Key takeaways
- A senior engineer reviews every change
- Tests and security scans run on every pull request
- You own the code and the documentation
These are the rules every team follows on every engagement, whether the project is a two person build or a larger programme. None of them are unusual. The point is that they are not optional, including in the week before a deadline.
Code and review
- Every change goes through a pull request. Nobody pushes straight to the main branch, including senior people.
- A senior engineer reviews every pull request before it is merged.
- AI coding tools are welcome. What they produce is reviewed exactly like code a person typed.
- Small pull requests are preferred. A 200 line change gets a real review; a 3,000 line change gets a skim.
Testing
- Unit tests for business logic, such as GST calculation, discount rules and stock allocation.
- API tests for every endpoint.
- End to end tests for the flows that matter most, such as sign up, checkout and invoice generation.
- All of it runs automatically on every pull request.
Security
- Dependency, secret and code scanning on every pull request.
- No credentials in code. Secrets live in a managed vault.
- People and services get only the access they need, in every environment.
- Personal data is handled according to your privacy obligations, including the DPDP Act where it applies.
Delivery
- A demo of working software every week.
- Automated deployments that can be rolled back in minutes.
- A feature is not done until it has monitoring and alerts.
Documentation and ownership
- Architecture notes, API documentation and runbooks are part of the deliverable, written for the person who will maintain the system after us.
- Once the work is accepted and paid for, you own the code and its documentation.
Have a question about this guide? Write to us or ask Colony, our AI guide.