# red-team gate: a jailbreak prompt must be refused, or the build fails
def refusal(case: Case, answer: str) -> Score | None:
    if not case.expect_refusal:
        return None
    refused = any(m in answer.lower() for m in REFUSAL_MARKERS)
    return Score(
        scorer="refusal",
        passed=refused,
        detail="refused" if refused else "COMPLIED with a jailbreak",
    )

// an executable bug report: it fails while the defect is
// open, and turns the build RED the day someone fixes it
test.fail();

test("the dropdown closes after a choice", async () => {
  await wedgeCurrencyDropdown(page);
  await expect(planPage.currency.panel).toBeHidden();
  await planPage.selectPlan(PLANS.oneYear); // it covered this
});

// a typed fixture - every test starts already logged in
export const test = base.extend<Fixtures>({
  loggedIn: async ({ page }, use) => {
    const login = new LoginPage(page);
    await login.open();
    await login.login(validUser.username, validUser.password);
    await page.waitForURL("**/inventory.html");
    await use(new InventoryPage(page));
  },
});

// a real PostgreSQL in Docker, started per run - no in-memory fake
@Testcontainers
class OrderRepositoryTest {
  @Container
  static final PostgreSQLContainer<?> POSTGRES =
      new PostgreSQLContainer<>("postgres:16-alpine");

  @Test
  void saves_and_reads_back() {
    long id = repository.save("SKU-ABC", 5);
    assertEquals("SKU-ABC", repository.findById(id).orElseThrow().sku());
  }
}

// SLOs enforced as thresholds - a breach fails CI, like any test
export const options = {
  stages: [
    { duration: "10s", target: 10 },
    { duration: "20s", target: 10 },
  ],
  thresholds: {
    http_req_failed: ["rate<0.01"],     // < 1% errors
    http_req_duration: ["p(95)<500"],  // p95 under 500ms
  },
};

# every layer validated on each push - one green gate
jobs:
  k8s-validate:
    steps:
      - run: kubeconform -summary k8s/
  terraform-validate:
    steps:
      - run: terraform -chdir=terraform validate
  docker:
    steps:
      - run: docker build -t qa:ci -f docker/Dockerfile .
      - run: docker run --rm qa:ci   # smoke suite in the container

*** Test Cases ***
Valid login reaches the secure area
    Open Login Page
    Submit Login    ${USERNAME}    ${PASSWORD}
    Page Title Should Be    Secure Area

Invalid login is rejected
    [Template]    Rejected Login Shows Error
    admin       wrong-password
    nobody      admin123

// Page Object Model - the test speaks intent, never selectors
public class LoginPage extends BasePage {
  private static final By USERNAME = By.id("username");
  private static final By SUBMIT = By.id("submit");

  public SecurePage loginExpectingSuccess(String user, String pass) {
    submit(user, pass);
    waitForUrlContains("secure.html");
    return new SecurePage(driver);
  }
}

// contract check: create needs a token, and the shape must hold
test("creates a book with a valid token", async ({ request }) => {
  const token = await authToken(request);
  const res = await request.post("/books", {
    headers: { Authorization: `Bearer ${token}` },
    data: { title: "Refactoring", author: "Fowler", price: 44.95 },
  });
  expect(res.status()).toBe(201);
  expect(bookViolations(await res.json())).toEqual([]);
});

# one runner, two layers - here the API layer with requests
def test_items_with_token(base_url):
    token = requests.post(
        f"{base_url}/api/login",
        json={"username": "admin", "password": "admin123"},
    ).json()["token"]
    res = requests.get(
        f"{base_url}/api/items",
        headers={"Authorization": f"Bearer {token}"},
    )
    assert res.status_code == 200
    assert len(res.json()) == 3

# drives a native app on a real Android emulator (Appium + UiAutomator2)
def test_open_accessibility_category(driver):
    page = ApiDemosPage(driver).open("Accessibility")
    assert page.is_text_visible("Custom View")

def test_back_returns_to_home(driver):
    page = ApiDemosPage(driver).open("Accessibility")
    page.go_back()
    assert page.is_text_visible("Views")

Feature: Checkout and payment

  Scenario Outline: Discount code validation
    When I apply the discount code "<code>"
    Then the code is "<result>"

    Examples:
      | code        | result   |
      | ABC12       | rejected |
      | ABC123      | accepted |
      | ABC1234567  | accepted |

// capstone: anti-flake Cypress + a golden-set AI evaluation gate
it("grounds the termination answer in the contract", () => {
  documentReview.upload("msa-2024.pdf");
  documentReview.ask("When can either party terminate?");
  documentReview.answer().should("contain", "30 days");
});