Definition of Done (DoD) Checklist

In Plain Language

The Definition of Done is a shared quality agreement that every user story must satisfy before a developer can call it 'finished'. It protects teams against technical debt by guaranteeing that unit tests pass, peer engineers approve the pull request, security scans are clean, and user documentation is updated before code enters the main codebase.

Plain-Language Executive Summary

The Definition of Done is a shared quality checklist that every piece of code must satisfy before a developer can call it "finished". It prevents hidden technical debt by ensuring tests are written, peer reviews are approved, and security scans are clean before merging into the main codebase.

Lifecycle Moment: User Story Completion & Pull Request Gate

Applied at the pull request boundary before merging into the main branch or completing a sprint story.

DoD Best Practices: Good vs. Bad Examples

Anti-Pattern Practice

Developer marks user story "Done" on the Jira board while automated tests are still failing or documentation is postponed to next sprint.

Verified Standard

Story status only moves to "Done" after CI/CD pipeline confirms 100% green tests, clean security scans, approved peer review, and updated docs.

Authoritative Definition of Done Criteria (5 Items)

Every item carries a structured identifier and explicit automation classification:

DOD-ENG-00010-00a0-00

Automated Unit & Integration Test Coverage

CI/CD Automatable

All new business logic and bug fixes have automated Vitest unit tests achieving >=85% branch coverage with zero failures.

Verification: Automated Vitest coverage report gate in CI runner (`npm run test`).
ISO 13485 Cl. 7.3.6 (Design Verification)
DOD-REV-00020-00a0-00

Independent Peer Code Review Sign-off

Manual Review Required

At least one independent peer engineer has reviewed the pull request for architecture fit, readability, and maintainability.

Verification: GitHub Branch Protection requiring approved pull request review by non-author.
SOX § 404 SoD & ISO 27001 Control A.8.32
DOD-SEC-00030-00a0-00

Static Security & Secret Scanning Clean

CI/CD Automatable

Pull request passes SAST scanner (Semgrep/SonarQube) and secret detector (Gitleaks) with zero Critical or High severity findings.

Verification: Automated security scan step blocking PR merge on threshold violation.
ISO 27001 Control A.8.28 (Secure Coding)
DOD-DOC-00040-00a0-00

Documentation & API Contracts Updated

Hybrid Automated/Manual

Public API documentation, Swagger/OpenAPI schemas, and user guide markdown files reflect all interface modifications.

Verification: Doc generator schema diff check and peer review sign-off.
ISO 13485 Cl. 4.2.1 (Documentation)
DOD-ACC-00050-00a0-00

Section 508 & WCAG Accessibility Verification

CI/CD Automatable

All modified UI elements pass automated axe-core accessibility checks and support full keyboard navigation.

Verification: Playwright axe-core automated audit (`npx axe-test`).
Section 508 / WCAG 2.1 AA

Automated CI/CD Pipeline Gate Configuration

Definition of Done items marked CI/CD Automatable are configured directly in GitHub Actions branch protections:

# .github/workflows/dod-quality-gate.yml
name: Definition of Done Gate
on: [pull_request]

jobs:
  verify-dod:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: DOD-ENG-00010: Vitest Coverage Threshold (>=85%)
        run: npx vitest run --coverage --coverage.branches=85
      - name: DOD-SEC-00030: Gitleaks Secrets Scanning
        run: gitleaks detect --source . --verbose --exit-code 1
      - name: DOD-ACC-00050: Playwright axe-core Accessibility
        run: npx playwright test tests/accessibility.spec.ts
Try This with AI: Pull Request DoD Completeness Audit

Copy this prompt into your AI coding assistant to perform an automated Definition of Done audit on any open pull request.

You are a Quality Engineering Lead. Review this GitHub pull request diff against our Definition of Done checklist: 1. Verify branch test coverage meets the >=85% threshold. 2. Check for missing JSDoc comments or outdated OpenAPI schema definitions. 3. Identify any missing accessibility ARIA tags or unhandled error boundaries. Output a structured DoD scorecard with actionable remediation suggestions.

Next Checklist Gate: Definition of Ready (DoR)

Learn how to apply quality gates during sprint planning and backlog refinement.

Open Definition of Ready

Community Discussion & Feedback

Attributed peer feedback and official Netspective architecture notes.

Was this documentation helpful?(100% found this helpful • 0 ratings)

Leave Feedback or Question

○ Loading user info...
0/2000 chars

Discussion (0)

Loading discussion thread...