Requirements for team processes

[antdking]

Many of our points can be fulfilled by completing one-shot tasks. An example of this is Sentry.

You can set up a Sentry service, and have it notifying to places, however it doesn't mean that Sentry will get used. We should look into setting standards for usage, ie "Sentry errors are triaged within 24 hours, resolved within 1 week".

This is not limited to Sentry

[booyaa]

If #7 hadn't existed, then I would've said this is out of scope for this repo.

I agreed this should probably be captured as a best practice.

Another similar item is security updates, if you don't keep on top of them they will eventually become a massive risk.

[davidwinter]

Feels like a few extra items for the checklists that could help steer this, but definitely seeing it as part of a team process discipline to keep on top of them. When we start working with deliveries from the start and jumping in and out further on, we can update the scores on the following items to help steer teams back to following them.

For the exception tracking, something along the lines of:

• No unresolved exceptions in the previous seven days

We need to ensure teams are encouraged to check the Sentry notifications during development to keep these down from the get-go.

For dependency upgrades, might be a little trickier as releases of those dependencies are out of our control. I'd like to include in this though that:

• Primary language is using the latest stable version (as this will change overtime but steer work for us)
• Primary framework is using the latest stable version
• No severe security vulnerabilities detected against dependencies
• No dependency upgrade suggestions older than X days/weeks/months (so we can try and batch these in single sessions)