test-strategy
starsforks
How to install test-strategy?
echovic/boss-skill/test-strategy
$npx -y skills add echoVic/boss-skill --skill test-strategy测试策略和测试金字塔原则，定义单元测试、集成测试、E2E测试的分布和覆盖要求
SKILL.md
| 1 | # 测试策略与测试金字塔 |
| 2 | |
| 3 | ## 测试金字塔原则 |
| 4 | |
| 5 | ``` |
| 6 | /\ |
| 7 | / \ |
| 8 | / E2E \ ← ~10%：端到端用户流程【必须编写】 |
| 9 | /--------\ |
| 10 | / 集成测试 \ ← ~20%：组件/服务/API 交互 |
| 11 | /--------------\ |
| 12 | / 单元测试 \ ← ~70%：函数/组件/服务逻辑 |
| 13 | /--------------------\ |
| 14 | ``` |
| 15 | |
| 16 | ### E2E 测试是强制要求 |
| 17 | |
| 18 | **每个项目必须编写 E2E 测试**，最少覆盖： |
| 19 | - 创建流程 |
| 20 | - 编辑流程 |
| 21 | - 删除流程 |
| 22 | - 列表展示 |
| 23 | - 核心业务流程 |
| 24 | |
| 25 | ### 前端 vs 后端测试分布 |
| 26 | |
| 27 | | 层级 | 前端测试 | 后端测试 | |
| 28 | |------|----------|----------| |
| 29 | | **单元测试** | 组件渲染、Hooks、工具函数 | Service 层、业务逻辑、工具类 | |
| 30 | | **集成测试** | 组件交互、状态管理、API 调用 | API 端点、数据库操作、服务间调用 | |
| 31 | | **E2E 测试** | UI 用户流程 | API 完整流程、跨服务调用 | |
| 32 | |
| 33 | ## QA Attack Protocol |
| 34 | |
| 35 | - **重放核心用户路径**：证明核心用户路径真实可用 |
| 36 | - **捕获真实 payload 与服务端响应**：验证请求 payload、服务端响应和 schema 一致性 |
| 37 | - **攻击认证授权**：覆盖匿名、授权、非授权、过期、越权 |
| 38 | - **攻击数据边界**：empty state、pagination、第二页、旧数据、illegal enum、long input、double submit |
| 39 | - **攻击业务一致性**：核对界面展示与服务端业务常量一致 |
| 40 | - **验证产物类功能**：验证核心产物、记录或状态存在、可展示、可继续用于下游流程 |
| 41 | - **标记未验证路径**：若核心用户路径只由 Mock 或桩数据证明，必须标记为未验证，不能作为发布证据 |
| 42 | |
| 43 | ## 安全测试 |
| 44 | |
| 45 | | 测试类型 | 测试内容 | 示例 | |
| 46 | |----------|----------|------| |
| 47 | | **SQL 注入** | 参数化查询验证 | `' OR '1'='1` | |
| 48 | | **XSS** | 输出转义验证 | `<script>alert(1)</script>` | |
| 49 | | **CSRF** | Token 验证 | 跨站请求测试 | |
| 50 | | **认证** | Token 有效性 | 过期/伪造 Token | |
| 51 | | **授权** | 权限边界 | 越权访问测试 | |
| 52 | | **输入验证** | 边界值/格式 | 超长/特殊字符 | |
| 53 | |
| 54 | ## 性能测试 |
| 55 | |
| 56 | | 指标 | 前端目标 | 后端目标 | |
| 57 | |------|----------|----------| |
| 58 | | 首屏加载 | < 3s | - | |
| 59 | | API P50 | - | < 100ms | |
| 60 | | API P99 | - | < 500ms | |
| 61 | | 并发用户 | - | ≥ 100 | |
| 62 | | 内存泄漏 | 无 | 无 | |
People who liked this also viewed
6 picksType
- tddSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- test-driven-developmentUse when implementing any feature or bugfix, before writing implementation codeSkillsJul 2026
- qaSkills for Real Engineers. Straight from my .agents directory.SkillsJul 2026
- verification-before-completionUse when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidenceSkillsJul 2026
- webapp-testingToolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser lSkillsJul 2026
- playwright-best-practicesUse when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, teSkillsJul 2026
