CI/CD 测试门禁

<!-- pom.xml：jacoco-maven-plugin 的 check 目标 -->
<execution>
  <id>check</id>
  <goals><goal>check</goal></goals>
  <configuration>
    <rules>
      <rule>
        <element>BUNDLE</element>
        <limits>
          <limit>
            <counter>BRANCH</counter>
            <value>COVEREDRATIO</value>
            <minimum>0.80</minimum>  <!-- 分支覆盖率不低于 80% -->
          </limit>
        </limits>
      </rule>
    </rules>
  </configuration>
</execution>

// vitest.config.ts
export default {
  test: {
    coverage: {
      provider: 'v8',              // 默认 v8，精确度经 AST 重映射后与 Istanbul 相当
      include: ['src/**'],
      thresholds: {
        branches: 80,
        functions: 80,
        lines: 80,
        statements: 80,
      },
    },
  },
};

# GitHub Actions 片段（示意）
- run: mvn verify sonar:sonar -Dsonar.projectKey=demo
- run: |
    # 轮询 Quality Gate Status，非 OK 则退出非零，阻断合并
    bash ci/wait_for_quality_gate.sh

// 被测代码：折扣计算
public BigDecimal discount(int quantity) {
    return quantity >= 10 ? new BigDecimal("0.9") : BigDecimal.ONE;
}

// 「完美」测试：行覆盖 100%，但它对折扣金额一个数字都没断言
@Test
void discountTest() {
    service.discount(15);    // 覆盖了 true 分支
    service.discount(5);     // 覆盖了 false 分支
}

<plugin>
  <groupId>org.pitest</groupId>
  <artifactId>pitest-maven</artifactId>
  <version>1.16.1</version>
  <configuration>
    <targetClasses>
      <param>com.example.pricing.*</param>   <!-- 只变异核心计价逻辑 -->
    </targetClasses>
    <targetTests>
      <param>com.example.pricing.**</param>
    </targetTests>
    <mutationThreshold>70</mutationThreshold>  <!-- 低于 70% 构建失败 -->
    <excludedTestClasses>
      <param>*IT</param>                       <!-- 集成测试太慢，不参与变异判定 -->
    </excludedTestClasses>
  </configuration>
</plugin>

mvn org.pitest:pitest-maven:mutationCoverage   # 产出 HTML 报告：每个存活 mutant 标在源码上

{
  "packageManager": "npm",
  "testRunner": "vitest",
  "mutate": ["src/pricing/**/*.ts"],      // 同理：只变异核心逻辑
  "coverageAnalysis": "perTest",          // 只跑覆盖到该 mutant 的测试，提速数倍
  "thresholds": { "high": 80, "low": 60, "break": 55 },
  "concurrency": 4,
  "timeoutMS": 5000
}

代码提交 → 代码扫描 → 单元测试 → 构建打包 → 集成测试 → 部署测试环境 → E2E测试 → 报告

# .github/workflows/test.yml
name: Test Pipeline

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  unit-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.12'
      - name: Install dependencies
        run: pip install -r requirements.txt
      - name: Run unit tests
        run: pytest tests/unit/ -v --cov=src --cov-report=xml
      - name: Upload coverage
        uses: codecov/codecov-action@v4
        with:
          file: coverage.xml

  integration-test:
    needs: unit-test
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: test
        ports:
          - 5432:5432
    steps:
      - uses: actions/checkout@v4
      - name: Run integration tests
        run: pytest tests/integration/ -v
        env:
          DATABASE_URL: postgresql://postgres:test@localhost:5432/testdb

  api-test:
    needs: integration-test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Start API server
        run: |
          docker-compose up -d api
          sleep 10
      - name: Run API tests
        run: newman run postman_collection.json -e test_environment.json

  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
      - name: Run Bandit (Python SAST)
        run: |
          pip install bandit
          bandit -r src/ -f json -o bandit-report.json

// Jenkinsfile
pipeline {
    agent any

    stages {
        stage('代码扫描') {
            steps {
                sh 'sonar-scanner -Dsonar.projectKey=myapp'
            }
        }

        stage('单元测试') {
            steps {
                sh 'pytest tests/unit/ --junitxml=unit-results.xml'
            }
            post {
                always {
                    junit 'unit-results.xml'
                }
            }
        }

        stage('构建') {
            steps {
                sh 'docker build -t myapp:test .'
            }
        }

        stage('集成测试') {
            steps {
                sh 'docker-compose -f docker-compose.test.yml up -d'
                sh 'pytest tests/integration/ --junitxml=integration-results.xml'
            }
            post {
                always {
                    sh 'docker-compose -f docker-compose.test.yml down'
                    junit 'integration-results.xml'
                }
            }
        }

        stage('性能测试') {
            steps {
                sh 'jmeter -n -t perf_test.jmx -l results.jtl'
                publishHTML(target: [
                    reportDir: 'report',
                    reportFiles: 'index.html',
                    reportName: 'Performance Report'
                ])
            }
        }
    }

    post {
        always {
            emailext(
                subject: "构建 ${currentBuild.result}: ${env.JOB_NAME} #${env.BUILD_NUMBER}",
                body: "测试报告: ${env.BUILD_URL}",
                to: 'team@example.com'
            )
        }
    }
}

# 质量门禁配置示例
quality_gates:
  code_review:
    required_approvals: 2
    must_include_test: true

  unit_test:
    coverage_minimum: 80%
    all_tests_pass: true

  integration_test:
    critical_paths_pass: true
    error_rate_below: 0.1%

  security:
    no_critical_vulnerabilities: true
    no_high_vulnerabilities: true

  performance:
    p95_response_time_below: 500ms
    tps_above: 1000

  deployment:
    canary_success_rate_above: 99.5%
    rollback_on_failure: true

# .github/workflows/ci.yml 最小门禁
name: CI
on: [push, pull_request]

jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install -r requirements.txt
      - run: ruff check src/           # 第 1 道门禁：静态检查，秒级
      - run: pytest tests/ -q          # 第 2 道门禁：单元测试
      # 两步任一非零退出码，job 失败，PR 无法合并（分支保护里设 require status checks）