@cubis/foundry 0.3.64 → 0.3.65

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/terraform-engineer/references/testing.md

@@ -0,0 +1,486 @@
+# Terraform Testing Strategies
+
+## Terraform Plan Validation
+
+**Basic Plan Workflow**
+```bash
+# Initialize and validate syntax
+terraform init
+terraform fmt -check
+terraform validate
+
+# Plan with output
+terraform plan -out=tfplan
+
+# Show plan in JSON for automated review
+terraform show -json tfplan | jq .
+
+# Apply specific plan
+terraform apply tfplan
+```
+
+**Plan with Variable Files**
+```bash
+# Plan with specific tfvars
+terraform plan -var-file="production.tfvars"
+
+# Plan with inline variables
+terraform plan -var="instance_count=5"
+
+# Plan with multiple var files
+terraform plan \
+  -var-file="common.tfvars" \
+  -var-file="production.tfvars"
+```
+
+**Plan Analysis**
+```bash
+# Resource targeting for specific resources
+terraform plan -target=aws_vpc.main
+
+# Refresh only (check drift)
+terraform plan -refresh-only
+
+# Destroy plan
+terraform plan -destroy
+
+# Save plan output
+terraform plan -out=tfplan 2>&1 | tee plan-output.txt
+```
+
+## Terraform Test (1.6+)
+
+**Test File Structure**
+```
+tests/
+├── unit/
+│   ├── vpc_test.tftest.hcl
+│   └── security_group_test.tftest.hcl
+└── integration/
+    └── complete_test.tftest.hcl
+```
+
+**Basic Test**
+```hcl
+# tests/vpc_test.tftest.hcl
+run "validate_vpc_cidr" {
+  command = plan
+
+  variables {
+    cidr_block = "10.0.0.0/16"
+    name       = "test-vpc"
+  }
+
+  assert {
+    condition     = aws_vpc.main.cidr_block == "10.0.0.0/16"
+    error_message = "VPC CIDR block did not match expected value"
+  }
+
+  assert {
+    condition     = aws_vpc.main.enable_dns_hostnames == true
+    error_message = "DNS hostnames should be enabled"
+  }
+}
+
+run "validate_tags" {
+  command = plan
+
+  variables {
+    cidr_block = "10.0.0.0/16"
+    name       = "test-vpc"
+    tags = {
+      Environment = "test"
+    }
+  }
+
+  assert {
+    condition     = aws_vpc.main.tags["Environment"] == "test"
+    error_message = "Environment tag not set correctly"
+  }
+}
+```
+
+**Integration Test**
+```hcl
+# tests/integration/complete_test.tftest.hcl
+run "create_full_stack" {
+  command = apply
+
+  variables {
+    cidr_block = "10.0.0.0/16"
+    name       = "integration-test"
+
+    private_subnets = {
+      app = { cidr_block = "10.0.1.0/24", az = "us-east-1a" }
+    }
+  }
+
+  assert {
+    condition     = length(aws_subnet.private) == 1
+    error_message = "Should create exactly one private subnet"
+  }
+
+  assert {
+    condition     = output.vpc_id != ""
+    error_message = "VPC ID should not be empty"
+  }
+}
+```
+
+**Run Tests**
+```bash
+# Run all tests
+terraform test
+
+# Run specific test file
+terraform test tests/vpc_test.tftest.hcl
+
+# Verbose output
+terraform test -verbose
+
+# Keep test resources (for debugging)
+terraform test -no-cleanup
+```
+
+## Terratest (Go-based Testing)
+
+**Test Structure**
+```
+tests/
+├── go.mod
+├── go.sum
+└── vpc_test.go
+```
+
+**go.mod**
+```go
+module github.com/example/terraform-modules/tests
+
+go 1.21
+
+require (
+    github.com/gruntwork-io/terratest v0.45.0
+    github.com/stretchr/testify v1.8.4
+)
+```
+
+**Basic Terratest**
+```go
+// tests/vpc_test.go
+package test
+
+import (
+    "testing"
+
+    "github.com/gruntwork-io/terratest/modules/terraform"
+    "github.com/stretchr/testify/assert"
+)
+
+func TestVPCCreation(t *testing.T) {
+    t.Parallel()
+
+    terraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
+        TerraformDir: "../examples/complete",
+
+        Vars: map[string]interface{}{
+            "name":       "test-vpc",
+            "cidr_block": "10.0.0.0/16",
+        },
+
+        EnvVars: map[string]string{
+            "AWS_DEFAULT_REGION": "us-east-1",
+        },
+    })
+
+    defer terraform.Destroy(t, terraformOptions)
+
+    terraform.InitAndApply(t, terraformOptions)
+
+    vpcID := terraform.Output(t, terraformOptions, "vpc_id")
+    assert.NotEmpty(t, vpcID)
+
+    vpcCIDR := terraform.Output(t, terraformOptions, "vpc_cidr_block")
+    assert.Equal(t, "10.0.0.0/16", vpcCIDR)
+}
+```
+
+**Advanced Terratest with AWS SDK**
+```go
+package test
+
+import (
+    "testing"
+
+    "github.com/aws/aws-sdk-go/aws"
+    "github.com/aws/aws-sdk-go/service/ec2"
+    "github.com/gruntwork-io/terratest/modules/terraform"
+    aws_helper "github.com/gruntwork-io/terratest/modules/aws"
+    "github.com/stretchr/testify/assert"
+)
+
+func TestVPCConfiguration(t *testing.T) {
+    t.Parallel()
+
+    awsRegion := "us-east-1"
+
+    terraformOptions := &terraform.Options{
+        TerraformDir: "../examples/complete",
+        Vars: map[string]interface{}{
+            "name":       "test-vpc",
+            "cidr_block": "10.0.0.0/16",
+        },
+    }
+
+    defer terraform.Destroy(t, terraformOptions)
+    terraform.InitAndApply(t, terraformOptions)
+
+    vpcID := terraform.Output(t, terraformOptions, "vpc_id")
+
+    // Verify VPC configuration using AWS SDK
+    vpc := aws_helper.GetVpcById(t, vpcID, awsRegion)
+    assert.Equal(t, "10.0.0.0/16", *vpc.CidrBlock)
+    assert.True(t, *vpc.EnableDnsSupport)
+    assert.True(t, *vpc.EnableDnsHostnames)
+
+    // Verify tags
+    tags := convertEC2TagsToMap(vpc.Tags)
+    assert.Equal(t, "test-vpc", tags["Name"])
+}
+
+func convertEC2TagsToMap(tags []*ec2.Tag) map[string]string {
+    result := make(map[string]string)
+    for _, tag := range tags {
+        result[*tag.Key] = *tag.Value
+    }
+    return result
+}
+```
+
+**Run Terratest**
+```bash
+cd tests
+go mod download
+go test -v -timeout 30m
+```
+
+## Policy as Code - OPA/Sentinel
+
+**Open Policy Agent (OPA)**
+
+**policy.rego**
+```rego
+package terraform.analysis
+
+import input as tfplan
+
+# Deny if resources are not tagged
+deny[msg] {
+    r := tfplan.resource_changes[_]
+    r.change.actions[_] == "create"
+    not r.change.after.tags.Environment
+    msg := sprintf("Resource %s is missing Environment tag", [r.address])
+}
+
+# Require encryption for S3 buckets
+deny[msg] {
+    r := tfplan.resource_changes[_]
+    r.type == "aws_s3_bucket"
+    r.change.actions[_] == "create"
+    not r.change.after.server_side_encryption_configuration
+    msg := sprintf("S3 bucket %s must have encryption enabled", [r.address])
+}
+
+# Ensure VPC flow logs are enabled
+deny[msg] {
+    r := tfplan.resource_changes[_]
+    r.type == "aws_vpc"
+    r.change.actions[_] == "create"
+    vpc_id := r.change.after.id
+    not has_flow_log(vpc_id)
+    msg := sprintf("VPC %s must have flow logs enabled", [r.address])
+}
+
+has_flow_log(vpc_id) {
+    r := tfplan.resource_changes[_]
+    r.type == "aws_flow_log"
+    r.change.after.vpc_id == vpc_id
+}
+```
+
+**Run OPA Policy**
+```bash
+# Generate plan in JSON
+terraform plan -out=tfplan
+terraform show -json tfplan > tfplan.json
+
+# Run OPA policy check
+opa eval -i tfplan.json -d policy.rego "data.terraform.analysis.deny"
+```
+
+**Conftest (OPA wrapper for testing)**
+```bash
+# Install conftest
+brew install conftest
+
+# Test plan against policies
+conftest test tfplan.json
+
+# With specific namespace
+conftest test tfplan.json --namespace terraform.analysis
+```
+
+## TFLint
+
+**Installation and Configuration**
+```bash
+# Install tflint
+brew install tflint
+
+# Initialize tflint plugins
+tflint --init
+```
+
+**.tflint.hcl**
+```hcl
+plugin "terraform" {
+  enabled = true
+  preset  = "recommended"
+}
+
+plugin "aws" {
+  enabled = true
+  version = "0.27.0"
+  source  = "github.com/terraform-linters/tflint-ruleset-aws"
+}
+
+rule "terraform_naming_convention" {
+  enabled = true
+
+  format = "snake_case"
+}
+
+rule "terraform_required_version" {
+  enabled = true
+}
+
+rule "terraform_required_providers" {
+  enabled = true
+}
+
+rule "aws_instance_invalid_type" {
+  enabled = true
+}
+
+rule "aws_s3_bucket_encryption" {
+  enabled = true
+}
+```
+
+**Run TFLint**
+```bash
+# Run linter
+tflint
+
+# With specific config
+tflint --config=.tflint.hcl
+
+# Recursive (all subdirectories)
+tflint --recursive
+
+# Output format
+tflint --format=json
+```
+
+## Pre-commit Hooks
+
+**.pre-commit-config.yaml**
+```yaml
+repos:
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.83.6
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_validate
+      - id: terraform_tflint
+        args:
+          - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
+      - id: terraform_docs
+        args:
+          - --hook-config=--path-to-file=README.md
+          - --hook-config=--add-to-existing-file=true
+      - id: terraform_checkov
+        args:
+          - --args=--quiet
+          - --args=--skip-check CKV_AWS_*
+```
+
+**Setup**
+```bash
+# Install pre-commit
+pip install pre-commit
+
+# Install hooks
+pre-commit install
+
+# Run manually
+pre-commit run -a
+```
+
+## CI/CD Pipeline Testing
+
+**GitHub Actions Example**
+```yaml
+name: Terraform Test
+
+on: [pull_request]
+
+jobs:
+  terraform-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Setup Terraform
+        uses: hashicorp/setup-terraform@v2
+        with:
+          terraform_version: 1.6.0
+
+      - name: Terraform Format
+        run: terraform fmt -check -recursive
+
+      - name: Terraform Init
+        run: terraform init
+
+      - name: Terraform Validate
+        run: terraform validate
+
+      - name: TFLint
+        uses: terraform-linters/setup-tflint@v3
+        with:
+          tflint_version: latest
+
+      - name: Run TFLint
+        run: tflint --recursive
+
+      - name: Terraform Test
+        run: terraform test
+
+      - name: Checkov
+        uses: bridgecrewio/checkov-action@master
+        with:
+          directory: .
+          framework: terraform
+```
+
+## Best Practices
+
+- Run `terraform validate` before every commit
+- Use `terraform test` for unit and integration tests
+- Implement policy as code for security compliance
+- Run TFLint in CI/CD pipelines
+- Use pre-commit hooks for automated checks
+- Test modules with Terratest for critical infrastructure
+- Always review plan output before apply
+- Test provider upgrades in isolated environments
+- Document test scenarios and expected outcomes
+- Automate testing in pull request workflows

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/test-master/SKILL.md

@@ -0,0 +1,76 @@
+---
+name: "test-master"
+description: "Use when writing tests, creating test strategies, or building automation frameworks. Invoke for unit tests, integration tests, E2E, coverage analysis, performance testing, security testing."
+---
+
+
+# Test Master
+
+## Overview
+
+Comprehensive testing specialist ensuring software quality through functional, performance, and security testing.
+
+## Role Definition
+
+You are a senior QA engineer with 12+ years of testing experience. You think in three testing modes: **[Test]** for functional correctness, **[Perf]** for performance, **[Security]** for vulnerability testing. You ensure features work correctly, perform well, and are secure.
+
+## When to Use This Skill
+
+- Writing unit, integration, or E2E tests
+- Creating test strategies and plans
+- Analyzing test coverage and quality metrics
+- Building test automation frameworks
+- Performance testing and benchmarking
+- Security testing for vulnerabilities
+- Managing defects and test reporting
+- Debugging test failures
+- Manual testing (exploratory, usability, accessibility)
+- Scaling test automation and CI/CD integration
+
+## Core Workflow
+
+1. **Define scope** - Identify what to test and testing types needed
+2. **Create strategy** - Plan test approach using all three perspectives
+3. **Write tests** - Implement tests with proper assertions
+4. **Execute** - Run tests and collect results
+5. **Report** - Document findings with actionable recommendations
+
+## Available Steering Files
+
+Load detailed guidance on-demand:
+
+| Topic          | Reference                           | Load When                                                        |
+| -------------- | ----------------------------------- | ---------------------------------------------------------------- |
+| Unit Testing   | `references/unit-testing.md`          | Jest, Vitest, pytest patterns                                    |
+| Integration    | `references/integration-testing.md`   | API testing, Supertest                                           |
+| E2E            | `references/e2e-testing.md`           | E2E strategy, user flows                                         |
+| Performance    | `references/performance-testing.md`   | k6, load testing                                                 |
+| Security       | `references/security-testing.md`      | Security test checklist                                          |
+| Reports        | `references/test-reports.md`          | Report templates, findings                                       |
+| QA Methodology | `references/qa-methodology.md`        | Manual testing, quality advocacy, shift-left, continuous testing |
+| Automation     | `references/automation-frameworks.md` | Framework patterns, scaling, maintenance, team enablement        |
+
+<!-- Rows below adapted from obra/superpowers by Jesse Vincent (@obra), MIT License -->
+
+| TDD Iron Laws | `references/tdd-iron-laws.md` | TDD methodology, test-first development, red-green-refactor |
+| Testing Anti-Patterns | `references/testing-anti-patterns.md` | Test review, mock issues, test quality problems |
+
+## Constraints
+
+**MUST DO**: Test happy paths AND error cases, mock external dependencies, use meaningful descriptions, assert specific outcomes, test edge cases, run in CI/CD, document coverage gaps
+
+**MUST NOT**: Skip error testing, use production data, create order-dependent tests, ignore flaky tests, test implementation details, leave debug code
+
+## Output Templates
+
+When creating test plans, provide:
+
+1. Test scope and approach
+2. Test cases with expected outcomes
+3. Coverage analysis
+4. Findings with severity (Critical/High/Medium/Low)
+5. Specific fix recommendations
+
+## Knowledge Reference
+
+Jest, Vitest, pytest, React Testing Library, Supertest, Playwright, Cypress, k6, Artillery, OWASP testing, code coverage, mocking, fixtures, test automation frameworks, CI/CD integration, quality metrics, defect management, BDD, page object model, screenplay pattern, exploratory testing, accessibility (WCAG), usability testing, shift-left testing, quality gates