test-strategy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited test-strategy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
/\
/e2e\ ~10% — critical user flows only
/------\
/ integ \ ~20% — API contracts, DB interactions
/------------\
/ unit \ ~70% — pure logic, transformations, edge cases
/--------------\Keep the pyramid right-side-up. Inverting it (too many e2e) leads to slow, flaky CI.
| Task Type | Test Type | Tool |
|---|---|---|
| Pure function / utility | Unit | Jest / Vitest |
| API endpoint | Integration | Supertest / httpx |
| Critical user flow | E2E | Playwright |
| Data transformation | Property-based | fast-check / Hypothesis |
| React/Vue component | Component | Testing Library |
| CLI command | Integration | execa + assertions |
| Database query | Integration (real DB) | jest + pg / pytest |
| Cron job / scheduler | Unit (mocked time) | Jest fakeTimers |
Is it an external API (Stripe, Sendgrid, etc.)?
→ YES: Always mock. Use recorded fixtures or MSW.
Is it a database?
→ Unit test context: mock (in-memory store or jest.fn())
→ Integration test context: real DB (test container or local)
Is it the file system?
→ Mock with memfs or tmp dir, then clean up.
Is it time / Date.now()?
→ Always mock. Use Jest fakeTimers or freezegun (Python).
Is it a third-party SDK wrapper you wrote?
→ Skip testing the wrapper itself, test your code's behavior.| Project Type | Branch Coverage | Notes |
|---|---|---|
| Published library | 90%+ | Every exported function needs tests |
| Production app | 80%+ | Focus on critical paths |
| Internal tool | 70%+ | Happy path + main error cases |
| Prototype / spike | Skip | Throw it away anyway |
| Generated code | Skip | Don't test codegen output |
describe('calculateDiscount', () => {
it('returns 10% for gold members', () => { ... })
it('returns 0% when cart is empty', () => { ... })
it('throws when discount rate exceeds 100', () => { ... })
})describe('OrderService', () => {
describe('given a confirmed order', () => {
describe('when the user cancels', () => {
it('then it transitions to CANCELLED state', () => { ... })
it('then it sends a cancellation email', () => { ... })
})
})
})getEmail() { return this.email })_app.tsx, Express server bootstrap)beforeEach(async () => {
await db.query('BEGIN')
})
afterEach(async () => {
await db.query('ROLLBACK')
})afterEach(() => {
jest.clearAllMocks() // clear call counts
jest.resetAllMocks() // reset return values
jest.restoreAllMocks() // restore spied originals
})import { PostgreSqlContainer } from '@testcontainers/postgresql'
let container: StartedPostgreSqlContainer
beforeAll(async () => {
container = await new PostgreSqlContainer().start()
process.env.DATABASE_URL = container.getConnectionUri()
})
afterAll(async () => {
await container.stop()
})When a test is flaky (passes/fails non-deterministically):
await on async callssetTimeout, Date.now())--runInBand to isolate and confirmMutation testing verifies that your tests actually catch bugs:
npx stryker run// stryker.config.json
{
"mutator": { "excludedMutations": ["StringLiteral"] },
"thresholds": { "high": 80, "low": 60, "break": 50 },
"reporters": ["html", "progress"]
}Mutation score < 60% means tests pass without catching real logic errors. Focus on the surviving mutants — each one is an untested code path.
High ROI (write these first):
Low ROI (write last or skip):
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.