Outils & environnements du FullStack Developer
8 briques outillage : IDE, Git, Tests, Monitoring, Collaboration, Packages/Builds, Environnements, Sécurité Dev.
IDE : VS Code, JetBrains Git : GitHub/GitLab/Bitbucket Tests : Jest, Cypress, Pytest, JUnit Observabilité : Sentry, Datadog, Prometheus
1) IDE & Productivité (VS Code, JetBrains)
Ă retenir
- VS Code : Remote SSH, DevContainers, Tasks, Workspaces.
- JetBrains (IntelliJ/WebStorm/PyCharm) : refactorings, inspections, profiler.
- Standards dâĂ©quipe : formatage (Prettier/Black), conventions, snippets.
Livrables & KPIs
- Dossier
.vscode/ou.idea/partagé (tasks, launch, extensions). - Temps de setup < 10 min via devcontainer / script bootstrap.
- RĂšgles de formatage/typing homogĂšnes >= 95% de fichiers conformes.
Anti-patterns
- Config locale non versionnĂ©e â Ă©carts entre devs.
- Pas de formatage auto, pas de lint on save.
// VS Code â tasks.json (extrait)
{ "version":"2.0.0","tasks":[{ "label":"tests","type":"shell","command":"npm test"}] }// .editorconfig
root = true
[*]
indent_style = space
indent_size = 2
end_of_line = lf// DevContainer (extrait)
{ "name":"fs-app","image":"mcr.microsoft.com/devcontainers/javascript-node:20","features":{ "ghcr.io/devcontainers/features/python:1":{} } }2) ContrĂŽle de version & GitOps (Git, GitHub/GitLab/Bitbucket)
Stratégies
- Trunk-based + feature flags, ou GitFlow selon contexte.
- PR/MR templates, CODEOWNERS, pre-commit hooks.
- Commits signés (GPG/SSH), Conventional Commits + CHANGELOG.
KPIs & Livrables
- Lead time < 1j, reviews < 24h, rework < 10%.
- Protection branches : tests & lint obligatoires.
- Artefacts versionnés (tags, releases, SBOM).
Anti-patterns
- Long-lived branches, merges géants, pas de rebase.
- Secrets dans lâhistorique, LFS ignorĂ© pour binaires lourds.
# .githooks/pre-commit (ex.)
npm run lint && npm test# .github/PULL_REQUEST_TEMPLATE.md
## Contexte / Tests / Impact# .github/CODEOWNERS
* @team/fullstack3) Tests & Qualité (Jest, Cypress, Pytest, JUnit)
Pyramide
- Unitaires â IntĂ©gration â e2e (Cypress/Playwright).
- Contrats API (OpenAPI tests), snapshot UI.
- Mutation testing (Stryker/PITest) sur modules critiques.
KPIs & Livrables
- Coverage â„ 80% (lignes/branches), < 2% tests flaky.
- Temps CI < 10 min build+tests (cache dépendances).
- Rapports JUnit, coverage XML, artefacts écrans e2e.
Anti-patterns
- Tests e2e massifs lents, mocks excessifs, données non déterministes.
- Pas de seed/fixtures, paralélisme non utilisé.
// Jest (extrait)
test('sum', ()=> expect(sum(1,2)).toBe(3))# Pytest (extrait)
def test_status(client): assert client.get("/healthz").status_code==200// Cypress (extrait)
cy.visit('/login'); cy.get('input[name=email]').type('a@b.com')4) Monitoring & Observabilité (Sentry, Datadog, Prometheus, OTel)
Ă retenir
- Erreurs front/back : Sentry + source maps.
- Métriques : Prometheus (RED/USE), dashboards Grafana.
- Traces : OpenTelemetry (export Jaeger/Tempo/Datadog).
KPIs & Alerting
- p95 API < 150ms, taux erreurs < 1%.
- MTTR < 30m, disponibilité ℠99.9%.
- Front : JS errors/1k sessions < seuil, LCP < 2.5s.
Anti-patterns
- Pas de corrélation trace_id, logs verbeux avec PII.
- Alertes bruitées, seuils non alignés SLO.
// Node + OTel (auto-instr.)
const { NodeSDK } = require('@opentelemetry/sdk-node');
const { getNodeAutoInstrumentations } = require('@opentelemetry/auto-instrumentations-node');
new NodeSDK({ instrumentations:[getNodeAutoInstrumentations()] }).start();# Prometheus â alerte latence
- alert: HighLatency
expr: histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])) > 0.15
for: 2m// Sentry frontend (extrait)
Sentry.init({ dsn:"...", integrations:[new Sentry.BrowserTracing()] });5) Collaboration (Jira, Confluence, Notion, Slack)
Workflows
- Backlog â Sprint â Review â Retro (Scrum/Kanban).
- DoR/DoD, epic â story â sous-tĂąches, points.
- ADR (Architecture Decision Record) versionnés.
KPIs & Livrables
- Cycle time < 5 jours, throughput stable.
- Roadmap trimestrielle, changelog produits.
- Docs vivantes (Confluence/Notion), modĂšles PRD/ADR.
Anti-patterns
- Docs obsolÚtes, décisions orales non tracées.
- Slack-only (pas dâissues), standup sans actions.
# ADR template (extrait)
Title: Décision & contexte
Status: Accepted
Consequences: + / -# Convention ticket
[FEAT] sujet court â critĂšre d'acceptation â tests6) Packages, Builds & Artefacts (npm/pnpm, Poetry, Maven/Gradle, Docker)
Gestion deps
- npm/pnpm/yarn (lockfile), Python Poetry/pip-tools, Java Maven/Gradle.
- Registry privé (Artifactory/GH Packages), cache CI.
- SBOM (Syft), scans (Trivy/Grype).
Builds & Docker
- Docker multi-stage, images < 200MB si possible.
- Reproductibilité (versions épinglées), buildx cache.
- Artefacts : .whl, .jar, images taguées (semver+sha).
KPIs / Anti-patterns
- Temps build < 5â10 min, taux cache > 80%.
- Anti-patterns :
latest, dépendances non gelées, images root.
# Docker multi-stage (extrait)
FROM node:20-alpine AS build
WORKDIR /app; COPY . .; RUN npm ci && npm run build
FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html# Poetry
poetry add fastapi && poetry lock# Gradle (extrait)
tasks.register("fatJar", Jar){ manifest{ attributes("Main-Class":"App") } }7) Environnements & Parité (Docker Compose, DevContainers, Kind/Minikube, Make/Nix)
Outillage env
- Docker Compose (DB/Cache/Queue), devcontainer.json.
- Kind/Minikube + Skaffold/Tilt (boucle rapide).
- Makefile/Nix pour bootstrap idempotent.
Secrets & config
- .env chiffré (SOPS/Age), variables par env.
- Feature flags (LaunchDarkly/ConfigCat) pour dé-risquer.
- Datasets anonymisés pour pré-prod.
KPIs / Anti-patterns
- Setup dev < 10 min, onboarding < 1h.
- Anti-patterns : âworks on my machineâ, DB prod en dev, secrets en clair.
# docker-compose.yml (extrait)
services:
db: { image: postgres:16, environment: { POSTGRES_PASSWORD: dev } }
redis: { image: redis:7 }# Makefile (extrait)
setup: ; npm ci && poetry install
dev: ; docker compose up -d && npm run dev# sops â secret chiffrĂ© (YAML)
apiKey: ENC[AES256_GCM,data:...,iv:...,tag:...]8) Sécurité Dev (Semgrep, Bandit, Trivy, Dependabot/Snyk)
Ă retenir
- SAST : Semgrep (JS/TS), Bandit (Python), SpotBugs (Java).
- Scans deps/images : Dependabot/Snyk, Trivy/Grype.
- Policy-as-Code : OPA/Conftest (IaC/CI/CD).
KPIs & Gates
- 0 vulnĂ©rabilitĂ©s âcriticalâ avant merge.
- MTTR vulnérabilités < 7 jours (high), < 24h (critical).
- SBOM signé, provenance (SLSA) pour artefacts.
Anti-patterns
- Ignorer les advisories, secrets commités, images
latest. - Pas de rotation de clés, pas de MFA.
# GitHub Actions â Dependabot auto-merge (extrait)
- uses: fastify/github-action-merge-dependabot@v3# Trivy â scan image
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0# Semgrep (extrait)
semgrep --config p/ci --error