Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Code comments standard #298

Open
wants to merge 17 commits into
base: main
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
339 changes: 339 additions & 0 deletions docs/standards/code-comments.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,339 @@
---
layout: standard
order: 1
title: Code Comments
date: 2023-10-18
id: SEGAS-TBC
tags:
- Documentation
- Ways of working
related:
sections:
- title: Related links
items:
- text: Minimal documentation set for a product
href: /standards/minimal-documentation-set-for-a-product/
---

These Code Commenting Guidelines are designed to ensure that code is documented at a minimum standard, making it easy for new engineers to quickly get up to speed and preventing the isolation of knowledge within the team. By following these guidelines, you help streamline the onboarding process for new team members, ensuring that code is accessible and understandable.

This standard promotes effective communication and knowledge sharing within the team, ultimately contributing to the overall success of the project.

---

## Requirement(s)

- [Comments MUST enhance code comprehension and maintainability.](#comments-must-enhance-code-comprehension-and-maintainability)
- [Comments MUST be explanatory, not merely descriptive, and use concise, fully-formed sentences.](#comments-must-be-explanatory-not-merely-descriptive-and-use-concise-fully-formed-sentences)
- [Comments MUST add value to the understanding and readability of the code.](#comments-must-add-value-to-the-understanding-and-readability-of-the-code)
- [Comments MUST adhere to a documented standard, such as Docblock, and include all necessary information.](#comments-must-adhere-to-a-documented-standard-such-as-docblock-and-include-all-necessary-information)
- [Comments MUST Remain Applicable After Code Refactor.](#comments-must-remain-applicable-after-code-refactor)
- [Comments MUST Use Neutral, Unopinionated Language.](#comments-must-use-neutral-unopinionated-language)
- [Comments MUST NOT be present in production deployments.](#comments-must-not-be-present-in-production-deployments)
- [Comments MUST NOT be used as a substitute for deleting code.](#comments-must-not-be-used-as-a-substitute-for-deleting-code)
- [Comments MUST NOT contain sensitive data, such as API keys, tokens, etc.](#comments-must-not-contain-sensitive-data-such-as-api-keys-tokens-etc)

### Comments MUST enhance code comprehension and maintainability.

The placement of comments is essential for code comprehensibility and maintainability. Comments should be thoughtfully positioned to explain complex logic, significant decision points, or any non-trivial functionality.

Positioning comments at the top of files, above structural elements, or before specific code sections assists both newcomers and existing team members in understanding the code's purpose. This fosters a collaborative environment, ensuring seamless knowledge transfer and facilitating effective contributions from colleagues to the project.

#### Positive Example
```
"""
Calculates the total price of items in the shopping cart by summing up individual item prices.

This function iterates through each item in the provided shopping cart, extracting the 'price'
attribute from each item, and aggregating these prices to compute the overall total.

:param cart: A list of items in the shopping cart. Each item should be an object or instance
with a 'price' attribute representing the cost of that particular item.
:return: The total price as a floating-point number, representing the sum of individual item prices.
"""
def calculate_total_price(cart):
total_price = 0.0
for item in cart:
total_price += item.price
return total_price
```

#### Negative Example
```
def calculate_total_price(cart):
# This function calculates the total price
total_price = 0.0
for item in cart:
total_price += item.price
return total_price
```

### Comments MUST be explanatory, not merely descriptive, and use concise, fully-formed sentences.

The use of language in your comments is essential for effective communication. Comments should serve the purpose of explaining the reasoning behind the code rather than solely describing its functionality. They should be clear, concise, and composed of fully-formed sentences.

This practice ensures that readers can grasp the code's intent without any ambiguity. Concise and explanatory comments contribute to enhanced code readability and easier maintenance.

Additionally, adhere to the DRY (Don't Repeat Yourself) principle. Avoid duplicating comments that describe similar logic in different parts of the code. Instead, use well-crafted comments in one location to cover shared concepts or functionalities. This not only reduces redundancy but also promotes consistency and helps prevent inconsistencies or contradictions in your documentation.

#### Positive Example
```
"""
Calculates the factorial of a given integer.


:param n: The non-negative integer for which to calculate the factorial.
:return: The factorial of the input integer.
"""
def calculate_factorial(n):
if n < 0:
return "Input must be a non-negative integer."
elif n == 0:
return 1
else:
factorial = 1
for i in range(1, n + 1):
factorial *= i
return factorial
```

#### Negative Example
```
"""
This function computes the factorial of an integer, n.

This function takes an integer, n, as input and calculates its factorial. The factorial is calculated for any non-negative integer, denoted as n!, which is found by multiplying all the positive integers less than or equal to n. If the input, n, is negative, an error message is returned. Otherwise, the factorial is calculated using a loop.

:param n: An input integer, which should be a non-negative integer.
:return: The output of the function is the factorial of the provided integer.
"""
def calculate_factorial(n):
if n < 0:
return "An error has occurred. The input should be a non-negative integer."
elif n == 0:
return 1
else:
factorial = 1
for i in range(1, n + 1):
factorial *= i
return factorial
```

### Comments MUST add value to the understanding and readability of the code.

Comments that provide value are essential for code documentation. Comments should not be added thoughtlessly but should genuinely enhance the codebase.

Each comment should contribute to the reader's understanding of the code by providing insights or explanations that might not be immediately evident from the code itself. Value-added comments act as a bridge between the code's functionality and the developer's comprehension, improving accessibility and efficiency for both current and future team members.

deanwhitehouseHO marked this conversation as resolved.
Show resolved Hide resolved
Additionally, consider that code functions should be written in a way that allows developers to use them effectively without having to delve into the source code. This means that function signatures, parameter names, and return types should be self-explanatory. Well-crafted comments can complement this by offering high-level explanations or usage examples, making it possible for developers to utilize functions blindly, confidently relying on the documented behavior without necessarily needing to inspect the implementation details.

#### Positive Example
```
"""
This function validates user passwords.

This function takes a password as input and checks if it meets security requirements, including minimum length, the presence of both uppercase and lowercase letters, and the use of special characters.

:param password: The user's input password.
:return: True if the password meets security requirements, False otherwise.
"""
def validate_password(password):
...
```

#### Negative Example
```
"""
This function validates user passwords.

:param password: The user's input password.
:return: True if the password is valid, False if it's not.
"""
def validate_password(password):
...
```

### Comments MUST adhere to a documented standard, such as Docblock, and include all necessary information.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't agree with this.

Sometimes these standards provide some value, but I don't think that all comments should have to comply. - Some of the most useful comments are one-liners that explain something that isn't immediately obvious from reading the code.

In fact I'd suggest that it is these sorts of standards that cause some developers to write the sort of useless comments that are complained about in the section above.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin It is important that a comment should adhere to a standard, if that standard allows one-liners that is fine, but there should be a standard agreed within the code base to ensure that all developers can interpret and write comments consistently

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If such a standard allows free-form comments like that, does it still have value? What would we be achieving by mandating this?

Does this fall into coding standards more generally? i.e. Use a linter / code formatter.


Adhering to a documented standard in your comments can assist in achieving consistency and comprehension. Following established standards, like Docblock, helps harmonize the commenting style across the codebase, simplifying navigation and comprehension for all team members.

Furthermore, comments should encompass all pertinent information, including parameter descriptions, return values, and function or class explanations. This practice ensures that any developer reviewing the code possesses all the necessary details to use, modify, or maintain it effectively, reducing the necessity for time-consuming back-and-forths or investigations.

When developing APIs, comments play a crucial role in generating API documentation automatically. Systems like Swagger, which rely on comments within the code, can extract valuable information and generate comprehensive API documentation. By consistently using Docblock or similar standards, developers contribute not only to the clarity of the code but also to the seamless generation of API documentation. This documentation becomes an invaluable resource for users and maintainers, facilitating easier integration and understanding of the API's capabilities.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I'm not sure that generating Swagger/OpenAPI in this way is actually a good thing. - I think it's safer to maintain your swagger specification separately from your code. That way you can test that your code meets the specification, and it is easier to detect whether you have made a change to the spec.

To put it another way, there is a risk that by generating Swagger from code (+ comments) that you change the contract without knowing, and that your subsequent tests provide a false positive.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin maybe the wording could be clearer, but we're not saying you must follow this standard, it is simply an informative section that this might be how the project is set-up and may be of benefit


### Swagger Information
- [Swagger](https://swagger.io/)

#### Docblock Information
deanwhitehouseHO marked this conversation as resolved.
Show resolved Hide resolved
- [Docblock - Wikipedia](https://en.wikipedia.org/wiki/Docblock)

##### Language Specific Links (for reference only)
- [JavaDoc](https://www.oracle.com/uk/technical-resources/articles/java/javadoc-tool.html)
- [JSDoc](https://developer.adobe.com/commerce/php/coding-standards/js-docblock/)
- [TSDoc](https://tsdoc.org/)
- [Python Doc String](https://pandas.pydata.org/docs/development/contributing_docstring.html)

#### Positive Example
```
"""
Calculates the factorial of a given integer.

This function takes an integer as input and returns its factorial. The factorial of a non-negative integer n, denoted as n!, is the product of all positive integers less than or equal to n.
Copy link
Contributor

@daniel-ac-martin daniel-ac-martin Nov 27, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's an irony here that this definition isn't quite right. i.e. 0! = 1 and not 0.

It's difficult when you need to come up with these synthetic examples, of course, and I'm not saying it's a problem.

But I do think we should be aware of this irony, as one argument against comments like these is that one should just read the actual code.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin I guess this plays into the idea that developers shouldn't have to read the code necessarily, especially with IDE tools that pull in comments from methods you shouldn't then need to go into the code to understand it

But yes, creating examples is more of a headache than I expected so I think there's an element of accepting they'll never be perfect. Maybe it's more hassle than it's worth and we should remove them, if they're adding more confusion than clarity?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Think I agree @deanwhitehouseHO, maybe the examples are not adding a lot, especially if they cause more confusion than working to help understand the point

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it's about doc-block style comments, then maybe we should just have an example with fewer caveats? ;-)

Or perhaps the comment should include a link to wikipedia with the full definition? (I'm not sure how we feel about links in comments? - I find they can be useful at times.)


:param n: The non-negative integer for which to calculate the factorial.
:return: The factorial of the input integer.
Comment on lines +183 to +184
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd argue that the most important information here is the types of the input and output. (When that is not defined in the language itself.)

I also think this example is missing something in that it doesn't tell us how error conditions will be handled. (Or is it just undefined behaviour? But then should this be called out in the comment?) e.g. What happens with calculate_factorial(-1)?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin we've tried to avoid adding in too much information in the examples so as not to dictate the exact approach or syntax of comments - it's definitely a good shout, but i'm not sure it adds any further value other than demonstrating what you can use comments for further

"""
def calculate_factorial(n):
...
```

#### Negative Example
```
"""
Calculate factorial, takes a param called `n` which is a number to compute the returned factorial.
"""
def calculate_factorial(n):
...
```

### Comments MUST Remain Applicable After Code Refactor
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This probably isn't possible in practice.

I think I'd suggest that developers should check whether comments need to be updated/removed when they update the code.

There's also maybe a point about keeping comments minimal, but the waters get a bit muddy with the docblock-type comments. (Which are more in the realm of documentation.)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin this aligns with the idea that refactors should maintain the same functionality, this applies to commenting and testing - this is not the same as code updates though, which may alter the functionality and therefore require comment updates and test updates.

I think we have a section about comment minimisation somewhere...

Copy link
Contributor

@daniel-ac-martin daniel-ac-martin Nov 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@deanwhitehouseHO: Okay, so this is analogous to the idea that a good unit test should survive refactoring as well? i.e. Test the contract with the caller and not implementation details.

I think the main source of our disagreements come from an implicit assumption that code comments == doc-block style documentation. In the case of doc-block, I think that @robertdeniszczyc2 has a point with regards to treating it as documentation rather than normal comments.

As an aside, I'm not sure how much I believe in things like doc-block. I think they can be quite low value. (But then again I suppose that is what you are trying to counteract with this standard?) I think it has more value in languages that lack types (such as PHP and JS), as the documentation can start to fill the gaps left by the language. My gut instinct is that we should be making use of things like TypeScript to fill this gap, but also that we should use tests (both unit and functional) as living documentation instead of doc-block comments. That way when a change is made that breaks the contract, we know and can update the documentation (i.e. the tests).


Ensuring that comments remain relevant after code refactors is crucial for long-term code sustainability. Comments should retain their relevance even after code refactors or modifications. This practice ensures that the information conveyed in the comments remains accurate and valuable as the codebase undergoes changes. By doing so, the risk of confusion and errors during future modifications is significantly reduced.

#### Positive Example
```
"""
Calculates the total price of items in the shopping cart.

This function computes the total price by iterating through the items in the shopping cart and summing their prices.

:param cart: List of items in the shopping cart.
:return: Total price as a float.
"""
```

#### Negative Example
```
"""
This function is optimized for small shopping carts with less than 10 items.

This function is specifically designed for small shopping carts with less than 10 items. It uses an efficient algorithm that may not be suitable for larger carts.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Known deficiencies of current code should be called out in comments.

Obviously that creates a problem when those deficiencies are ameliorated, but I think that is the lesser of the two evils.

So I think this is a bit problematic as a negative example.

Although I do agree that such a comment doesn't belong in a docblock style comment.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin I suppose there are better ways to document known deficiencies such as structured code comments (i.e. @todo) or using external tools. The comment here isn't necessarily a deficiency but more an observation from the developer (in this example), maybe of what they've tested - again, examples are hard so any alternatives are welcome


:param cart: List of items in the shopping cart.
:return: Total price as a float.
"""
```

### Comments MUST Use Neutral, Unopinionated Language

Comments should use neutral, unopinionated language to ensure clarity and avoid subjective interpretations. Expressions of personal opinions, unwarranted enthusiasm, or assertions of superiority should be avoided. The goal is to provide factual and clear explanations that facilitate understanding.
Comment on lines +227 to +229
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I disagree with this.

We do need to maintain professionalism, especially when working in the open. (And maybe that is what this point should be changed to.)

But, comments should be opinionated. I want a comment to tell me something that I can't tell from the code alone. e.g. How much confidence did the programmer have when he/she wrote the code? Why did they make make a particular choice/design decision? Did they intend to come back to this code to clean it up later?

On the topic of 'superiority', if a piece of code has been heavily optimised (and perhaps is a bit hard to read as a result) I'd like to know that. But perhaps that feeds into your point about whether a statement is 'unwarranted'.

Perhaps there is something about being clear over what is an objective fact vs a subjective opinion? (Though as I say, I'd still want the subjective stuff, just keep things professional.)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin I think maybe the language used here isn't as clear as we hoped. Comments being opinionated in this context is about subjectivity, I don't see any benefit to one developer writing a subjective opinion within the code as this then becomes challenging if another developer has a different opinion - do you allow both to write individual comments for the same code...

I feel that what you're describing is descriptive comments, rather than what I would define as opinionated. Aligning to other points in the standard such as being valid after a refactor are more challenging if a codebase has comments such as why a choice was made. Whereas being descriptive is what we want, comments should be explanatory but I believe this is possible without being opinionated (depending on your definition).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@deanwhitehouseHO: There are a few things to tease out in this...

With regards to developers with different opinions, the situation you describe sounds like an issue with individuals in a team. I don't think this is something that we can 'standards our way out of'. The problem has to be fixed directly in that particular team. To come back to who exactly should leave a comment, I would expect that comments should be left by the developer who wrote the code. When the code is updated the comments should be updated along with it. When there is disagreement, this should be handled through the peer review process.

Your second paragraph pertains to to the difference that I mentioned between doc-block comments and ordinary comments. I agree that opinionated/subjective remarks do not belong in the documentation for an interface. (And that's what your doc-block comments really are.) On the other hand, I do think that they belong in other, more ordinary comments, as those are really documenting the implementation rather than the interface.


#### Positive Example
```
"""
Calculates the total price of items in the shopping cart.

This function takes a shopping cart as input and calculates the total price. It iterates through the cart items and sums their prices. The code is designed to work efficiently with various cart structures.

:param cart: The shopping cart as a list of items.
:return: The total price as a float.
"""
```

#### Negative Example
```
"""
This function calculates the total price in a smart way.

This function takes a list of items as input and computes the total price in a highly efficient manner. It's the best way to do this, and it's really smart. You'd be crazy to change it.

:param items: The list of items.
:return: The total price, and trust me, it's the best way to do it.
"""
```

### Comments MUST NOT be present in production deployments.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this point should be included.

There's probably something around saying that debugging information should be removed for production builds, but that's not really about comments.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin this is more important for code that a user can see directly, especially JavaScript

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@deanwhitehouseHO: Ah okay, I think that's a more general point about knowing where you code is running and keeping private information private. I don't think it's specific to comments.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin I agree it's more specific to systems that are out of the developers domain per se (i.e. in a browser), however I feel it is specific to comments as JavaScript primarily will run on a users device with the code served directly to them. Comments in the code, in this case, should be removed before we serve it to the user for a number of reasons - keeping information private is a bit broader, although comments can be encompassed under this, but it touches on a lot more than comments.

It then comes down to, as standards, do we (to an extent) duplicate content that overlaps (i.e. security and comments), or do we have it one place - if one place, how do we decide what goes where. If this fell into a security standard, would a user reading about comments know what to exclude in their comments without reading the standard (and vice versa I suppose).

One way around that is cross linking of course, if we have a standard that covers this then would you mind sharing the link as we may just want to cross link rather than repeat ourselves here


Comments in production deployments present potential security and performance risks. They can unintentionally expose sensitive information, such as API keys or debugging details, to unauthorized individuals. Additionally, comments may have a marginal impact on the code's size, which can affect performance in production environments.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you need to be more clear about what you mean here; I somewhat doubt the premise.

Secrets (e.g. API keys) shouldn't be baked into code full-stop. (And we should employ secret scanning tools to help prevent that.) But that is a separate issue from comments.

You also mention unauthorised individuals but it's not obvious how they would gain access to a 'production deployment' in the first place. - Don't we have bigger problems if we get to that point?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin API keys, of sorts, are often included in web-apps as a way of connecting to backend services so these are baked into the code as is the nature of the technology. This is about ensuring that we aren't giving help to anyone who wishes to understand and attempt to exploit the code in anyway - comments themselves aren't the risk, but the information they may give to potential exploiters are.

With regards to how people may access a system, that is of course a bigger problem, but that doesn't mean we let the guard down elsewhere in my opinion

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to be careful to the extent that we endorse 'security through obscurity' as we shouldn't rely on it as our main defence.

Copy link
Contributor

@robertdeniszczyc2 robertdeniszczyc2 Nov 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is somewhat covered by the Work in the open and Threat modelling principles and patterns.

We actually make reference to reducing 'security by obscurity' in the Work in the open principle, and recommend following central government guidance on open and closed source code.


It is important to ensure that no comments are included in production code to mitigate these issues. The removal of comments from production code enhances security and optimizes code performance, ultimately leading to an improved user experience.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing comments won't alter performance in any meaningful way. (Unless there is something very wrong with the compiler/interpreter.)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin of course, we only mention it in passing as it does alter performance very slightly - do you see any harm in stating this?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How slightly?

I do see some harm, as the more content we put out the less likely anyone is to read it. So we need to focus on what matters.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depends on a lot of factors, where we have complex systems in JS and CSS (sorry, this is more my area so i find it easier to highlight) we can have hundreds of lines of comments in a file - these bytes all add up when being served over the network. When we extrapolate that to potentially millions of requests, then it can become fairly significant when it comes to sustainability

I totally get that, we've worked hard to reduce this as much as possible so really appreciate the feedback too!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah definitely this this is more of a HS/CSS problem rather than a Java one

Copy link
Contributor

@daniel-ac-martin daniel-ac-martin Nov 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this is all about client-side JavaScript, I wonder if this is really a more general point about minimising your javascript. i.e. We should cover it elsewhere.


deanwhitehouseHO marked this conversation as resolved.
Show resolved Hide resolved
Furthermore, note that some modern compilers and build tools may automatically strip comments from the compiled code during the production build process. While relying on automatic tools, it is still crucial for developers to follow best practices and ensure that no sensitive information or unnecessary comments are present in the codebase, even before the build process.

#### Tools (for reference only)
- **React/JavaScript/TypeScript/Node:**
- [Terser](https://terser.org/)
- [Babel](https://babeljs.io/)

- **HTML/CSS:**
- [HTML Minifier](https://www.npmjs.com/package/html-minifier)
- [CSS Minifier](https://www.npmjs.com/package/css-minify)

#### Example
No example given.

### Comments MUST NOT be used as a substitute for deleting code.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, but there are exceptions. So I wonder if this is a should rather than a MUST.

I suspect this is more about whether the commented code will be useful to others or just to yourself.

I'd also put in in terms of not committing commented code. i.e. More of a Git hygiene issue.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin we toyed with the idea of having SHOULD or similar but decided to only use MUST as a convention based on other standards we have already

This is primarily a guise for keeping VCS clean yes, but as a standard on commenting rather than version control we have avoided that directly. For arguments sake they may not use a VCS or we may have a different standard altogether for those

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's safe to say that they will be using Git, and so we should handle this under Git hygiene somehow.


Duplication of comments and using comments as a replacement for code deletion can impact code cleanliness. Developers are encouraged to steer clear of duplicating comments across various code sections, as it may result in inconsistencies when modifications are required. Rather than adding a comment to explain outdated or unnecessary code, it is advisable to remove the unused code entirely.

Replacing code deletion with comments can introduce confusion and clutter within the codebase. Ensuring that comments are employed for authentic explanations and not as a workaround for code removal contributes to a cleaner and more maintainable codebase.

#### Positive Example
```
"""
This function calculates the area of a rectangle.

:param length: The length of the rectangle.
:param width: The width of the rectangle.
:return: The area of the rectangle.
"""
def calculate_rectangle_area(length, width):
return length * width
```

#### Negative Example
```
"""
This function calculates the area of a rectangle.

:param length: The length of the rectangle.
:param width: The width of the rectangle.
:return: The area of the rectangle.
"""
def calculate_rectangle_area(length, width):
# Calculate the area of the rectangle
return length * width
# return width * length # Not used
```

### Comments MUST NOT contain sensitive data, such as API keys, tokens, etc.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a more general point around managing secrets. I don't think it should be covered here except perhaps to link off to another standard / pattern / guidance.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daniel-ac-martin can you please provide the link to the standard that we can link to please?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not certain if we have one published publicly at this time. We've got stuff written down elsewhere that we could re-use.

If we don't have it, I'd suggest removing it here and raising an issue to add a link when we do.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have a Standard around managing secrets: https://engineering.homeoffice.gov.uk/standards/managing-secrets/


Avoiding sensitive data in comments is a fundamental security practice. Storing confidential information, such as API keys or tokens, within comments can pose substantial security risks. Comments are typically part of the source code repository and may be accessible to unauthorized individuals.

To safeguard sensitive data and maintain the security of your application, it's essential to refrain from including such information within comments. Instead, it's advisable to utilize secure and designated storage mechanisms for sensitive data, guaranteeing the functionality and security of your code.

#### Good Example
```
"""
Connect to the database using secure credentials.

This function establishes a database connection using secure credentials stored in a separate, protected configuration file. Sensitive data, such as database usernames and passwords, are not exposed in comments or within the source code.

:return: A database connection object.
"""
def connect_to_database():
# Database connection logic here
```

#### Bad Example
```
"""
Connect to the database using username 'my_user' and password 'my_password'.

This function establishes a database connection using hard-coded sensitive data within the comment itself. Storing sensitive data in this manner is a security risk and should be avoided.

:return: A database connection object.
"""
def connect_to_database():
# Database connection logic here
```