Belajar QA Automation Engineer - Secure Test Automation

#Pendahuluan

Setelah di episode 17 kita membangun reporting & dashboards, pada episode ini kita membahas aspek yang sering terlupakan: keamanan test automation. Test suite yang tidak aman bisa membocorkan secrets dan credentials.

#Secrets Management

#Never Hardcode Secrets

javascript

// BAD: hardcoded credentials
const password = 'admin123';  // JANGAN PERNAH
 
// GOOD: environment variables
const password = process.env.TEST_PASSWORD;
 
// BETTER: dotenv
import dotenv from 'dotenv';
dotenv.config();
const password = process.env.TEST_PASSWORD;

#GitHub Actions Secrets

yaml

# .github/workflows/test.yml
env:
  TEST_USER: ${{ secrets.TEST_USER }}
  TEST_PASSWORD: ${{ secrets.TEST_PASSWORD }}
  API_KEY: ${{ secrets.TEST_API_KEY }}
 
steps:
  - run: npm test
    env:
      TEST_USER: ${{ secrets.TEST_USER }}
      TEST_PASSWORD: ${{ secrets.TEST_PASSWORD }}

#.env.example

bash

# .env.example (commit ke git)
TEST_USER=
TEST_PASSWORD=
API_KEY=
BASE_URL=http://localhost:3000

#Test Accounts

#Dedicated Test Users

typescript

// test-users.ts
export const testUsers = {
  regular: {
    email: process.env.TEST_USER_EMAIL,
    password: process.env.TEST_USER_PASSWORD,
  },
  admin: {
    email: process.env.TEST_ADMIN_EMAIL,
    password: process.env.TEST_ADMIN_PASSWORD,
  },
};

#Account Isolation

text

Test Account Rules:
├── Dedicated accounts (bukan production users)
├── Predictable passwords (untuk debugging)
├── Limited permissions (hanya yang dibutuhkan)
├── Regular rotation
├── Disable di production
└── Audit logging

#Environment Isolation

#Separate Environments

typescript

// playwright.config.ts
const baseURL = process.env.BASE_URL || 'http://localhost:3000';
 
export default defineConfig({
  use: {
    baseURL,
    // Jangan simpan sensitive data di config
    storageState: undefined,
  },
});

#Network Isolation

typescript

// Block external calls di test
test.beforeEach(async ({ page }) => {
  await page.route('**/api/analytics/**', route => route.abort());
  await page.route('**/tracking/**', route => route.abort());
});

#CI Security

yaml

# GitHub Actions security best practices
jobs:
  test:
    runs-on: ubuntu-latest
    environment: test  # Isolated environment
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v4
      - run: npm test
        env:
          TEST_USER: ${{ secrets.TEST_USER }}
          TEST_PASSWORD: ${{ secrets.TEST_PASSWORD }}

Warning

Jangan pernah commit secrets ke repository. Gunakan GitHub secrets atau secret manager lainnya. Setiap secret yang bocor harus segera di-rotate.

#Praktik: Secure Config

bash

# 1. Buat .env (jangan commit)
echo "TEST_USER=user@test.com" > .env
echo "TEST_PASSWORD=securepassword" >> .env
 
# 2. Tambah .env ke .gitignore
echo ".env" >> .gitignore
 
# 3. Buat .env.example (commit)
cp .env .env.example

#Penutup

Secrets: gunakan environment variables, jangan hardcode.
Test accounts: dedicated, limited permissions, regular rotation.
Environment isolation: separate test dari production.
CI security: GitHub secrets, isolated environments.

Di episode 19 selanjutnya kita akan membahas testing auth & session flows — automate login, token management, dan session testing. Sampai jumpa di episode 19!