소프트웨어 테스팅 전략 완전 가이드 — 유닛부터 카오스 엔지니어링까지

        /  E2E  \          ~10%  느리지만 사용자 관점 검증
       /  통합    \        ~20%  컴포넌트 간 상호작용 검증
      /   유닛     \      ~70%  빠르고 격리된 단위 검증

      \    E2E     /      ~70%  느리고 불안정
       \  통합    /       ~20%
        \ 유닛  /         ~10%  거의 없음

# Python - pytest + unittest.mock
from unittest.mock import Mock, patch
import pytest

class PaymentService:
    def __init__(self, gateway):
        self.gateway = gateway

    def charge(self, amount, card_token):
        if amount <= 0:
            raise ValueError("Amount must be positive")
        return self.gateway.process_payment(amount, card_token)

class TestPaymentService:
    def test_charge_positive_amount(self):
        # Arrange
        mock_gateway = Mock()
        mock_gateway.process_payment.return_value = "txn_123"
        service = PaymentService(mock_gateway)

        # Act
        result = service.charge(100, "card_abc")

        # Assert
        assert result == "txn_123"
        mock_gateway.process_payment.assert_called_once_with(100, "card_abc")

    def test_charge_negative_amount_raises(self):
        mock_gateway = Mock()
        service = PaymentService(mock_gateway)

        with pytest.raises(ValueError, match="Amount must be positive"):
            service.charge(-50, "card_abc")

        mock_gateway.process_payment.assert_not_called()

// JavaScript - Jest
describe('PaymentService', () => {
  it('should charge positive amount', async () => {
    const mockGateway = {
      processPayment: jest.fn().mockResolvedValue('txn_123'),
    };
    const service = new PaymentService(mockGateway);

    const result = await service.charge(100, 'card_abc');

    expect(result).toBe('txn_123');
    expect(mockGateway.processPayment).toHaveBeenCalledWith(100, 'card_abc');
  });

  it('should reject negative amount', async () => {
    const mockGateway = { processPayment: jest.fn() };
    const service = new PaymentService(mockGateway);

    await expect(service.charge(-50, 'card_abc'))
      .rejects.toThrow('Amount must be positive');
    expect(mockGateway.processPayment).not.toHaveBeenCalled();
  });
});

# Python - FastAPI + pytest + httpx
import pytest
from httpx import AsyncClient, ASGITransport
from app.main import app

@pytest.mark.asyncio
async def test_create_user():
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as client:
        response = await client.post("/users", json={
            "name": "Alice",
            "email": "alice@example.com"
        })

    assert response.status_code == 201
    data = response.json()
    assert data["name"] == "Alice"
    assert "id" in data

@pytest.mark.asyncio
async def test_create_user_duplicate_email():
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as client:
        await client.post("/users", json={
            "name": "Alice",
            "email": "alice@example.com"
        })
        response = await client.post("/users", json={
            "name": "Bob",
            "email": "alice@example.com"
        })

    assert response.status_code == 409

// Java - Testcontainers + JUnit 5
@Testcontainers
@SpringBootTest
class UserRepositoryIntegrationTest {

    @Container
    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16")
        .withDatabaseName("testdb")
        .withUsername("test")
        .withPassword("test");

    @DynamicPropertySource
    static void configureProperties(DynamicPropertyRegistry registry) {
        registry.add("spring.datasource.url", postgres::getJdbcUrl);
        registry.add("spring.datasource.username", postgres::getUsername);
        registry.add("spring.datasource.password", postgres::getPassword);
    }

    @Autowired
    private UserRepository userRepository;

    @Test
    void shouldSaveAndFindUser() {
        User user = new User("Alice", "alice@example.com");
        userRepository.save(user);

        Optional<User> found = userRepository.findByEmail("alice@example.com");

        assertThat(found).isPresent();
        assertThat(found.get().getName()).isEqualTo("Alice");
    }

    @Test
    void shouldReturnEmptyForNonExistentUser() {
        Optional<User> found = userRepository.findByEmail("nobody@example.com");
        assertThat(found).isEmpty();
    }
}

# Python - testcontainers
from testcontainers.postgres import PostgresContainer
import psycopg2

def test_user_crud():
    with PostgresContainer("postgres:16") as postgres:
        conn = psycopg2.connect(
            host=postgres.get_container_host_ip(),
            port=postgres.get_exposed_port(5432),
            user=postgres.username,
            password=postgres.password,
            dbname=postgres.dbname,
        )
        cursor = conn.cursor()

        cursor.execute("""
            CREATE TABLE users (
                id SERIAL PRIMARY KEY,
                name VARCHAR(100),
                email VARCHAR(100) UNIQUE
            )
        """)
        cursor.execute(
            "INSERT INTO users (name, email) VALUES (%s, %s) RETURNING id",
            ("Alice", "alice@example.com")
        )
        user_id = cursor.fetchone()[0]

        cursor.execute("SELECT name FROM users WHERE id = %s", (user_id,))
        assert cursor.fetchone()[0] == "Alice"

        conn.commit()
        conn.close()

// Playwright 테스트 예제
import { test, expect } from '@playwright/test';

test.describe('사용자 로그인 흐름', () => {
  test('유효한 자격증명으로 로그인', async ({ page }) => {
    await page.goto('/login');

    await page.getByLabel('이메일').fill('user@example.com');
    await page.getByLabel('비밀번호').fill('SecurePass123');
    await page.getByRole('button', { name: '로그인' }).click();

    await expect(page).toHaveURL('/dashboard');
    await expect(page.getByText('환영합니다')).toBeVisible();
  });

  test('잘못된 비밀번호로 로그인 실패', async ({ page }) => {
    await page.goto('/login');

    await page.getByLabel('이메일').fill('user@example.com');
    await page.getByLabel('비밀번호').fill('wrong');
    await page.getByRole('button', { name: '로그인' }).click();

    await expect(page.getByText('이메일 또는 비밀번호가 잘못되었습니다')).toBeVisible();
    await expect(page).toHaveURL('/login');
  });
});

// Cypress 테스트 예제
describe('장바구니 기능', () => {
  beforeEach(() => {
    cy.visit('/products');
  });

  it('상품을 장바구니에 추가', () => {
    cy.get('[data-testid="product-card"]').first().within(() => {
      cy.get('[data-testid="add-to-cart"]').click();
    });

    cy.get('[data-testid="cart-badge"]').should('have.text', '1');
    cy.get('[data-testid="cart-icon"]').click();
    cy.get('[data-testid="cart-item"]').should('have.length', 1);
  });

  it('장바구니에서 수량 변경', () => {
    cy.get('[data-testid="product-card"]').first()
      .find('[data-testid="add-to-cart"]').click();
    cy.get('[data-testid="cart-icon"]').click();

    cy.get('[data-testid="quantity-increase"]').click();
    cy.get('[data-testid="quantity-input"]').should('have.value', '2');
  });
});

// Playwright - 플레이키 테스트 방지 패턴
test('데이터 로딩 후 목록 표시', async ({ page }) => {
  await page.goto('/users');

  // 나쁜 예: 고정 시간 대기
  // await page.waitForTimeout(3000);

  // 좋은 예: 특정 요소가 나타날 때까지 대기
  await page.waitForSelector('[data-testid="user-list"]');
  const users = page.getByTestId('user-item');
  await expect(users).toHaveCount(10);
});

# Step 1: Red - 실패하는 테스트 작성
def test_password_minimum_length():
    validator = PasswordValidator()
    assert validator.validate("short") == False

def test_password_requires_uppercase():
    validator = PasswordValidator()
    assert validator.validate("longpassword1") == False

def test_password_requires_number():
    validator = PasswordValidator()
    assert validator.validate("LongPassword") == False

def test_valid_password():
    validator = PasswordValidator()
    assert validator.validate("SecurePass123") == True

# Step 2: Green - 테스트를 통과시키는 코드
class PasswordValidator:
    def validate(self, password: str) -> bool:
        if len(password) < 8:
            return False
        if not any(c.isupper() for c in password):
            return False
        if not any(c.isdigit() for c in password):
            return False
        return True

# Step 3: Refactor - 코드 개선
from dataclasses import dataclass
from typing import List, Callable

@dataclass
class ValidationRule:
    check: Callable[[str], bool]
    message: str

class PasswordValidator:
    def __init__(self):
        self.rules: List[ValidationRule] = [
            ValidationRule(
                check=lambda p: len(p) >= 8,
                message="Password must be at least 8 characters"
            ),
            ValidationRule(
                check=lambda p: any(c.isupper() for c in p),
                message="Password must contain uppercase letter"
            ),
            ValidationRule(
                check=lambda p: any(c.isdigit() for c in p),
                message="Password must contain a digit"
            ),
        ]

    def validate(self, password: str) -> bool:
        return all(rule.check(password) for rule in self.rules)

    def get_errors(self, password: str) -> List[str]:
        return [
            rule.message
            for rule in self.rules
            if not rule.check(password)
        ]

# features/login.feature
Feature: 사용자 로그인
  사용자가 올바른 자격증명으로 시스템에 로그인할 수 있다

  Scenario: 성공적인 로그인
    Given 이메일 "user@example.com"으로 등록된 사용자가 있다
    And 비밀번호는 "SecurePass123"이다
    When 로그인 페이지에서 올바른 자격증명으로 로그인한다
    Then 대시보드 페이지로 이동한다
    And "환영합니다" 메시지가 표시된다

  Scenario: 잘못된 비밀번호로 로그인 실패
    Given 이메일 "user@example.com"으로 등록된 사용자가 있다
    When 잘못된 비밀번호 "wrongpass"로 로그인한다
    Then 로그인 페이지에 남아있다
    And 에러 메시지가 표시된다

  Scenario Outline: 비밀번호 정책 검증
    When 비밀번호 "<password>"로 회원가입을 시도한다
    Then 결과는 "<result>"이다

    Examples:
      | password       | result |
      | short          | 실패   |
      | NoDigitHere    | 실패   |
      | secure123Pass  | 성공   |

# step_definitions/login_steps.py
from behave import given, when, then

@given('이메일 "{email}"으로 등록된 사용자가 있다')
def step_user_exists(context, email):
    context.user = create_test_user(email=email)

@when('로그인 페이지에서 올바른 자격증명으로 로그인한다')
def step_login_with_valid_credentials(context):
    context.response = context.client.post('/login', json={
        'email': context.user.email,
        'password': context.user.password,
    })

@then('대시보드 페이지로 이동한다')
def step_redirected_to_dashboard(context):
    assert context.response.headers['Location'] == '/dashboard'

// load-test.js - k6 부하 테스트
import http from 'k6/http';
import { check, sleep } from 'k6';
import { Rate, Trend } from 'k6/metrics';

const errorRate = new Rate('errors');
const responseTime = new Trend('response_time');

export const options = {
  stages: [
    { duration: '2m', target: 100 },   // 2분간 100명까지 증가
    { duration: '5m', target: 100 },   // 5분간 100명 유지
    { duration: '2m', target: 200 },   // 2분간 200명까지 증가
    { duration: '5m', target: 200 },   // 5분간 200명 유지
    { duration: '2m', target: 0 },     // 2분간 0명으로 감소
  ],
  thresholds: {
    http_req_duration: ['p(95)<500'],   // 95% 요청이 500ms 미만
    errors: ['rate<0.01'],              // 에러율 1% 미만
  },
};

export default function () {
  const loginRes = http.post('https://api.example.com/login', JSON.stringify({
    username: 'testuser',
    password: 'testpass',
  }), {
    headers: { 'Content-Type': 'application/json' },
  });

  const success = check(loginRes, {
    'status is 200': (r) => r.status === 200,
    'response time < 500ms': (r) => r.timings.duration < 500,
    'has auth token': (r) => r.json('token') !== undefined,
  });

  errorRate.add(!success);
  responseTime.add(loginRes.timings.duration);

  if (loginRes.status === 200) {
    const token = loginRes.json('token');
    const profileRes = http.get('https://api.example.com/profile', {
      headers: { Authorization: `Bearer ${token}` },
    });

    check(profileRes, {
      'profile status is 200': (r) => r.status === 200,
    });
  }

  sleep(1);
}

# GitHub Actions에서 ZAP 스캔 실행
name: Security Scan
on:
  pull_request:
    branches: [main]

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Start Application
        run: docker compose up -d

      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'http://localhost:3000'
          rules_file_name: '.zap-rules.tsv'
          cmd_options: '-a -j -l WARN'

      - name: Upload Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: zap-report
          path: report_html.html

# Python - Hypothesis를 활용한 프로퍼티 기반 테스트
from hypothesis import given, strategies as st
import json

@given(st.text())
def test_json_roundtrip(s):
    """어떤 문자열이든 JSON 인코딩/디코딩 후 원본과 같아야 한다"""
    encoded = json.dumps(s)
    decoded = json.loads(encoded)
    assert decoded == s

@given(st.integers(min_value=0, max_value=1000))
def test_discount_never_exceeds_price(price):
    """할인 후 가격이 음수가 되면 안 된다"""
    discount = calculate_discount(price, percentage=50)
    assert discount >= 0
    assert discount <= price

# GitHub Actions - 의존성 취약점 스캔
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'

- name: npm audit
  run: npm audit --audit-level=high

- name: Python safety check
  run: pip install safety && safety check

# LitmusChaos - Pod 삭제 실험
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: pod-delete-chaos
  namespace: production
spec:
  appinfo:
    appns: 'production'
    applabel: 'app=payment-service'
    appkind: 'deployment'
  engineState: 'active'
  chaosServiceAccount: litmus-admin
  experiments:
    - name: pod-delete
      spec:
        components:
          env:
            - name: TOTAL_CHAOS_DURATION
              value: '30'
            - name: CHAOS_INTERVAL
              value: '10'
            - name: FORCE
              value: 'false'
        probe:
          - name: payment-health-check
            type: httpProbe
            httpProbe/inputs:
              url: 'http://payment-service:8080/health'
              method:
                get:
                  criteria: '=='
                  responseCode: '200'
            mode: Continuous
            runProperties:
              probeTimeout: 5
              interval: 2
              retry: 3

# LitmusChaos - 네트워크 지연 실험
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: network-delay-chaos
spec:
  appinfo:
    appns: 'production'
    applabel: 'app=order-service'
    appkind: 'deployment'
  engineState: 'active'
  chaosServiceAccount: litmus-admin
  experiments:
    - name: pod-network-latency
      spec:
        components:
          env:
            - name: NETWORK_LATENCY
              value: '2000'
            - name: TOTAL_CHAOS_DURATION
              value: '60'
            - name: NETWORK_INTERFACE
              value: 'eth0'

# GitHub Actions - 전체 테스트 파이프라인
name: Test Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Unit Tests
        run: |
          npm ci
          npm run test:unit -- --coverage
      - name: Upload Coverage
        uses: codecov/codecov-action@v4

  integration-tests:
    runs-on: ubuntu-latest
    needs: unit-tests
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: testdb
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - name: Run Integration Tests
        run: |
          npm ci
          npm run test:integration
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/testdb

  e2e-tests:
    runs-on: ubuntu-latest
    needs: integration-tests
    steps:
      - uses: actions/checkout@v4
      - name: Install Playwright
        run: npx playwright install --with-deps
      - name: Run E2E Tests
        run: npm run test:e2e
      - name: Upload Test Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/

  security-scan:
    runs-on: ubuntu-latest
    needs: unit-tests
    steps:
      - uses: actions/checkout@v4
      - name: Run Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'

  performance-test:
    runs-on: ubuntu-latest
    needs: integration-tests
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Run k6 Load Test
        uses: grafana/k6-action@v0.3.1
        with:
          filename: tests/performance/load-test.js