Multi-Language Code Quality & Test Coverage
Role
Senior SRE Engineer focused on quality, stability, and technical-debt reduction across multi-language codebases.
Goal
Perform a comprehensive intervention in the target repository to stabilize the build, reduce static-analysis warnings, raise test coverage to the language target, apply high-level architectural patterns, and produce a measured improvement report — without auto-opening a Pull Request.
When to Use
- A repository (
.NET, Java, or Python) has accumulated warnings, smells, or suppressed exceptions.
- Test coverage is below the language target and needs a structured push.
- Technical debt must be reduced before a release or handoff.
- Security CVEs (NU1903, OWASP, Bandit, Safety, Snyk) must be cleared.
When NOT to use: one small file, a single change review, or a quick lint pass. For reviewing a single change, use code-review-and-quality.
Inputs
REPO_NAME: full name (owner/repo).
BASE_BRANCH: branch to start from (default main/develop).
OUTPUT_BRANCH: feature/{YYYYMMDD}-{function-name}.
PRIMARY_LANGUAGE: dotnet, java, or python.
Phase 1 — Preparation and Environment
- Clone
{REPO_NAME} if not already present.
- Create working branch
feature/{YYYYMMDD}-{function-name}.
- Identify the build/test tooling:
- .NET:
*.sln, *.csproj, Directory.Build.props, global.json.
- Java:
pom.xml (Maven) or build.gradle* (Gradle).
- Python:
pyproject.toml, setup.py, requirements*.txt, tox.ini.
- Keep any
Environment.SetEnvironmentVariable("Testing", "true") (or equivalent) inside the test execution context only.
Phase 2 — Static Analysis and Warning Correction
Run the appropriate static-analysis tools and fix the following categories.
.NET
| Category |
Codes |
Fix |
| Logging |
CA2017, S2629, CA2254 |
Use static templates and consistent placeholders |
| Asynchronism |
CS4014, CS1998 |
Add await or remove unnecessary async |
| Cleanup |
CS0105, CS0219 |
Remove duplicate usings / unused variables |
| Exceptions |
S3445, S2139 |
Replace throw ex; with throw;; add context on rethrow |
| Web/API |
ASP0019 |
Use .Append in headers |
| Security |
NU1903 |
Resolve package vulnerabilities (high priority) |
| Documentation |
— |
Add /// <summary> to public classes and methods |
Tools: dotnet build, dotnet test, dotnet format, SonarScanner, Roslyn analyzers.
Java
| Category |
Codes / Tools |
Fix |
| Logging |
SLF4J placeholders, Checkstyle |
Parameterized logging; avoid string concatenation in logs |
| Asynchronism |
SpotBugs NP_NULL, Sonar S2190 |
Proper CompletableFuture chaining; avoid fire-and-forget async |
| Cleanup |
PMD, Checkstyle |
Remove unused imports and variables |
| Exceptions |
Sonar S1166, S2221 |
Preserve stack trace; do not swallow exceptions |
| Web/API |
Sonar S3751, S2658 |
Use correct header APIs; avoid mutable static state |
| Security |
OWASP dependency-check, Snyk |
Update vulnerable dependencies |
| Documentation |
Javadoc |
Add Javadoc to public classes and methods |
Tools: mvn compile, mvn test, mvn spotbugs:spotbugs, mvn checkstyle:checkstyle, mvn org.owasp:dependency-check-maven:check.
Python
| Category |
Codes / Tools |
Fix |
| Logging |
Pylint W1203, Ruff G001 |
Use %/f-string formatting with logging correctly |
| Asynchronism |
Pylint W0707, Ruff ASYNC |
Use await properly; avoid asyncio fire-and-forget |
| Cleanup |
F401, F841 (Ruff/Flake8) |
Remove unused imports and variables |
| Exceptions |
Pylint W0706, W0719 |
Re-raise with raise or raise Custom() with from |
| Web/API |
Bandit B104 |
Avoid hard-coded * in CORS; validate headers |
| Security |
Bandit, Safety, Snyk |
Fix high/critical CVEs in requirements.txt / pyproject.toml |
| Documentation |
Pydocstyle, Ruff D |
Add docstrings to public classes and methods |
Tools: ruff check ., ruff format ., mypy, pylint, bandit -r ., pytest --cov=src --cov-report=xml.
Phase 3 — Architecture and Style
Refactor only when it reduces warnings or improves testability.
SOLID
- Single Responsibility: split classes/modules that mix persistence, business logic, and presentation.
- Dependency Inversion: depend on abstractions (interfaces/abstract classes/protocols) instead of concrete implementations.
DDD
- Identify Aggregates, Entities, Value Objects, and Repositories.
- Keep domain logic independent of frameworks and UI.
Clean Architecture
- Validate separation between Domain, Application, Infrastructure, and Presentation.
- Domain must not depend on external frameworks, databases, or UI libraries.
Phase 4 — Tests and Coverage
For framework-specific commands (xUnit/NUnit/MSTest, Maven/Gradle, pytest/unittest), thresholds, and HTML reports, see the references/ files:
references/coverage-dotnet.md
references/coverage-java.md
references/coverage-python.md
Use the auxiliary dispatcher to auto-detect the stack and run coverage:
bash references/run-coverage.sh
.NET
dotnet test --collect:"XPlat Code Coverage" --results-directory ./TestResults
Java
mvn test
# or
./gradlew test jacocoTestReport
Python
pytest --cov=src --cov-report=term-missing --cov-report=xml
Stabilization Rules
- Fix existing failures before creating new tests.
- Remove or skip problematic infrastructure tests (e.g. JWT, external APIs) only when they require deep refactoring, and document the reason.
- New tests follow BDD style: Given / When / Then (or Dado / Quando / Então for pt-BR projects).
Coverage Goals
| Language |
Minimum target |
| .NET |
90% line and branch |
| Java |
85% line and branch |
| Python |
90% line and branch |
Generate reports with reportgenerator (.NET), JaCoCo (Java), or pytest-coverage (Python).
Phase 5 — Documentation and Delivery
README.md
Update with:
- Repository structure (hierarchical tree with descriptions).
- Test coverage table: Total Tests, % Lines, % Branches.
- Technical stack list.
- Business Vision and Technical Vision sections.
CHANGELOG.md
Finalization
Use Conventional Commits:
feat: — new features
fix: — bug fixes
test: — tests
docs: — documentation
refactor: — refactorings
chore: — maintenance tasks
Restriction: Do not open the Pull Request automatically. Prepare the commit, update the README/CHANGELOG, and generate a Detailed Technical Summary containing all changes so the user can open the PR manually.
Quality Checklist
Common Mistakes
| Mistake |
Consequence |
How to avoid |
throw ex; instead of raise/throw |
Stack trace lost, root cause hidden |
Re-raise with original trace; add context, do not reset |
| String concatenation in logs |
Allocation/SQLi-style risk, no structured params |
Use parameterized logging placeholders |
| Auto-opening the PR |
User loses control of merge timing |
Generate the summary; let the user open the PR |
| New tests before fixing red suite |
Unstable baseline, false confidence |
Stabilize existing failures first |
| Skip coverage report |
No evidence target was met |
Always emit cobertura/jacoco/xml coverage |
References
references/coverage-dotnet.md — .NET coverage (xUnit/NUnit/MSTest, Coverlet, reportgenerator, thresholds).
references/coverage-java.md — Java coverage (Maven JaCoCo, Gradle JaCoCo, thresholds).
references/coverage-python.md — Python coverage (pytest-cov, unittest + coverage.py, mypy, thresholds).
references/run-coverage.sh — Stack-detecting dispatcher that runs the right coverage command.
See Also
- For reviewing a single change before merge, see
code-review-and-quality.
- For automated SonarQube issue remediation across stacks, see
sonarqube-review.
Origin
Adapted from the devin/playbooks/multi-language-quality/PLAYBOOK.md playbook into an agentskills.io-format skill, following the catalog standards (license: MIT, metadata.version, tripartite description with explicit Do NOT use for clause).
1---2name: quality-test-implementation3description: Use when improving code quality, reducing technical debt, or raising test coverage in .NET, Java, or Python repositories — fixing static-analysis warnings (Roslyn/Sonar, SpotBugs/Checkstyle, Bandit/Ruff), resolving security CVEs, and applying SOLID/DDD/Clean Architecture. Do NOT use for a single-file cosmetic edit, a focused review of one change, or as a substitute for `code-review-and-quality`; this is a whole-repo quality intervention, not a localized fix. Part of the afonsoft/skills collection.4license: MIT5---67# Multi-Language Code Quality & Test Coverage89## Role1011Senior SRE Engineer focused on quality, stability, and technical-debt reduction across multi-language codebases.1213## Goal1415Perform a comprehensive intervention in the target repository to stabilize the build, reduce static-analysis warnings, raise test coverage to the language target, apply high-level architectural patterns, and produce a measured improvement report — without auto-opening a Pull Request.1617## When to Use1819- A repository (`.NET`, `Java`, or `Python`) has accumulated warnings, smells, or suppressed exceptions.20- Test coverage is below the language target and needs a structured push.21- Technical debt must be reduced before a release or handoff.22- Security CVEs (NU1903, OWASP, Bandit, Safety, Snyk) must be cleared.2324**When NOT to use:** one small file, a single change review, or a quick lint pass. For reviewing a single change, use `code-review-and-quality`.2526## Inputs2728- `REPO_NAME`: full name (`owner/repo`).29- `BASE_BRANCH`: branch to start from (default `main`/`develop`).30- `OUTPUT_BRANCH`: `feature/{YYYYMMDD}-{function-name}`.31- `PRIMARY_LANGUAGE`: `dotnet`, `java`, or `python`.3233---3435## Phase 1 — Preparation and Environment36371. Clone `{REPO_NAME}` if not already present.382. Create working branch `feature/{YYYYMMDD}-{function-name}`.393. Identify the build/test tooling:40 - **.NET**: `*.sln`, `*.csproj`, `Directory.Build.props`, `global.json`.41 - **Java**: `pom.xml` (Maven) or `build.gradle*` (Gradle).42 - **Python**: `pyproject.toml`, `setup.py`, `requirements*.txt`, `tox.ini`.434. Keep any `Environment.SetEnvironmentVariable("Testing", "true")` (or equivalent) **inside the test execution context only**.4445---4647## Phase 2 — Static Analysis and Warning Correction4849Run the appropriate static-analysis tools and fix the following categories.5051### .NET5253| Category | Codes | Fix |54|---|---|---|55| Logging | CA2017, S2629, CA2254 | Use static templates and consistent placeholders |56| Asynchronism | CS4014, CS1998 | Add `await` or remove unnecessary `async` |57| Cleanup | CS0105, CS0219 | Remove duplicate usings / unused variables |58| Exceptions | S3445, S2139 | Replace `throw ex;` with `throw;`; add context on rethrow |59| Web/API | ASP0019 | Use `.Append` in headers |60| Security | NU1903 | Resolve package vulnerabilities (high priority) |61| Documentation | — | Add `/// <summary>` to public classes and methods |6263Tools: `dotnet build`, `dotnet test`, `dotnet format`, SonarScanner, Roslyn analyzers.6465### Java6667| Category | Codes / Tools | Fix |68|---|---|---|69| Logging | SLF4J placeholders, Checkstyle | Parameterized logging; avoid string concatenation in logs |70| Asynchronism | SpotBugs NP_NULL, Sonar S2190 | Proper `CompletableFuture` chaining; avoid fire-and-forget async |71| Cleanup | PMD, Checkstyle | Remove unused imports and variables |72| Exceptions | Sonar S1166, S2221 | Preserve stack trace; do not swallow exceptions |73| Web/API | Sonar S3751, S2658 | Use correct header APIs; avoid mutable static state |74| Security | OWASP dependency-check, Snyk | Update vulnerable dependencies |75| Documentation | Javadoc | Add Javadoc to public classes and methods |7677Tools: `mvn compile`, `mvn test`, `mvn spotbugs:spotbugs`, `mvn checkstyle:checkstyle`, `mvn org.owasp:dependency-check-maven:check`.7879### Python8081| Category | Codes / Tools | Fix |82|---|---|---|83| Logging | Pylint W1203, Ruff G001 | Use `%`/f-string formatting with `logging` correctly |84| Asynchronism | Pylint W0707, Ruff ASYNC | Use `await` properly; avoid `asyncio` fire-and-forget |85| Cleanup | F401, F841 (Ruff/Flake8) | Remove unused imports and variables |86| Exceptions | Pylint W0706, W0719 | Re-raise with `raise` or `raise Custom()` with `from` |87| Web/API | Bandit B104 | Avoid hard-coded `*` in CORS; validate headers |88| Security | Bandit, Safety, Snyk | Fix high/critical CVEs in `requirements.txt` / `pyproject.toml` |89| Documentation | Pydocstyle, Ruff D | Add docstrings to public classes and methods |9091Tools: `ruff check .`, `ruff format .`, `mypy`, `pylint`, `bandit -r .`, `pytest --cov=src --cov-report=xml`.9293---9495## Phase 3 — Architecture and Style9697Refactor only when it reduces warnings or improves testability.9899### SOLID100- **Single Responsibility**: split classes/modules that mix persistence, business logic, and presentation.101- **Dependency Inversion**: depend on abstractions (interfaces/abstract classes/protocols) instead of concrete implementations.102103### DDD104- Identify **Aggregates**, **Entities**, **Value Objects**, and **Repositories**.105- Keep domain logic independent of frameworks and UI.106107### Clean Architecture108- Validate separation between **Domain**, **Application**, **Infrastructure**, and **Presentation**.109- Domain must not depend on external frameworks, databases, or UI libraries.110111---112113## Phase 4 — Tests and Coverage114115For framework-specific commands (xUnit/NUnit/MSTest, Maven/Gradle, pytest/unittest), thresholds, and HTML reports, see the `references/` files:116117- `references/coverage-dotnet.md`118- `references/coverage-java.md`119- `references/coverage-python.md`120121Use the auxiliary dispatcher to auto-detect the stack and run coverage:122123```bash124bash references/run-coverage.sh125```126127### .NET128```bash129dotnet test --collect:"XPlat Code Coverage" --results-directory ./TestResults130```131132### Java133```bash134mvn test135# or136./gradlew test jacocoTestReport137```138139### Python140```bash141pytest --cov=src --cov-report=term-missing --cov-report=xml142```143144### Stabilization Rules145- Fix existing failures before creating new tests.146- Remove or skip problematic infrastructure tests (e.g. JWT, external APIs) only when they require deep refactoring, and document the reason.147- New tests follow **BDD** style: **Given / When / Then** (or **Dado / Quando / Então** for pt-BR projects).148149### Coverage Goals150| Language | Minimum target |151|---|---|152| .NET | 90% line and branch |153| Java | 85% line and branch |154| Python | 90% line and branch |155156Generate reports with `reportgenerator` (.NET), `JaCoCo` (Java), or `pytest-coverage` (Python).157158---159160## Phase 5 — Documentation and Delivery161162### README.md163Update with:164- Repository structure (hierarchical tree with descriptions).165- Test coverage table: Total Tests, % Lines, % Branches.166- Technical stack list.167- Business Vision and Technical Vision sections.168169### CHANGELOG.md170- Follow [Keep a Changelog](https://keepachangelog.com/)171- Use [Semantic Versioning](https://semver.org/)172- Link the changelog in the README.173174### Finalization175Use **Conventional Commits**:176- `feat:` — new features177- `fix:` — bug fixes178- `test:` — tests179- `docs:` — documentation180- `refactor:` — refactorings181- `chore:` — maintenance tasks182183**Restriction:** Do not open the Pull Request automatically. Prepare the commit, update the README/CHANGELOG, and generate a **Detailed Technical Summary** containing all changes so the user can open the PR manually.184185---186187## Quality Checklist188189- [ ] No high/critical security vulnerabilities remain.190- [ ] Static-analysis warnings reduced to acceptable baseline.191- [ ] All existing tests pass.192- [ ] Coverage report generated and meets the language target.193- [ ] README updated with coverage and architecture sections.194- [ ] CHANGELOG updated with `Unreleased` changes.195- [ ] Commit message follows Conventional Commits.196197## Common Mistakes198199| Mistake | Consequence | How to avoid |200|------|-------------|-------------|201| `throw ex;` instead of `raise`/`throw` | Stack trace lost, root cause hidden | Re-raise with original trace; add context, do not reset |202| String concatenation in logs | Allocation/SQLi-style risk, no structured params | Use parameterized logging placeholders |203| Auto-opening the PR | User loses control of merge timing | Generate the summary; let the user open the PR |204| New tests before fixing red suite | Unstable baseline, false confidence | Stabilize existing failures first |205| Skip coverage report | No evidence target was met | Always emit `cobertura`/`jacoco`/`xml` coverage |206207## References208209- `references/coverage-dotnet.md` — .NET coverage (xUnit/NUnit/MSTest, Coverlet, reportgenerator, thresholds).210- `references/coverage-java.md` — Java coverage (Maven JaCoCo, Gradle JaCoCo, thresholds).211- `references/coverage-python.md` — Python coverage (pytest-cov, unittest + coverage.py, mypy, thresholds).212- `references/run-coverage.sh` — Stack-detecting dispatcher that runs the right coverage command.213214## See Also215216- For reviewing a single change before merge, see `code-review-and-quality`.217- For automated SonarQube issue remediation across stacks, see `sonarqube-review`.218219## Origin220221Adapted from the `devin/playbooks/multi-language-quality/PLAYBOOK.md` playbook into an agentskills.io-format skill, following the catalog standards (`license: MIT`, `metadata.version`, tripartite `description` with explicit `Do NOT use for` clause).