ソフトウェアテスト戦略完全ガイド — ユニットテストからカオスエンジニアリングまで

        /  E2E   \          ~10%  遅いがユーザー視点の検証
       /  統合    \         ~20%  コンポーネント間の相互作用を検証
      / ユニット   \       ~70%  高速で分離された単位の検証

      \      E2E      /    ~70%  遅くて不安定
       \    統合     /     ~20%
        \ ユニット /       ~10%  ほぼ不在

# Python - pytest + unittest.mock
from unittest.mock import Mock, patch
import pytest

class PaymentService:
    def __init__(self, gateway):
        self.gateway = gateway

    def charge(self, amount, card_token):
        if amount <= 0:
            raise ValueError("Amount must be positive")
        return self.gateway.process_payment(amount, card_token)

class TestPaymentService:
    def test_charge_positive_amount(self):
        # Arrange
        mock_gateway = Mock()
        mock_gateway.process_payment.return_value = "txn_123"
        service = PaymentService(mock_gateway)

        # Act
        result = service.charge(100, "card_abc")

        # Assert
        assert result == "txn_123"
        mock_gateway.process_payment.assert_called_once_with(100, "card_abc")

    def test_charge_negative_amount_raises(self):
        mock_gateway = Mock()
        service = PaymentService(mock_gateway)

        with pytest.raises(ValueError, match="Amount must be positive"):
            service.charge(-50, "card_abc")

        mock_gateway.process_payment.assert_not_called()

// JavaScript - Jest
describe('PaymentService', () => {
  it('should charge positive amount', async () => {
    const mockGateway = {
      processPayment: jest.fn().mockResolvedValue('txn_123'),
    };
    const service = new PaymentService(mockGateway);

    const result = await service.charge(100, 'card_abc');

    expect(result).toBe('txn_123');
    expect(mockGateway.processPayment).toHaveBeenCalledWith(100, 'card_abc');
  });

  it('should reject negative amount', async () => {
    const mockGateway = { processPayment: jest.fn() };
    const service = new PaymentService(mockGateway);

    await expect(service.charge(-50, 'card_abc'))
      .rejects.toThrow('Amount must be positive');
    expect(mockGateway.processPayment).not.toHaveBeenCalled();
  });
});

# Python - FastAPI + pytest + httpx
import pytest
from httpx import AsyncClient, ASGITransport
from app.main import app

@pytest.mark.asyncio
async def test_create_user():
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as client:
        response = await client.post("/users", json={
            "name": "Alice",
            "email": "alice@example.com"
        })

    assert response.status_code == 201
    data = response.json()
    assert data["name"] == "Alice"
    assert "id" in data

@pytest.mark.asyncio
async def test_create_user_duplicate_email():
    transport = ASGITransport(app=app)
    async with AsyncClient(transport=transport, base_url="http://test") as client:
        await client.post("/users", json={
            "name": "Alice",
            "email": "alice@example.com"
        })
        response = await client.post("/users", json={
            "name": "Bob",
            "email": "alice@example.com"
        })

    assert response.status_code == 409

// Java - Testcontainers + JUnit 5
@Testcontainers
@SpringBootTest
class UserRepositoryIntegrationTest {

    @Container
    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16")
        .withDatabaseName("testdb")
        .withUsername("test")
        .withPassword("test");

    @DynamicPropertySource
    static void configureProperties(DynamicPropertyRegistry registry) {
        registry.add("spring.datasource.url", postgres::getJdbcUrl);
        registry.add("spring.datasource.username", postgres::getUsername);
        registry.add("spring.datasource.password", postgres::getPassword);
    }

    @Autowired
    private UserRepository userRepository;

    @Test
    void shouldSaveAndFindUser() {
        User user = new User("Alice", "alice@example.com");
        userRepository.save(user);

        Optional<User> found = userRepository.findByEmail("alice@example.com");

        assertThat(found).isPresent();
        assertThat(found.get().getName()).isEqualTo("Alice");
    }

    @Test
    void shouldReturnEmptyForNonExistentUser() {
        Optional<User> found = userRepository.findByEmail("nobody@example.com");
        assertThat(found).isEmpty();
    }
}

# Python - testcontainers
from testcontainers.postgres import PostgresContainer
import psycopg2

def test_user_crud():
    with PostgresContainer("postgres:16") as postgres:
        conn = psycopg2.connect(
            host=postgres.get_container_host_ip(),
            port=postgres.get_exposed_port(5432),
            user=postgres.username,
            password=postgres.password,
            dbname=postgres.dbname,
        )
        cursor = conn.cursor()

        cursor.execute("""
            CREATE TABLE users (
                id SERIAL PRIMARY KEY,
                name VARCHAR(100),
                email VARCHAR(100) UNIQUE
            )
        """)
        cursor.execute(
            "INSERT INTO users (name, email) VALUES (%s, %s) RETURNING id",
            ("Alice", "alice@example.com")
        )
        user_id = cursor.fetchone()[0]

        cursor.execute("SELECT name FROM users WHERE id = %s", (user_id,))
        assert cursor.fetchone()[0] == "Alice"

        conn.commit()
        conn.close()

// Playwright テスト例
import { test, expect } from '@playwright/test';

test.describe('ユーザーログインフロー', () => {
  test('有効な認証情報でログイン', async ({ page }) => {
    await page.goto('/login');

    await page.getByLabel('メールアドレス').fill('user@example.com');
    await page.getByLabel('パスワード').fill('SecurePass123');
    await page.getByRole('button', { name: 'ログイン' }).click();

    await expect(page).toHaveURL('/dashboard');
    await expect(page.getByText('ようこそ')).toBeVisible();
  });

  test('不正なパスワードでログイン失敗', async ({ page }) => {
    await page.goto('/login');

    await page.getByLabel('メールアドレス').fill('user@example.com');
    await page.getByLabel('パスワード').fill('wrong');
    await page.getByRole('button', { name: 'ログイン' }).click();

    await expect(page.getByText('メールアドレスまたはパスワードが正しくありません')).toBeVisible();
    await expect(page).toHaveURL('/login');
  });
});

// Cypress テスト例
describe('ショッピングカート機能', () => {
  beforeEach(() => {
    cy.visit('/products');
  });

  it('商品をカートに追加', () => {
    cy.get('[data-testid="product-card"]').first().within(() => {
      cy.get('[data-testid="add-to-cart"]').click();
    });

    cy.get('[data-testid="cart-badge"]').should('have.text', '1');
    cy.get('[data-testid="cart-icon"]').click();
    cy.get('[data-testid="cart-item"]').should('have.length', 1);
  });

  it('カート内で数量変更', () => {
    cy.get('[data-testid="product-card"]').first()
      .find('[data-testid="add-to-cart"]').click();
    cy.get('[data-testid="cart-icon"]').click();

    cy.get('[data-testid="quantity-increase"]').click();
    cy.get('[data-testid="quantity-input"]').should('have.value', '2');
  });
});

// Playwright - フレイキーテスト防止パターン
test('データロード後にリストを表示', async ({ page }) => {
  await page.goto('/users');

  // 悪い例：固定時間の待機
  // await page.waitForTimeout(3000);

  // 良い例：特定の要素が表示されるまで待機
  await page.waitForSelector('[data-testid="user-list"]');
  const users = page.getByTestId('user-item');
  await expect(users).toHaveCount(10);
});

# Step 1: Red - 失敗するテストを書く
def test_password_minimum_length():
    validator = PasswordValidator()
    assert validator.validate("short") == False

def test_password_requires_uppercase():
    validator = PasswordValidator()
    assert validator.validate("longpassword1") == False

def test_password_requires_number():
    validator = PasswordValidator()
    assert validator.validate("LongPassword") == False

def test_valid_password():
    validator = PasswordValidator()
    assert validator.validate("SecurePass123") == True

# Step 2: Green - テストをパスさせるコード
class PasswordValidator:
    def validate(self, password: str) -> bool:
        if len(password) < 8:
            return False
        if not any(c.isupper() for c in password):
            return False
        if not any(c.isdigit() for c in password):
            return False
        return True

# Step 3: Refactor - コード改善
from dataclasses import dataclass
from typing import List, Callable

@dataclass
class ValidationRule:
    check: Callable[[str], bool]
    message: str

class PasswordValidator:
    def __init__(self):
        self.rules: List[ValidationRule] = [
            ValidationRule(
                check=lambda p: len(p) >= 8,
                message="Password must be at least 8 characters"
            ),
            ValidationRule(
                check=lambda p: any(c.isupper() for c in p),
                message="Password must contain uppercase letter"
            ),
            ValidationRule(
                check=lambda p: any(c.isdigit() for c in p),
                message="Password must contain a digit"
            ),
        ]

    def validate(self, password: str) -> bool:
        return all(rule.check(password) for rule in self.rules)

    def get_errors(self, password: str) -> List[str]:
        return [
            rule.message
            for rule in self.rules
            if not rule.check(password)
        ]

# features/login.feature
Feature: ユーザーログイン
  ユーザーが正しい認証情報でシステムにログインできる

  Scenario: 成功するログイン
    Given メールアドレス "user@example.com" で登録されたユーザーがいる
    And パスワードは "SecurePass123" である
    When ログインページで正しい認証情報でログインする
    Then ダッシュボードページに遷移する
    And 「ようこそ」メッセージが表示される

  Scenario: 不正なパスワードでのログイン失敗
    Given メールアドレス "user@example.com" で登録されたユーザーがいる
    When 不正なパスワード "wrongpass" でログインする
    Then ログインページに留まる
    And エラーメッセージが表示される

  Scenario Outline: パスワードポリシーの検証
    When パスワード "<password>" で会員登録を試みる
    Then 結果は "<result>" である

    Examples:
      | password       | result |
      | short          | 失敗   |
      | NoDigitHere    | 失敗   |
      | secure123Pass  | 成功   |

# step_definitions/login_steps.py
from behave import given, when, then

@given('メールアドレス "{email}" で登録されたユーザーがいる')
def step_user_exists(context, email):
    context.user = create_test_user(email=email)

@when('ログインページで正しい認証情報でログインする')
def step_login_with_valid_credentials(context):
    context.response = context.client.post('/login', json={
        'email': context.user.email,
        'password': context.user.password,
    })

@then('ダッシュボードページに遷移する')
def step_redirected_to_dashboard(context):
    assert context.response.headers['Location'] == '/dashboard'

// load-test.js - k6 負荷テスト
import http from 'k6/http';
import { check, sleep } from 'k6';
import { Rate, Trend } from 'k6/metrics';

const errorRate = new Rate('errors');
const responseTime = new Trend('response_time');

export const options = {
  stages: [
    { duration: '2m', target: 100 },   // 2分で100ユーザーまで増加
    { duration: '5m', target: 100 },   // 5分間100ユーザーを維持
    { duration: '2m', target: 200 },   // 2分で200ユーザーまで増加
    { duration: '5m', target: 200 },   // 5分間200ユーザーを維持
    { duration: '2m', target: 0 },     // 2分で0ユーザーまで減少
  ],
  thresholds: {
    http_req_duration: ['p(95)<500'],   // 95%のリクエストが500ms未満
    errors: ['rate<0.01'],              // エラー率1%未満
  },
};

export default function () {
  const loginRes = http.post('https://api.example.com/login', JSON.stringify({
    username: 'testuser',
    password: 'testpass',
  }), {
    headers: { 'Content-Type': 'application/json' },
  });

  const success = check(loginRes, {
    'status is 200': (r) => r.status === 200,
    'response time < 500ms': (r) => r.timings.duration < 500,
    'has auth token': (r) => r.json('token') !== undefined,
  });

  errorRate.add(!success);
  responseTime.add(loginRes.timings.duration);

  if (loginRes.status === 200) {
    const token = loginRes.json('token');
    const profileRes = http.get('https://api.example.com/profile', {
      headers: { Authorization: `Bearer ${token}` },
    });

    check(profileRes, {
      'profile status is 200': (r) => r.status === 200,
    });
  }

  sleep(1);
}

# GitHub ActionsでZAPスキャンを実行
name: Security Scan
on:
  pull_request:
    branches: [main]

jobs:
  zap-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Start Application
        run: docker compose up -d

      - name: ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.12.0
        with:
          target: 'http://localhost:3000'
          rules_file_name: '.zap-rules.tsv'
          cmd_options: '-a -j -l WARN'

      - name: Upload Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: zap-report
          path: report_html.html

# Python - Hypothesisを活用したプロパティベーステスト
from hypothesis import given, strategies as st
import json

@given(st.text())
def test_json_roundtrip(s):
    """どんな文字列でもJSONエンコード/デコード後に元の値と一致すべき"""
    encoded = json.dumps(s)
    decoded = json.loads(encoded)
    assert decoded == s

@given(st.integers(min_value=0, max_value=1000))
def test_discount_never_exceeds_price(price):
    """割引後の価格がマイナスになってはならない"""
    discount = calculate_discount(price, percentage=50)
    assert discount >= 0
    assert discount <= price

# GitHub Actions - 依存関係脆弱性スキャン
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    format: 'sarif'
    output: 'trivy-results.sarif'
    severity: 'CRITICAL,HIGH'

- name: npm audit
  run: npm audit --audit-level=high

- name: Python safety check
  run: pip install safety && safety check

# LitmusChaos - Pod削除実験
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: pod-delete-chaos
  namespace: production
spec:
  appinfo:
    appns: 'production'
    applabel: 'app=payment-service'
    appkind: 'deployment'
  engineState: 'active'
  chaosServiceAccount: litmus-admin
  experiments:
    - name: pod-delete
      spec:
        components:
          env:
            - name: TOTAL_CHAOS_DURATION
              value: '30'
            - name: CHAOS_INTERVAL
              value: '10'
            - name: FORCE
              value: 'false'
        probe:
          - name: payment-health-check
            type: httpProbe
            httpProbe/inputs:
              url: 'http://payment-service:8080/health'
              method:
                get:
                  criteria: '=='
                  responseCode: '200'
            mode: Continuous
            runProperties:
              probeTimeout: 5
              interval: 2
              retry: 3

# LitmusChaos - ネットワーク遅延実験
apiVersion: litmuschaos.io/v1alpha1
kind: ChaosEngine
metadata:
  name: network-delay-chaos
spec:
  appinfo:
    appns: 'production'
    applabel: 'app=order-service'
    appkind: 'deployment'
  engineState: 'active'
  chaosServiceAccount: litmus-admin
  experiments:
    - name: pod-network-latency
      spec:
        components:
          env:
            - name: NETWORK_LATENCY
              value: '2000'
            - name: TOTAL_CHAOS_DURATION
              value: '60'
            - name: NETWORK_INTERFACE
              value: 'eth0'

# GitHub Actions - 全体テストパイプライン
name: Test Pipeline
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Unit Tests
        run: |
          npm ci
          npm run test:unit -- --coverage
      - name: Upload Coverage
        uses: codecov/codecov-action@v4

  integration-tests:
    runs-on: ubuntu-latest
    needs: unit-tests
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_DB: testdb
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - name: Run Integration Tests
        run: |
          npm ci
          npm run test:integration
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/testdb

  e2e-tests:
    runs-on: ubuntu-latest
    needs: integration-tests
    steps:
      - uses: actions/checkout@v4
      - name: Install Playwright
        run: npx playwright install --with-deps
      - name: Run E2E Tests
        run: npm run test:e2e
      - name: Upload Test Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/

  security-scan:
    runs-on: ubuntu-latest
    needs: unit-tests
    steps:
      - uses: actions/checkout@v4
      - name: Run Security Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          severity: 'CRITICAL,HIGH'

  performance-test:
    runs-on: ubuntu-latest
    needs: integration-tests
    if: github.ref == 'refs/heads/main'
    steps:
      - uses: actions/checkout@v4
      - name: Run k6 Load Test
        uses: grafana/k6-action@v0.3.1
        with:
          filename: tests/performance/load-test.js