qa360 2.1.7 → 2.2.0

package/examples/pack-v2-examples.md

@@ -0,0 +1,244 @@
+# Pack v2 Examples
+
+This directory contains example Pack v2 configurations for various testing scenarios.
+
+## Examples
+
+| File | Description | Complexity |
+|------|-------------|------------|
+| `pack-v2-quickstart.yml` | Minimal API testing example | Beginner |
+| `pack-v2-complete.yml` | Full-featured example with all options | Advanced |
+| `pack-v2-ui-login.yml` | UI testing with login authentication | Intermediate |
+
+## Quick Start
+
+1. **Copy the quickstart example:**
+   ```bash
+   cp pack-v2-quickstart.yml my-pack.yml
+   ```
+
+2. **Edit the configuration:**
+   ```yaml
+   auth:
+     api: my-bearer-token
+     profiles:
+       my-bearer-token:
+         type: bearer
+         config:
+           token: "your-actual-token"
+
+   gates:
+     health:
+       adapter: playwright-api
+       enabled: true
+       config:
+         baseUrl: "https://your-api.com"
+         smoke:
+           - "GET /health -> 200"
+   ```
+
+3. **Run QA360:**
+   ```bash
+   qa360 run my-pack.yml
+   ```
+
+## Features Demonstrated
+
+### Authentication (`pack-v2-complete.yml`)
+
+Pack v2 supports multiple authentication types:
+
+- `bearer` - Bearer token authentication
+- `api_key` - API key in header or query
+- `basic` - HTTP Basic authentication
+- `ui_login` - UI-based login for E2E tests
+- `jwt` - JWT token authentication
+- `oauth2` - OAuth2 flow
+- `totp` - Time-based one-time password
+
+Example:
+```yaml
+auth:
+  api: my-bearer-token
+  profiles:
+    my-bearer-token:
+      type: bearer
+      config:
+        token: "${API_TOKEN}"
+```
+
+### Gate Types
+
+#### API Tests (`playwright-api`)
+```yaml
+gates:
+  api:
+    adapter: playwright-api
+    config:
+      baseUrl: "https://api.example.com"
+      smoke:
+        - "GET /users -> 200"
+        - "POST /users -> 201"
+```
+
+#### UI Tests (`playwright-ui`)
+```yaml
+gates:
+  ui:
+    adapter: playwright-ui
+    config:
+      baseUrl: "https://example.com"
+      pages:
+        - url: /dashboard
+          expectedElements:
+            - ".header"
+```
+
+#### Performance Tests (`k6-perf`)
+```yaml
+gates:
+  perf:
+    adapter: k6-perf
+    config:
+      script: |
+        import http from 'k6/http';
+        export default function () {
+          http.get('https://api.example.com');
+        }
+```
+
+#### Security Tests (`semgrep-sast`)
+```yaml
+gates:
+  sast:
+    adapter: semgrep-sast
+    config:
+      rules:
+        - javascript.lang.security.audit.xss
+      paths:
+        - src/
+```
+
+### Hooks
+
+Setup and teardown commands:
+
+```yaml
+hooks:
+  beforeAll:
+    - type: wait_on
+      wait_for:
+        resource: "https://api.example.com/health"
+    - type: docker
+      compose:
+        command: up -d
+    - type: run
+      command: npm run setup
+
+  afterAll:
+    - type: docker
+      compose:
+        command: down -v
+```
+
+### Environment Variables
+
+Use `${VAR:-default}` syntax for environment variables:
+
+```yaml
+config:
+  baseUrl: "${API_URL:-https://api.example.com}"
+  token: "${API_TOKEN:-default-token}"
+```
+
+Run with:
+```bash
+API_URL=https://staging.api.com qa360 run my-pack.yml
+```
+
+## Migration from Pack v1
+
+### v1 Format
+```yaml
+version: 1
+name: my-tests
+gates:
+  - api_smoke
+targets:
+  api:
+    baseUrl: https://api.example.com
+    smoke:
+      - "GET /health -> 200"
+```
+
+### v2 Format (Equivalent)
+```yaml
+version: 2
+name: my-tests
+gates:
+  api_smoke:
+    adapter: playwright-api
+    enabled: true
+    config:
+      baseUrl: https://api.example.com
+      smoke:
+        - "GET /health -> 200"
+```
+
+## Advanced Features
+
+### Per-Gate Auth Override
+
+```yaml
+auth:
+  api: default-bearer
+  profiles:
+    default-bearer:
+      type: bearer
+      config:
+        token: "default-token"
+    admin-token:
+      type: bearer
+      config:
+        token: "admin-token"
+
+gates:
+  public-api:
+    adapter: playwright-api
+    # Uses default-bearer
+    config:
+      baseUrl: https://api.example.com
+
+  admin-api:
+    adapter: playwright-api
+    auth: admin-token  # Override
+    config:
+      baseUrl: https://api.example.com
+```
+
+### Budgets
+
+```yaml
+gates:
+  api:
+    adapter: playwright-api
+    config:
+      budgets:
+        p95_ms: 1000      # P95 latency
+        error_rate: 0.01  # Max 1% errors
+```
+
+### Parallel Execution
+
+```yaml
+execution:
+  parallel: true
+  max_parallel: 3
+  default_timeout: 30000
+```
+
+## See Also
+
+- [Pack v2 Documentation](../docs/pack-v2.md)
+- [Authentication Guide](../docs/authentication.md)
+- [LLM Providers](../docs/llm-providers.md)

package/examples/pack-v2-quickstart.yml

@@ -0,0 +1,55 @@
+# QA360 Pack v2 - Quickstart Example
+#
+# Minimal configuration to test a REST API with authentication
+
+version: 2
+name: my-api-tests
+description: Quickstart example for API testing
+
+# ============================================================
+# Authentication
+# ============================================================
+auth:
+  api: my-bearer-token
+  profiles:
+    my-bearer-token:
+      type: bearer
+      config:
+        token: "${API_TOKEN:-your-token-here}"
+
+# ============================================================
+# Quality Gates
+# ============================================================
+gates:
+  # API Health Check
+  health:
+    adapter: playwright-api
+    enabled: true
+    config:
+      baseUrl: "${API_URL:-https://api.example.com}"
+      smoke:
+        - "GET /health -> 200"
+
+  # API CRUD Tests
+  api:
+    adapter: playwright-api
+    enabled: true
+    config:
+      baseUrl: "${API_URL:-https://api.example.com}"
+      smoke:
+        - "GET /users -> 200"
+        - "GET /users/1 -> 200"
+        - "POST /users -> 201"
+        - "PUT /users/1 -> 200"
+        - "DELETE /users/1 -> 204"
+
+# ============================================================
+# Usage
+# ============================================================
+# Run with:
+#   qa360 run pack-v2-quickstart.yml
+#
+# With environment variables:
+#   API_URL=https://api.example.com \
+#   API_TOKEN=your-token \
+#   qa360 run pack-v2-quickstart.yml

package/examples/packs-business/ecommerce-api.yml

@@ -0,0 +1,121 @@
+# QA360 Pack Métier - E-Commerce API
+# Pack synthétique réaliste pour validation universelle
+name: ecommerce-api-business
+version: 1.0.0
+description: "Pack métier e-commerce - API produits, panier, commandes"
+
+gates:
+  api:
+    enabled: true
+    config:
+      baseURL: https://fakestoreapi.com
+      endpoints:
+        - path: /products
+          method: GET
+          expect:
+            status: 200
+            schema:
+              type: array
+              minItems: 1
+        - path: /products/1
+          method: GET
+          expect:
+            status: 200
+            schema:
+              type: object
+              required: [id, title, price, category]
+        - path: /products/categories
+          method: GET
+          expect:
+            status: 200
+            schema:
+              type: array
+        - path: /carts
+          method: GET
+          expect:
+            status: 200
+        - path: /users/1
+          method: GET
+          expect:
+            status: 200
+            schema:
+              type: object
+              required: [id, email, username]
+    budgets:
+      max_failures: 1
+      timeout_ms: 5000
+
+  perf:
+    enabled: true
+    config:
+      scenarios:
+        - name: product-listing
+          executor: constant-vus
+          vus: 10
+          duration: 30s
+          requests:
+            - method: GET
+              url: https://fakestoreapi.com/products
+        - name: product-detail
+          executor: ramping-vus
+          startVUs: 5
+          stages:
+            - duration: 10s
+              target: 20
+            - duration: 10s
+              target: 20
+            - duration: 10s
+              target: 0
+          requests:
+            - method: GET
+              url: https://fakestoreapi.com/products/{{randomInt(1,20)}}
+    budgets:
+      p95_ms: 500
+      p99_ms: 1000
+      error_rate: 0.05
+
+  sast:
+    enabled: true
+    config:
+      rules:
+        - id: javascript.lang.security.audit.hardcoded-secret
+        - id: javascript.lang.security.audit.sql-injection
+        - id: javascript.lang.security.audit.xss
+      paths:
+        - "**/*.js"
+        - "**/*.ts"
+    budgets:
+      max_high: 0
+      max_critical: 0
+
+  deps:
+    enabled: true
+    config:
+      manifests:
+        - package.json
+        - pnpm-lock.yaml
+    budgets:
+      max_high: 2
+      max_critical: 0
+
+  secrets:
+    enabled: true
+    config:
+      paths:
+        - "."
+      patterns:
+        - api_key
+        - secret
+        - password
+        - token
+    budgets:
+      max_findings: 0
+
+metadata:
+  author: QA360 Validation Team
+  tags:
+    - business
+    - ecommerce
+    - api
+    - synthetic
+  business_context: "Validation API e-commerce avec produits, panier, utilisateurs"

package/examples/packs-business/saas-dashboard-ui.yml

@@ -0,0 +1,133 @@
+# QA360 Pack Métier - SaaS Dashboard UI
+# Pack synthétique réaliste pour validation universelle
+name: saas-dashboard-ui-business
+version: 1.0.0
+description: "Pack métier SaaS - Dashboard, authentification, settings"
+
+gates:
+  ui:
+    enabled: true
+    config:
+      baseURL: https://demoqa.com
+      scenarios:
+        - name: login-flow
+          steps:
+            - action: navigate
+              url: /login
+            - action: wait
+              selector: "#userName"
+              timeout: 5000
+            - action: fill
+              selector: "#userName"
+              value: "testuser"
+            - action: fill
+              selector: "#password"
+              value: "Test@123"
+            - action: click
+              selector: "#login"
+            - action: wait
+              timeout: 2000
+        
+        - name: forms-interaction
+          steps:
+            - action: navigate
+              url: /text-box
+            - action: fill
+              selector: "#userName"
+              value: "John Doe"
+            - action: fill
+              selector: "#userEmail"
+              value: "john@example.com"
+            - action: click
+              selector: "#submit"
+            - action: wait
+              timeout: 1000
+        
+        - name: elements-check
+          steps:
+            - action: navigate
+              url: /buttons
+            - action: click
+              selector: "button:has-text('Click Me')"
+            - action: wait
+              timeout: 1000
+    budgets:
+      max_failures: 2
+      timeout_ms: 30000
+
+  a11y:
+    enabled: true
+    config:
+      urls:
+        - https://demoqa.com/login
+        - https://demoqa.com/text-box
+        - https://demoqa.com/buttons
+      rules:
+        - wcag2a
+        - wcag2aa
+        - wcag21aa
+    budgets:
+      max_violations: 5
+      max_critical: 0
+
+  perf:
+    enabled: true
+    config:
+      scenarios:
+        - name: dashboard-load
+          executor: constant-vus
+          vus: 5
+          duration: 20s
+          requests:
+            - method: GET
+              url: https://demoqa.com/
+        - name: login-stress
+          executor: ramping-vus
+          startVUs: 2
+          stages:
+            - duration: 10s
+              target: 10
+            - duration: 10s
+              target: 0
+          requests:
+            - method: GET
+              url: https://demoqa.com/login
+    budgets:
+      p95_ms: 800
+      p99_ms: 1500
+      error_rate: 0.1
+
+  sast:
+    enabled: true
+    config:
+      rules:
+        - id: javascript.lang.security.audit.hardcoded-secret
+        - id: javascript.lang.security.audit.xss
+      paths:
+        - "**/*.js"
+        - "**/*.ts"
+    budgets:
+      max_high: 1
+      max_critical: 0
+
+  secrets:
+    enabled: true
+    config:
+      paths:
+        - "."
+      patterns:
+        - password
+        - token
+        - api_key
+    budgets:
+      max_findings: 0
+
+metadata:
+  author: QA360 Validation Team
+  tags:
+    - business
+    - saas
+    - ui
+    - dashboard
+    - synthetic
+  business_context: "Validation dashboard SaaS avec login, formulaires, accessibilité"

package/examples/packs-conformance/compose-multi.yml

@@ -0,0 +1,174 @@
+name: compose-multi-conformance-pack
+version: 1.0.0
+description: Pack testing Docker Compose multi-service orchestration
+
+compose:
+  version: '3.8'
+  services:
+    web:
+      image: nginx:alpine
+      ports:
+        - "8080:80"
+      volumes:
+        - ./test-content:/usr/share/nginx/html:ro
+      healthcheck:
+        test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost"]
+        interval: 10s
+        timeout: 5s
+        retries: 3
+    
+    api:
+      image: httpbin/httpbin
+      ports:
+        - "8081:80"
+      healthcheck:
+        test: ["CMD", "curl", "-f", "http://localhost/get"]
+        interval: 10s
+        timeout: 5s
+        retries: 3
+    
+    redis:
+      image: redis:alpine
+      ports:
+        - "6379:6379"
+      healthcheck:
+        test: ["CMD", "redis-cli", "ping"]
+        interval: 10s
+        timeout: 5s
+        retries: 3
+
+hooks:
+  beforeAll: |
+    echo "Compose multi pack - setting up multi-service environment"
+    mkdir -p ./test-content
+    echo '<h1>QA360 Test Page</h1><p>Multi-service testing</p>' > ./test-content/index.html
+    docker-compose up -d
+    sleep 30  # Wait for services to be ready
+  afterAll: |
+    echo "Compose multi pack cleanup"
+    docker-compose down -v
+    rm -rf ./test-content
+
+steps:
+  - name: api-nginx-service
+    adapter: playwright-api
+    config:
+      url: "http://localhost:8080"
+      method: GET
+      expect:
+        status: 200
+        body_contains: ["QA360 Test Page"]
+    budgets:
+      duration_ms: 5000
+      
+  - name: api-httpbin-service
+    adapter: playwright-api
+    config:
+      url: "http://localhost:8081/get"
+      method: GET
+      expect:
+        status: 200
+        body_contains: ["args", "headers"]
+    budgets:
+      duration_ms: 5000
+      
+  - name: api-redis-health
+    adapter: playwright-api
+    config:
+      url: "http://localhost:8081/status/200"
+      method: GET
+      expect:
+        status: 200
+    budgets:
+      duration_ms: 3000
+      
+  - name: ui-multi-service
+    adapter: playwright-ui
+    config:
+      url: "http://localhost:8080"
+      actions:
+        - type: screenshot
+          name: "nginx-homepage"
+        - type: goto
+          url: "http://localhost:8081"
+        - type: screenshot
+          name: "httpbin-homepage"
+        - type: goto
+          url: "http://localhost:8081/forms/post"
+        - type: fill
+          selector: "input[name='custname']"
+          value: "Multi-Service Test"
+        - type: screenshot
+          name: "httpbin-form"
+    budgets:
+      duration_ms: 15000
+      
+  - name: perf-multi-service
+    adapter: k6-perf
+    config:
+      script: |
+        import http from 'k6/http';
+        import { check, group } from 'k6';
+        
+        export let options = {
+          stages: [
+            { duration: '30s', target: 10 },
+            { duration: '30s', target: 20 },
+            { duration: '30s', target: 10 },
+          ],
+        };
+        
+        export default function () {
+          group('nginx service', function () {
+            let response = http.get('http://localhost:8080');
+            check(response, {
+              'nginx status is 200': (r) => r.status === 200,
+              'nginx response time < 1000ms': (r) => r.timings.duration < 1000,
+            });
+          });
+          
+          group('httpbin service', function () {
+            let response = http.get('http://localhost:8081/get');
+            check(response, {
+              'httpbin status is 200': (r) => r.status === 200,
+              'httpbin response time < 2000ms': (r) => r.timings.duration < 2000,
+            });
+          });
+        }
+    budgets:
+      p95_ms: 3000
+      error_rate: 0.05
+      
+  - name: sast-compose-config
+    adapter: semgrep-sast
+    config:
+      rules: ["yaml.docker-compose.security"]
+      paths: ["./examples/packs-conformance"]
+      include_patterns: ["*.yml", "*.yaml"]
+    budgets:
+      high_findings: 2
+      critical_findings: 0
+      
+  - name: dast-multi-service
+    adapter: zap-dast
+    config:
+      targets: 
+        - "http://localhost:8080"
+        - "http://localhost:8081"
+      scan_type: "baseline"
+      timeout: 300
+    budgets:
+      duration_ms: 360000  # 6 minutes
+      high_findings: 15
+      critical_findings: 2
+      
+  - name: a11y-multi-service
+    adapter: playwright-a11y
+    config:
+      urls:
+        - "http://localhost:8080"
+        - "http://localhost:8081"
+      rules: ["wcag2a"]
+    budgets:
+      violations: 30
+      critical_violations: 5