Quality isn’t a phase. It’s part of the architecture.

1# BUG-0142  Discount removed when delivery changes
2Severity: High    Area: Checkout
3Build: 2026.10.06-3    Env: staging
4Browser: Safari 18 on macOS
5 
6Steps
7  1. Add two items, apply code SAVE10
8  2. Change delivery from Standard to Express
9Expected
10  Total keeps the 10% discount
11Actual
12  Discount silently removed, code field empty
13 
14Evidence: screen recording, HAR file
15Regression test: e2e/checkout/discount.spec.ts

1Feature: Discount codes at checkout
2 
3  Rule: Percentage codes need a minimum spend of $50
4 
5    Scenario Outline: Minimum spend is respected
6      Given a cart worth <subtotal>
7      When the customer applies "SAVE10"
8      Then the discount is <discount>
9 
10      Examples:
11        | subtotal | discount | why             |
12        | $49.99   | $0.00    | just below      |
13        | $50.00   | $5.00    | exactly minimum |
14        | $120.00  | $12.00   | normal          |

1import { PostgreSqlContainer, type StartedPostgreSqlContainer }
2  from "@testcontainers/postgresql";
3 
4let db: StartedPostgreSqlContainer;
5beforeAll(async () => {
6  db = await new PostgreSqlContainer("postgres:16").start();
7  await migrate(db.getConnectionUri());
8}, 60_000);
9afterAll(() => db.stop());
10 
11it("rejects a repeated idempotency key", async () => {
12  const orders = new OrderRepository(db.getConnectionUri());
13  await orders.create(anOrder({ idempotencyKey: "k-1" }));
14  await expect(orders.create(anOrder({ idempotencyKey: "k-1" })))
15    .rejects.toThrow(DuplicateOrder);
16});

1// Postman test script for POST /v1/orders
2pm.test("201 with a Location header", () => {
3  pm.response.to.have.status(201);
4  pm.response.to.have.header("Location");
5});
6 
7pm.test("matches the Order schema", () => {
8  const schema = JSON.parse(pm.collectionVariables.get("orderSchema"));
9  pm.response.to.have.jsonSchema(schema);
10});
11 
12pm.test("a replayed key returns the same order", () => {
13  pm.expect(pm.response.json().id)
14    .to.eql(pm.environment.get("firstOrderId"));
15});
16 
17// CI: newman run orders.postman_collection.json -e ci.json

1test("keeps the discount when delivery changes", {
2  tag: ["@regression", "@checkout"],
3  annotation: { type: "issue", description: "BUG-0142" },
4}, async ({ page }) => {
5  await page.goto("/checkout?cart=two-items");
6  await page.getByLabel("Discount code").fill("SAVE10");
7  await page.getByRole("button", { name: "Apply" }).click();
8  await page.getByRole("radio", { name: "Express" }).check();
9  await expect(page.getByTestId("order-total")).toHaveText("$94.50");
10});
11 
12// Pull request: npx playwright test --grep @checkout
13// Nightly:      npx playwright test --grep @regression

1import { test as base } from "@playwright/test";
2 
3export const test = base.extend<{
4  customer: Customer; checkout: CheckoutPage;
5}>({
6  // Each test creates its own customer through the API:
7  // no shared state, safe in parallel, cleaned up after.
8  customer: async ({ request }, use) => {
9    const customer = await createCustomer(request, { plan: "pro" });
10    await use(customer);
11    await deleteCustomer(request, customer.id);
12  },
13  checkout: async ({ page, customer }, use) => {
14    await signInAs(page, customer);
15    await use(new CheckoutPage(page));
16  },
17});

1import { test, expect } from "./fixtures";
2 
3test("customer buys with a saved card", async ({ page, checkout }) => {
4  await checkout.addToCart("Trail Runner 2", { size: "42" });
5  await checkout.open();
6  await checkout.payWithSavedCard();
7 
8  await expect(page.getByRole("heading", { name: "Order confirmed" }))
9    .toBeVisible();
10  await expect(page.getByText(/Order #\d+/)).toBeVisible();
11});
12 
13// On failure the report includes a trace, screenshot, and video.

1{
2  "ci": {
3    "collect": {
4      "url": ["https://preview.example.com/checkout"],
5      "numberOfRuns": 3
6    },
7    "assert": {
8      "assertions": {
9        "largest-contentful-paint": ["error", { "maxNumericValue": 2500 }],
10        "cumulative-layout-shift": ["error", { "maxNumericValue": 0.1 }],
11        "total-blocking-time": ["warn", { "maxNumericValue": 200 }],
12        "resource-summary:script:size": ["error", { "maxNumericValue": 300000 }]
13      }
14    }
15  }
16}

1import http from "k6/http";
2import { check } from "k6";
3 
4export const options = {
5  scenarios: { sale_peak: {
6    executor: "ramping-arrival-rate",
7    startRate: 20, timeUnit: "1s",
8    preAllocatedVUs: 200, maxVUs: 1000,
9    stages: [
10      { target: 200, duration: "10m" },  // expected peak
11      { target: 600, duration: "10m" },  // 3x headroom
12      { target: 600, duration: "20m" },  // hold
13    ],
14  } },
15  thresholds: {
16    "http_req_duration{name:checkout}": ["p(95)<400"],
17    http_req_failed: ["rate<0.005"],
18  },
19};
20 
21export default function () {
22  const res = http.post(`${__ENV.BASE_URL}/v1/checkout`, cart(),
23    { tags: { name: "checkout" } });
24  check(res, { "created": r => r.status === 201 });
25}

1export default defineConfig({
2  // Matrix from the last 90 days of analytics.
3  projects: [
4    { name: "chrome",  use: { ...devices["Desktop Chrome"] } },
5    { name: "edge",    use: { ...devices["Desktop Edge"], channel: "msedge" } },
6    { name: "firefox", use: { ...devices["Desktop Firefox"] } },
7    { name: "safari",  use: { ...devices["Desktop Safari"] } },
8    { name: "iphone",  use: { ...devices["iPhone 15"] } },
9    { name: "android", use: { ...devices["Pixel 7"] } },
10  ],
11  use: { trace: "retain-on-failure", screenshot: "only-on-failure" },
12});

1appId: com.example.fieldapp
2---
3- launchApp:
4    clearState: true
5- runFlow: flows/sign-in.yaml
6- setAirplaneMode: enabled      # Android
7- tapOn: "Today's jobs"
8- tapOn: "Check in"
9- assertVisible: "Saved. Will sync when online"
10- setAirplaneMode: disabled
11- extendedWaitUntil:
12    visible: "Synced"
13    timeout: 15000

1// Generated from the permission matrix: every role, every rule.
2const cases = [
3  { role: "customer",  path: "/v1/orders/:own",   status: 200 },
4  { role: "customer",  path: "/v1/orders/:other", status: 404 },
5  { role: "support",   path: "/v1/orders/:other", status: 200 },
6  { role: "support",   path: "/v1/refunds",       status: 403, method: "post" },
7  { role: "anonymous", path: "/v1/orders/:own",   status: 401 },
8];
9 
10test.each(cases)("$role $path → $status",
11  async ({ role, path, status, method = "get" }) => {
12    const res = await as(role)[method](resolve(path));
13    expect(res.status).toBe(status);
14  });
15 
16// Pipeline: zap-baseline.py · npm audit · trivy · gitleaks

1# Excerpt: each job is a required status check.
2jobs:
3  unit:
4    steps:
5      - run: npx jest --ci --coverage
6  integration:
7    needs: unit
8    steps:
9      - run: npx jest -c jest.integration.config.ts
10      - run: npx newman run api/orders.postman_collection.json
11  e2e:
12    needs: integration
13    strategy:
14      matrix: { browser: [chromium, firefox, webkit] }
15    steps:
16      - run: npx playwright test --project=${{ matrix.browser }}
17  performance:
18    needs: e2e
19    steps:
20      - run: k6 run perf/checkout-smoke.js
21  deploy:
22    needs: [e2e, performance]
23    if: github.ref == 'refs/heads/main'