testing-strategy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited testing-strategy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Testing approach: unit/integration/e2e split, what to test, test structure (AAA pattern), mocking strategies, and coverage targets.
Follow the testing pyramid — more unit tests, fewer integration tests, even fewer e2e tests:
/ E2E \ ~5% — Critical user journeys
/----------\
/ Integration \ ~20% — Module boundaries, API contracts
/----------------\
/ Unit Tests \ ~75% — Functions, components, utilities
/____________________\| Level | Speed | Scope | Quantity |
|---|---|---|---|
| Unit | Fast (ms) | Single function/component | Many |
| Integration | Medium (seconds) | Module interactions, DB, API | Some |
| E2E | Slow (seconds-minutes) | Full user flows | Few |
Every test should follow Arrange, Act, Assert:
describe("OrderService", () => {
describe("calculateTotal", () => {
it("applies percentage discount to subtotal", () => {
// Arrange
const items = [
{ name: "Widget", price: 25.00, quantity: 2 },
{ name: "Gadget", price: 15.00, quantity: 1 },
];
const discount = { type: "percentage", value: 10 };
// Act
const total = calculateTotal(items, discount);
// Assert
expect(total).toBe(58.50); // (50 + 15) * 0.90
});
});
});describe("OrderService"), describe("calculateTotal")it("applies percentage discount to subtotal")it("<expected behavior> when <condition>")it("returns null for invalid input") not it("should return null...")expect calls are fine if testing one behavior)if, for, or switch in test code| Mock | Don't Mock |
|---|---|
| External APIs and services | The unit under test |
| Database calls (in unit tests) | Simple utility functions |
| File system access | Data transformations |
| Timers and dates | Pure functions |
| Network requests | Collaborators (in integration tests) |
| Third-party services | Standard library methods |
Prefer lighter mocking techniques when possible:
jest.fn().mockReturnValue(42)jest.spyOn(service, 'save')new InMemoryUserRepository()jest.mock('./database')afterEach(() => jest.restoreAllMocks())// Good — mock at the boundary
const mockDb = { query: jest.fn().mockResolvedValue([{ id: 1, name: "Alice" }]) };
const repo = new UserRepository(mockDb);
const user = await repo.findById(1);
expect(user.name).toBe("Alice");
// Bad — mocking the unit under test
jest.spyOn(repo, "findById").mockResolvedValue({ id: 1, name: "Alice" });// Fixed time
beforeEach(() => {
jest.useFakeTimers();
jest.setSystemTime(new Date("2025-06-15T12:00:00Z"));
});
afterEach(() => jest.useRealTimers());
// API responses
const mockFetch = jest.fn().mockResolvedValue({
ok: true,
json: async () => ({ data: { id: 1 } }),
});
global.fetch = mockFetch;
// Environment variables
const originalEnv = process.env;
beforeEach(() => {
process.env = { ...originalEnv, API_KEY: "test-key" };
});
afterEach(() => {
process.env = originalEnv;
});describe("POST /api/users", () => {
it("creates a user and returns 201", async () => {
const response = await request(app)
.post("/api/users")
.send({ email: "[email protected]", name: "Test User" })
.expect(201);
expect(response.body.data).toMatchObject({
email: "[email protected]",
name: "Test User",
});
expect(response.body.data.id).toBeDefined();
});
it("returns 400 for invalid email", async () => {
const response = await request(app)
.post("/api/users")
.send({ email: "not-an-email", name: "Test User" })
.expect(400);
expect(response.body.error.code).toBe("VALIDATION_ERROR");
});
});data-testid="submit-button", not CSS selectors| Metric | Target | Notes |
|---|---|---|
| Line coverage | 80%+ | Higher for critical modules |
| Branch coverage | 75%+ | Ensures conditional paths are tested |
| Function coverage | 85%+ | All public functions tested |
| Critical paths | 100% | Payment, auth, data integrity |
src/
services/
order.service.ts
order.service.test.ts # Unit tests colocated
api/
routes/
users.route.ts
tests/
integration/
api/
users.test.ts # Integration tests separate
e2e/
flows/
checkout.test.ts # E2E tests separate
fixtures/
users.json # Shared test data
helpers/
test-db.ts # Shared test utilities~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.