qa

Use whenever an app uses self-hosted Keycloak and needs integration tests: a throwaway Keycloak per test class via Testcontainers, realm JSON imports, OIDC discovery, token and introspection endpoints, the admin REST API, password, auth-code, client-credentials and token-exchange flows, and UMA.

Use after a feature or route is deleted and the project still compiles, or when package.json has dependencies nobody can explain. Runs Knip on a JS/TS project to find unused files, dependencies, exports and class or enum members, aware of test entry points through its framework plugins.

Use whenever code that reads LaunchDarkly feature flags needs tests: the TestData source for hermetic tests with no network, file-based fixtures, per-test flag overrides and assignment checks. Which flag combinations to cover is in openfeature-sdk-testing's flag test-matrix reference.

Use whenever a schema is managed with Liquibase: changelogs and changesets in XML, YAML, JSON or SQL, update, status, rollback and tag, preconditions, contexts and labels, and the changelog lock tables, for portable migrations across databases with fine rollback control.

Use when BDD scenarios pass in CI and stakeholders need an always-current, readable report of which acceptance criteria pass. Turns Cucumber JSON into HTML living documentation (multiple-cucumber-html-reporter or Serenity BDD) and publishes it to GitHub or GitLab Pages.

Use when a multi-language codebase needs one complexity gate, or a function has grown unreviewable and CI needs a number. Runs Lizard (30+ languages) on production code to enforce per-function cyclomatic complexity, length and parameter-count thresholds, excluding tests.

Use when a JS/TS build compiles but a clearly imported module is undefined at runtime, or CI should block new import cycles. Runs Madge on production code to find circular dependencies and orphan modules and draw the module graph, excluding test files.

Pure-reference catalog of the Manifest V3 test surface for Firefox + Chromium browser extensions. Maps each manifest field that changed from MV2 (manifest_version, background.service_worker vs background.scripts, action vs browser_action / page_action, host_permissions split, web_accessible_resources object-form, content_security_policy object-form), the runtime restrictions service workers impose (no DOM, no XMLHttpRequest, no localStorage, ephemeral lifecycle, synchronous listener registration, alarms instead of setTimeout), and the Firefox-vs-Chrome key matrix (browser_specific_settings.gecko, externally_connectable / offline_enabled gaps, MV2-only user_scripts manifest key); references/ carry Mozilla's web-ext CLI (lint via addons-linter, run on firefox-desktop / firefox-android / chromium targets, deterministic build, AMO sign). Use as the manifest-surface reference when authoring extension tests across both browsers, or when driving Firefox runs / AMO signing with web-ext.

Use when multi-factor login needs automated tests or a new second factor is being added: deterministic TOTP and HOTP codes, SMS or email OTP, WebAuthn passkeys via the Chrome virtual authenticator, recovery codes, enrollment and step-up challenges.

Use whenever someone asks if a database migration is safe to run in production: rename or drop a column, add NOT NULL or a default, add an index or foreign key, change a type on a large PostgreSQL or MySQL table. Classifies each statement (additive, locking, breaking, data-loss) by lock and rewrite.

Use when a complex stateful flow (checkout, onboarding, multi-step wizard) needs systematic model-based coverage that ad-hoc tests miss. Builds a state-machine model, checks it is complete, picks a coverage criterion, generates covering paths and turns them into a curated test suite.

Use when two concurrent database transactions can touch the same rows (balance debits, seat bookings, stock counts), or before changing a default isolation level. Tests which anomalies each level prevents (dirty, non-repeatable and phantom reads, write skew) in PostgreSQL, MySQL and SQL Server.

Use whenever an OAuth 2.0 or OpenID Connect client or resource server needs tests, whatever the identity provider: auth code with PKCE, client credentials, refresh-token rotation and reuse detection, state and nonce checks, scopes and strict redirect-URI matching, per the RFCs.

Use when an app uses Okta as its identity provider and needs tests for org config, sign-in policies or Identity Engine flows: per-PR or shared orgs, MFA enforcement, factor enrollment, recovery, SCIM provisioning and least-privilege API tokens.

Use when a pull request or release changes an OpenAPI spec and breaking changes must be caught: removed endpoints, deleted schemas, narrowed enums, changed responses. Runs oasdiff breaking, grades findings ERR, WARN or INFO and gates CI with --fail-on.

Use whenever code that reads feature flags through OpenFeature, Unleash, Flagsmith or GrowthBook needs tests: InMemoryProvider for hermetic tests, evaluation details, hooks and targeting context in TypeScript, Java and Python, plus a flag test-matrix workflow. LaunchDarkly has launchdarkly-testing.

Use when a service is instrumented with OpenTelemetry and alerts, SLOs or dashboards depend on span names or attributes a refactor could drop. Captures spans with the in-memory exporter in tests (Python, JS, Java) and asserts on names, attributes, status, kind and structure.

Use when an OpenTelemetry Collector config changes (a new receiver, processor or exporter) and must be verified before deploy. Runs otelcol validate, uses the debug or file exporter to assert spans flow through the pipeline, and wires the check into CI.

Use whenever two services (a frontend and an API, or two microservices) keep breaking each other's API: set up Pact consumer-driven contract tests, publish pacts to a broker, verify the provider and gate deploys with can-i-deploy.

Use whenever tests must prove payment card handling meets PCI DSS v4.0: no stored or logged CVV, full card number (PAN), track data or PIN, card data only over strong TLS, cardholder data environment boundaries and segmentation, key management, SAQ level, scope reduction with hosted fields.