Belajar Quality Engineer - Quality Gates in CI/CD

#Pendahuluan

Setelah di episode 8 kita mempelajari shift-left testing, pada episode ini kita mempelajari quality gates in CI/CD — bagaimana implementasi quality gates otomatis di pipeline. Quality gates adalah checkpoint otomatis yang memastikan kualitas sebelum lanjut ke stage berikutnya.

Mengapa quality gates penting? Karena tanpa quality gates, code yang bermasalah bisa lolos ke production. Dengan quality gates otomatis, kalian bisa mencegah regression dan menjaga kualitas secara konsisten.

#Jenis Quality Gates

#Coverage Gates

text

Coverage Gates:
├── Unit Test Coverage:
│   ├── Minimum: 80%
│   ├── Target: 90%
│   └── Tools: Jest, Vitest
├── Integration Test Coverage:
│   ├── Minimum: 70%
│   ├── Target: 80%
│   └── Tools: Custom reporting
├── E2E Test Coverage:
│   ├── Critical paths: 100%
│   ├── All paths: 60%
│   └── Tools: Playwright
└── Code Coverage:
    ├── Line coverage
    ├── Branch coverage
    └── Function coverage

#Performance Gates

text

Performance Gates:
├── Response Time:
│   ├── API: < 200ms
│   ├── Page load: < 2s
│   └── Tools: k6, Lighthouse
├── Bundle Size:
│   ├── JavaScript: < 200KB
│   ├── CSS: < 50KB
│   └── Tools: size-limit
├── Lighthouse Score:
│   ├── Performance: > 90
│   ├── Accessibility: > 90
│   └── Tools: Lighthouse CI
└── Memory Usage:
    ├── Heap: < 512MB
    └── Tools: Clinic.js

#Security Gates

text

Security Gates:
├── Dependency Scan:
│   ├── No high/critical vulnerabilities
│   ├── Tools: Snyk, npm audit
│   └── Auto-fix: Dependabot
├── SAST (Static Analysis):
│   ├── No critical issues
│   ├── Tools: SonarQube, Semgrep
│   └── Custom rules
├── DAST (Dynamic Analysis):
│   ├── No high vulnerabilities
│   ├── Tools: OWASP ZAP
│   └── Baseline scan
└── License Check:
    ├── No forbidden licenses
    └── Tools: license-checker

#Quality Gates Implementation

#GitHub Actions Example

yaml

# .github/workflows/quality-gates.yml
name: Quality Gates
on: [push, pull_request]
jobs:
  quality-gates:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      
      - name: Linting
        run: npm run lint
      
      - name: Type Check
        run: npm run typecheck
      
      - name: Unit Tests
        run: npm run test:unit -- --coverage
      
      - name: Coverage Check
        run: |
          COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
          if [ $(echo "$COVERAGE < 80" | bc) -eq 1 ]; then
            echo "Coverage below 80%"
            exit 1
          fi
      
      - name: Security Scan
        run: npm audit --audit-level=high
      
      - name: Bundle Size
        run: npx size-limit

Note

Quality gates harus realistis. Jika threshold terlalu ketat, pipeline akan sering gagal dan developer akan frustrasi. Mulai dengan threshold moderate dan naikkan secara bertahap.

#Quality Policies

#Definisi Kebijakan

text

Quality Policies:
├── Code Review:
│   ├── Minimum 1 approval
│   ├── No self-merge
│   └── Review checklist
├── Test Requirements:
│   ├── Unit tests wajib
│   ├── Integration tests untuk API
│   └── E2E untuk critical paths
├── Documentation:
│   ├── API documentation
│   ├── README updated
│   └── CHANGELOG updated
└── Release:
    ├── All gates passed
    ├── QA sign-off
    └── Product owner approval

#Practical: Quality Gates Dashboard

text

Quality Gates Dashboard:
├── Status:
│   ├── Passing: 8/10 gates
│   ├── Failing: 2/10 gates
│   └── Trend: Improving
├── Details:
│   ├── ✅ Linting
│   ├── ✅ Type Check
│   ├── ✅ Unit Tests
│   ├── ✅ Coverage (85%)
│   ├── ✅ Security
│   ├── ✅ Performance
│   ├── ✅ Bundle Size
│   ├── ❌ Integration Tests (70% < 80%)
│   ├── ✅ E2E Tests
│   └── ❌ Documentation
└── Actions:
    ├── Fix integration tests
    └── Update documentation

Tip

Visualisasi quality gates membantu tim memahami status kualitas. Gunakan dashboard untuk memberikan visibility ke seluruh tim, bukan hanya QA.

#Penutup

Pada episode 9 ini, kalian telah mempelajari quality gates in CI/CD.

Inti yang harus dibawa pulang:

Coverage gates: unit (80%), integration (70%), E2E (critical paths).
Performance gates: response time, bundle size, Lighthouse score.
Security gates: dependency scan, SAST, DAST.
Quality policies: code review, test requirements, documentation.

Di episode 10 selanjutnya, kita akan membahas test environments & test ops — bagaimana mengelola test environments secara efektif. Sampai jumpa di episode 10!