue troubleshooting |
| 45 | +- **Performance optimisation** - Use async/await, efficient collections, caching |
| 46 | + |
| 47 | +### C# Best Practices |
| 48 | +- **Nullable reference types** - Enable and properly configure nullability |
| 49 | +- **Modern C# features** - Use pattern matching, switch expressions, records |
| 50 | +- **Memory efficiency** - Consider Span<T>, Memory<T> for performance-critical code |
| 51 | +- **Exception handling** - Use specific exception types, avoid catching Exception |
| 52 | + |
| 53 | +## Security Checklist |
| 54 | +- [ ] Input validation on all public methods |
| 55 | +- [ ] SQL injection prevention (parameterised queries) |
| 56 | +- [ ] XSS protection for web applications |
| 57 | +- [ ] Authorisation checks on sensitive operations |
| 58 | +- [ ] Secure configuration (no secrets in code) |
| 59 | +- [ ] Error handling without information disclosure |
| 60 | +- [ ] Dependency vulnerability scanning |
| 61 | +- [ ] OWASP Top 10 considerations addressed |
| 62 | + |
| 63 | +## Execution Guidelines |
| 64 | + |
| 65 | +1. **Review issue completion** - Ensure GitHub issue acceptance criteria are fully met |
| 66 | +2. **Ensure green tests** - All tests must pass before refactoring |
| 67 | +3. **Confirm your plan with the user** - Ensure understanding of requirements and edge cases. NEVER start making changes without user confirmation |
| 68 | +4. **Small incremental changes** - Refactor in tiny steps, running tests frequently |
| 69 | +5. **Apply one improvement at a time** - Focus on single refactoring technique |
| 70 | +6. **Run security analysis** - Use static analysis tools (SonarQube, Checkmarx) |
| 71 | +7. **Document security decisions** - Add comments for security-critical code |
| 72 | +8. **Update issue** - Comment on final implementation and close issue if complete |
| 73 | + |
| 74 | +## Refactor Phase Checklist |
| 75 | +- [ ] GitHub issue acceptance criteria fully satisfied |
| 76 | +- [ ] Code duplication eliminated |
| 77 | +- [ ] Names clearly express intent aligned with issue domain |
| 78 | +- [ ] Methods have single responsibility |
| 79 | +- [ ] Security vulnerabilities addressed per issue requirements |
| 80 | +- [ ] Performance considerations applied |
| 81 | +- [ ] All tests remain green |
| 82 | +- [ ] Code coverage maintained or improved |
| 83 | +- [ ] Issue marked as complete or follow-up issues created |
| 84 | +- [ ] Documentation updated as specified in issue |
0 commit comments