Backend Engineer

Backend Engineer

Production-ready backend development with modern technologies, best practices, and proven patterns.

When to Use

• Designing RESTful, GraphQL, or gRPC APIs
• Building authentication/authorization systems
• Optimizing database queries and schemas
• Implementing caching and performance optimization
• OWASP Top 10 security mitigation
• Designing scalable microservices
• Testing strategies (unit, integration, E2E)
• CI/CD pipelines and deployment
• Monitoring and debugging production systems

Technology Selection Guide

Languages: Node.js/TypeScript (full-stack), Python (data/ML), Go (concurrency), Rust (performance) Frameworks: NestJS, FastAPI, Django, Express, Gin Databases: PostgreSQL (ACID), MongoDB (flexible schema), Redis (caching) APIs: REST (simple), GraphQL (flexible), gRPC (performance)

See: references/technologies.md for detailed comparisons

Reference Navigation

Core Technologies:

• references/technologies.md - Languages, frameworks, databases, message queues, ORMs
• references/api-design.md - REST, GraphQL, gRPC patterns and best practices

Security & Authentication:

• references/security.md - OWASP Top 10, security best practices, input validation
• references/authentication.md - OAuth 2.1, JWT, RBAC, MFA, session management

Performance & Architecture:

• references/performance.md - Caching, query optimization, load balancing, scaling
• references/architecture.md - Microservices, event-driven, CQRS, saga patterns

Quality & Operations:

• references/testing.md - Testing strategies, frameworks, tools, CI/CD testing
• references/devops.md - Docker, Kubernetes, deployment strategies, monitoring
• references/implementation-workflow.md - Unified implementation workflow

Key Best Practices

Security: Argon2id passwords, parameterized queries, OAuth 2.1 + PKCE, rate limiting, security headers

Performance: Redis caching (90% DB load reduction), database indexing, CDN, connection pooling

Testing: 70-20-10 pyramid (unit-integration-E2E), contract testing for microservices

DevOps: Blue-green/canary deployments, feature flags, Kubernetes, Prometheus/Grafana monitoring, OpenTelemetry tracing

Quick Decision Matrix

Implementation Checklist

API: Choose style → Design schema → Validate input → Add auth → Rate limiting → Documentation → Error handling

Database: Choose DB → Design schema → Create indexes → Connection pooling → Migration strategy → Backup/restore → Test performance

Security: OWASP Top 10 → Parameterized queries → OAuth 2.1 + JWT → Security headers → Rate limiting → Input validation → Argon2id passwords

Testing: Unit 70% → Integration 20% → E2E 10% → Load tests → Migration tests → Contract tests (microservices)

Deployment: Docker → CI/CD → Blue-green/canary → Feature flags → Monitoring → Logging → Health checks

Implementation Workflow

When implementing backend code, follow unified implementation workflow patterns. See references/implementation-workflow.md for details.

API Design

REST, GraphQL, and gRPC patterns and best practices.

REST APIs

Principles

• Resource-based URLs
• HTTP methods (GET, POST, PUT, DELETE, PATCH)
• Stateless requests
• JSON responses

Best Practices

• Use nouns for resources: /users, /orders
• Use HTTP status codes correctly
• Version APIs: /v1/users, /v2/users
• Pagination for collections
• Filtering, sorting, searching via query params

Example Structure

GET    /api/v1/users            # List users
GET    /api/v1/users/:id        # Get user
POST   /api/v1/users            # Create user
PUT    /api/v1/users/:id        # Update user
DELETE /api/v1/users/:id        # Delete user

GraphQL

Principles

• Single endpoint
• Client-specified queries
• Strongly typed schema
• Introspection

Best Practices

• Design schema first
• Use DataLoader for N+1 queries
• Implement query complexity limits
• Use subscriptions for real-time data
• Version via schema evolution

Example Query

query {
  user(id: "123") {
    name
    email
    orders {
      id
      total
    }
  }
}

gRPC

Principles

• Protocol Buffers for schema
• HTTP/2 transport
• Strong typing
• Streaming support

Best Practices

• Define proto files first
• Use streaming for large datasets
• Implement proper error handling
• Use interceptors for cross-cutting concerns

When to Use

• Internal microservices communication
• High-performance requirements
• Strong typing needed
• Streaming data

API Versioning

URL Versioning

/api/v1/users
/api/v2/users

Header Versioning

Accept: application/vnd.api+json;version=1

Best Practices

• Version from the start
• Maintain backward compatibility when possible
• Deprecate old versions with notice
• Document breaking changes

Error Handling

Standard Error Format

{
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid input",
    "details": {
      "field": "email",
      "reason": "Invalid email format"
    }
  }
}

HTTP Status Codes

• 200 OK - Success
• 201 Created - Resource created
• 400 Bad Request - Client error
• 401 Unauthorized - Authentication required
• 403 Forbidden - Authorization failed
• 404 Not Found - Resource not found
• 500 Internal Server Error - Server error

Rate Limiting

• Implement rate limits to prevent abuse
• Use token bucket or sliding window algorithms
• Return appropriate headers: X-RateLimit-Limit, X-RateLimit-Remaining
• Provide clear error messages when limits exceeded

Documentation

• Use OpenAPI/Swagger for REST APIs
• GraphQL schema serves as documentation
• Include examples for all endpoints
• Document authentication requirements
• Provide SDKs when possible

Backend Architecture

Microservices, event-driven, CQRS, and saga patterns.

Microservices

Principles

• Single responsibility per service
• Independent deployment
• Service-specific databases
• Inter-service communication via APIs

When to Use

• Large, complex systems
• Different scaling needs per service
• Multiple teams working independently
• Technology diversity needed

Challenges

• Service discovery
• Distributed transactions
• Network latency
• Data consistency
• Monitoring complexity

Communication Patterns

• Synchronous: REST, gRPC
• Asynchronous: Message queues, event streaming
• Hybrid: REST for queries, events for updates

Event-Driven Architecture

Principles

• Services communicate via events
• Loose coupling
• Event sourcing for audit trails
• Event replay for recovery

Patterns

• Event sourcing - Store events, not state
• CQRS - Separate read/write models
• Saga - Distributed transactions
• Event streaming - Kafka, RabbitMQ

Benefits

• Scalability
• Resilience
• Flexibility
• Auditability

CQRS (Command Query Responsibility Segregation)

Principles

• Separate read and write models
• Optimize each independently
• Event sourcing for writes
• Denormalized read models

When to Use

• High read/write ratio
• Complex queries
• Different scaling needs
• Event sourcing requirements

Saga Pattern

Distributed Transactions

• Long-running transactions across services
• Compensating actions for rollback
• Event-driven coordination

Types

• Choreography - Services coordinate via events
• Orchestration - Central coordinator manages flow

Example Flow

1. Order service creates order 2. Payment service processes payment 3. Inventory service reserves items 4. If any step fails, compensate previous steps

Service Mesh

Benefits

• Service discovery
• Load balancing
• Circuit breaking
• Observability
• Security (mTLS)

Tools

• Istio
• Linkerd
• Consul Connect

API Gateway

Functions

• Request routing
• Authentication/authorization
• Rate limiting
• Request/response transformation
• Monitoring and logging

Patterns

• Single entry point
• Backend for frontend (BFF)
• API composition

Authentication & Authorization

OAuth 2.1, JWT, RBAC, MFA, and session management.

OAuth 2.1

Flow

1. Client redirects to authorization server 2. User authenticates and authorizes 3. Authorization server returns authorization code 4. Client exchanges code for access token 5. Client uses access token for API requests

PKCE (Proof Key for Code Exchange)

• Required for public clients
• Prevents authorization code interception
• Generate code verifier and challenge

Best Practices

• Use HTTPS only
• Short-lived access tokens (15 minutes)
• Long-lived refresh tokens (7-30 days)
• Secure token storage
• Token revocation support

JWT (JSON Web Tokens)

Structure

header.payload.signature

Claims

• iss (issuer)
• sub (subject)
• exp (expiration)
• iat (issued at)
• Custom claims for user data

Best Practices

• Sign with strong algorithm (RS256, ES256)
• Short expiration times
• Include minimal user data
• Validate signature and expiration
• Use refresh tokens for long sessions

Role-Based Access Control (RBAC)

Roles

• Admin - Full access
• User - Standard access
• Guest - Limited access

Permissions

• Read, Write, Delete
• Resource-specific permissions
• Hierarchical roles

Implementation

def require_permission(permission: str):
    def decorator(func):
        def wrapper(*args, **kwargs):
            if not current_user.has_permission(permission):
                raise ForbiddenError()
            return func(*args, **kwargs)
        return wrapper
    return decorator

Multi-Factor Authentication (MFA)

Methods

• TOTP (Time-based One-Time Password)
• SMS codes
• Email codes
• Hardware tokens
• Biometric authentication

Implementation

• Require MFA for sensitive operations
• Backup codes for account recovery
• Rate limit MFA attempts
• Secure MFA storage

Session Management

Best Practices

• Use secure, HTTP-only cookies
• Set SameSite attribute
• Implement session timeout
• Regenerate session ID on login
• Secure session storage
• Invalidate on logout

Session Storage

• Server-side sessions (Redis, database)
• Stateless sessions (JWT)
• Hybrid approach

Password Reset

Secure Flow

1. User requests password reset 2. Generate secure, time-limited token 3. Send reset link via email 4. Validate token on reset page 5. Require new password + confirmation 6. Invalidate token after use

Security Considerations

• Rate limit reset requests
• Token expiration (1 hour)
• One-time use tokens
• Secure token generation
• Email verification

Backend DevOps

Docker, Kubernetes, deployment strategies, and monitoring.

Docker

Best Practices

• Use multi-stage builds
• Minimize image size
• Use .dockerignore
• Don't run as root
• Use specific tags, not latest

Example Dockerfile

FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
CMD ["node", "dist/index.js"]

Kubernetes

Core Concepts

• Pods - Smallest deployable unit
• Services - Network access to pods
• Deployments - Manage pod replicas
• ConfigMaps - Configuration data
• Secrets - Sensitive data

Deployment Strategies

• Rolling Update - Gradual replacement
• Blue-Green - Two environments, switch traffic
• Canary - Gradual traffic shift

Best Practices

• Use resource limits
• Health checks (liveness, readiness)
• Horizontal Pod Autoscaling
• Namespace isolation
• RBAC for security

CI/CD Pipelines

Stages

1. Build - Compile, test, package 2. Test - Run test suite 3. Deploy - Deploy to environment 4. Verify - Health checks, smoke tests

Best Practices

• Fast feedback loops
• Parallel execution
• Cache dependencies
• Secure secrets management
• Automated rollback

Deployment Strategies

Blue-Green Deployment

• Two identical environments
• Deploy to inactive environment
• Switch traffic when ready
• Instant rollback

Canary Deployment

• Deploy to subset of users
• Monitor metrics
• Gradually increase traffic
• Rollback if issues

Rolling Deployment

• Gradual replacement
• Zero downtime
• Automatic rollback on failure

Feature Flags

• 90% fewer failures
• Gradual feature rollout
• A/B testing
• Instant rollback
• Kill switches

Monitoring

Metrics

• Application Metrics - Response time, error rate, throughput
• Infrastructure Metrics - CPU, memory, disk, network
• Business Metrics - User actions, revenue, conversions

Tools

• Prometheus - Metrics collection
• Grafana - Visualization
• Datadog - APM and monitoring
• New Relic - Application monitoring

Logging

Best Practices

• Structured logging (JSON)
• Log levels (DEBUG, INFO, WARN, ERROR)
• Include context (request ID, user ID)
• Centralized log aggregation
• Log retention policies

Tools

• ELK Stack - Elasticsearch, Logstash, Kibana
• Loki - Log aggregation
• Fluentd - Log forwarding

Tracing

Distributed Tracing

• Track requests across services
• Identify bottlenecks
• Debug distributed systems

Tools

• OpenTelemetry - Observability standard
• Jaeger - Distributed tracing
• Zipkin - Distributed tracing

Health Checks

Liveness Probe

• Is the application running?
• Restart if unhealthy

Readiness Probe

• Is the application ready to serve traffic?
• Remove from load balancer if not ready

Startup Probe

• Is the application starting up?
• Give time for initialization

Implementation Workflow

Unified workflow for implementing backend code changes.

Workflow Pattern Detection

Before implementing, check for existing workflow patterns in the repository and your skills. The workflow pattern should be superseded by these skills.

Spec-First Workflow

• Look for docs/ or specs/ directories with specifications
• Check for spec files in project structure
• Follow spec → implement pattern if present, supersede to specific skills

Test-Driven Development (TDD)

• Check if tests are written before implementation
• Look for test-first patterns in codebase
• Follow test → implement → refactor cycle if present

Other Structured Workflows

• Check for plan files or structured documentation
• Look for workflow indicators in README.md or AGENTS.md
• Follow existing patterns and skills when detected

Implementation Process

1. Atomic Changes

Group related changes together:

• Implementation code + tests
• Feature + related refactoring
• Fix + test for fix

Each atomic change should:

• Pass type checking
• Pass all tests
• Pass linting
• Be self-consistent

2. CI Verification

Before staging any changes: 1. Run CI checks (types, tests, lint) 2. Prefer single CI command if available 3. If checks fail, stop and report 4. Only proceed when all checks pass

3. Atomic Commits

After CI passes: 1. Stage atomic changes 2. Suggest semantic commit message 3. Confirm with user 4. Commit after approval 5. Continue to next atomic change

CLI Tools

For CLI tools, use async-first design with composable commands. See cli-building skill for details.

Integration

This workflow integrates with:

• CI verification before commits
• Semantic commit messages
• Test-first development when present
• Spec-first development when present
• Code review practices

Backend Performance

Caching, query optimization, load balancing, and scaling strategies.

Caching Strategies

Cache-Aside Pattern

1. Check cache for data 2. If miss, fetch from database 3. Store in cache for future requests 4. Return data

Write-Through Caching

1. Write to cache and database simultaneously 2. Ensures consistency 3. Higher write latency

Write-Back Caching

1. Write to cache immediately 2. Write to database asynchronously 3. Risk of data loss on cache failure

Redis Caching

• 90% database load reduction
• Sub-millisecond latency
• Use for session storage, rate limiting, leaderboards
• Set appropriate TTLs

Database Query Optimization

Indexing

• Add indexes to frequently queried columns
• Composite indexes for multi-column queries
• Monitor index usage
• 30% I/O reduction with proper indexing

Query Optimization

• Use EXPLAIN to analyze queries
• Avoid N+1 queries (use eager loading)
• Limit result sets
• Use pagination for large datasets

Connection Pooling

• Reuse database connections
• 5-10x performance boost
• Configure pool size based on load
• Monitor connection usage

Load Balancing

Strategies

• Round-robin - Distribute evenly
• Least connections - Route to least busy
• IP hash - Sticky sessions
• Geographic - Route by location

Health Checks

• Monitor backend health
• Remove unhealthy instances
• Automatic failover
• Graceful degradation

Scaling Strategies

Vertical Scaling

• Increase server resources (CPU, RAM)
• Simple but limited
• Use for moderate growth

Horizontal Scaling

• Add more servers
• Requires load balancing
• Stateless application design
• Better for high growth

Database Scaling

• Read replicas for read-heavy workloads
• Sharding for very large datasets
• Caching layer to reduce DB load
• Connection pooling

CDN (Content Delivery Network)

• 50%+ latency reduction
• Cache static assets at edge
• Reduce origin server load
• Global distribution

Monitoring & Profiling

Key Metrics

• Response time (p50, p95, p99)
• Throughput (requests/second)
• Error rate
• Resource utilization (CPU, memory)

Profiling Tools

• Application Performance Monitoring (APM)
• Database query profilers
• Memory profilers
• CPU profilers

Best Practices

• Set up alerts for critical metrics
• Monitor error rates
• Track slow queries
• Profile regularly
• Optimize bottlenecks

Backend Security

OWASP Top 10, security best practices, and input validation.

OWASP Top 10 (2025)

1. Broken Access Control - Implement proper authorization checks 2. Cryptographic Failures - Use strong encryption, secure storage 3. Injection - Parameterized queries, input validation 4. Insecure Design - Security by design, threat modeling 5. Security Misconfiguration - Secure defaults, regular updates 6. Vulnerable Components - Dependency scanning, updates 7. Authentication Failures - Strong passwords, MFA, session management 8. Software and Data Integrity - Code signing, supply chain security 9. Security Logging Failures - Comprehensive logging, monitoring 10. Server-Side Request Forgery - Input validation, allowlists

Input Validation

Principles

• Validate all inputs at API boundaries
• Whitelist over blacklist
• Validate type, format, length, range
• Sanitize before processing

Examples

Type Validation:

def validate_user_id(user_id: str) -> int:
    try:
        return int(user_id)
    except ValueError:
        raise ValidationError("Invalid user ID")

Format Validation:

import re

def validate_email(email: str) -> bool:
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    return bool(re.match(pattern, email))

SQL Injection Prevention

Always use parameterized queries:

# BAD - Vulnerable
query = f"SELECT * FROM users WHERE id = {user_id}"

# GOOD - Safe
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

Password Security

• Use Argon2id for password hashing
• Minimum 12 characters, complexity requirements
• Never store plaintext passwords
• Implement password reset securely
• Rate limit login attempts

Authentication

• OAuth 2.1 + PKCE for authorization
• JWT tokens with short expiration
• Refresh tokens for long sessions
• Secure token storage
• CSRF protection

Security Headers

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: default-src 'self'

Rate Limiting

• Implement rate limits to prevent abuse
• Different limits for authenticated vs anonymous
• Return 429 Too Many Requests when exceeded
• Log rate limit violations

Secrets Management

• Never commit secrets to version control
• Use environment variables or secret managers
• Rotate secrets regularly
• Use different secrets for different environments

Dependency Security

• Regularly update dependencies
• Use dependency scanning tools
• Review security advisories
• Pin dependency versions
• Use lock files

Backend Technologies

Core technologies, frameworks, databases, and message queues for modern backend development.

Programming Languages

Node.js/TypeScript

Best For:

• Full-stack JavaScript teams
• Real-time applications (WebSockets)
• Rapid prototyping with npm ecosystem
• Event-driven architectures

Popular Frameworks:

• NestJS - Enterprise-grade, TypeScript-first, modular architecture
• Express - Lightweight, flexible, most popular
• Fastify - High performance
• tRPC - End-to-end typesafe APIs without GraphQL

When to Choose: Team already using JavaScript/TypeScript, real-time features needed, rapid development priority

Python

Best For:

• Data-heavy applications
• ML/AI integration
• Scientific computing
• Scripting and automation

Popular Frameworks:

• FastAPI - Modern, async, auto-generated OpenAPI docs, validation via Pydantic
• Django - Batteries-included, ORM, admin panel, authentication
• Flask - Lightweight, flexible, microservices-friendly

When to Choose: Data science integration, ML/AI features, rapid prototyping, team Python expertise

Go

Best For:

• High-concurrency systems (goroutines)
• Microservices architectures
• CLI tools and DevOps tooling
• System programming

Popular Frameworks:

• Gin - Fast HTTP router
• Echo - High performance, extensible
• Fiber - Express-like API

When to Choose: Microservices, high concurrency needs, DevOps tooling, simple deployment (single binary)

Rust

Best For:

• Performance-critical systems
• Memory-safe system programming
• High-reliability requirements
• WebAssembly backends

Popular Frameworks:

• Axum - Ergonomic, modular, tokio-based
• Actix-web - Fastest web framework
• Rocket - Type-safe, easy to use

When to Choose: Maximum performance needed, memory safety critical, low-level control required

Databases

PostgreSQL

Strengths:

• ACID compliance, data integrity
• JSON/JSONB support (hybrid SQL + NoSQL)
• Full-text search, geospatial (PostGIS)
• Advanced indexing (B-tree, Hash, GiST, GIN)
• Window functions, CTEs, materialized views

Use Cases:

• E-commerce (transactions critical)
• Financial applications
• Complex reporting requirements
• Multi-tenant applications

When to Choose: Need ACID guarantees, complex queries/joins, data integrity critical

MongoDB

Strengths:

• Flexible/evolving schemas
• Horizontal scaling (sharding built-in)
• Aggregation pipeline (powerful data processing)
• GridFS for large files

Use Cases:

• Content management systems
• Real-time analytics
• IoT data collection
• Catalogs with varied attributes

When to Choose: Schema flexibility needed, rapid iteration, horizontal scaling required

Redis

Capabilities:

• In-memory key-value store
• Pub/sub messaging
• Sorted sets (leaderboards)
• Geospatial indexes
• Streams (event sourcing)

Performance: 10-100x faster than disk-based databases

Use Cases:

• Session storage
• Rate limiting
• Real-time leaderboards
• Job queues
• Caching layer (90% DB load reduction)

When to Choose: Need sub-millisecond latency, caching layer, session management

ORMs & Database Tools

Modern ORMs

Drizzle ORM (TypeScript)

• SQL-like syntax, full type safety
• Best for: Performance-critical TypeScript apps

Prisma (TypeScript)

• Auto-generated type-safe client
• Database migrations included
• Best for: Rapid development, type safety

SQLAlchemy (Python)

• Industry standard Python ORM
• Powerful query builder
• Best for: Python backends

Message Queues & Event Streaming

RabbitMQ

Best For: Task queues, request/reply patterns

Strengths:

• Flexible routing (direct, topic, fanout, headers)
• Message acknowledgment and durability
• Dead letter exchanges
• Wide protocol support

Use Cases:

• Background job processing
• Microservices communication
• Email/notification queues

Apache Kafka

Best For: Event streaming, millions messages/second

Strengths:

• Distributed, fault-tolerant
• High throughput
• Message replay (retention-based)
• Stream processing

Use Cases:

• Real-time analytics
• Event sourcing
• Log aggregation
• High-scale event streaming

Common Pitfalls

1. Choosing NoSQL for relational data - Use PostgreSQL if data has clear relationships 2. Not using connection pooling - Implement pooling for 5-10x performance boost 3. Ignoring indexes - Add indexes to frequently queried columns 4. Over-engineering with microservices - Start monolith, split when needed 5. Not caching - Redis caching provides significant DB load reduction

Backend Testing

Testing strategies, frameworks, tools, and CI/CD testing.

Testing Pyramid

70-20-10 Rule

• 70% Unit Tests - Fast, isolated, test individual functions
• 20% Integration Tests - Test component interactions
• 10% E2E Tests - Test full user flows

Unit Tests

• Test individual functions/methods
• Mock external dependencies
• Fast execution (<1ms per test)
• High coverage target (80%+)

Integration Tests

• Test database interactions
• Test API endpoints
• Test service integrations
• Use test databases

E2E Tests

• Test complete workflows
• Use staging environment
• Slower execution
• Lower coverage (critical paths)

Testing Frameworks

Node.js/TypeScript

• Vitest - Fast, Vite-based, 50% faster than Jest
• Jest - Popular, feature-rich
• Mocha - Flexible, minimal

Python

• pytest - Popular, fixtures, plugins
• unittest - Standard library
• Hypothesis - Property-based testing

Go

• testing - Standard library
• testify - Assertions and mocks

Test Structure

AAA Pattern

• Arrange - Set up test data
• Act - Execute code under test
• Assert - Verify results

Example

def test_user_creation():
    # Arrange
    user_data = {"name": "Test User", "email": "test@example.com"}
    
    # Act
    user = create_user(user_data)
    
    # Assert
    assert user.id is not None
    assert user.name == "Test User"

Database Testing

Strategies

• Use test database (separate from production)
• Transactions that rollback
• Fixtures for test data
• Migrations for schema setup

Best Practices

• Clean up after tests
• Use factories for test data
• Test migrations separately
• Verify data constraints

API Testing

Tools

• Postman - Manual testing
• REST Client - HTTP requests
• Supertest (Node.js) - API testing
• httpx (Python) - HTTP client for testing

Test Cases

• Status codes
• Response structure
• Error handling
• Authentication/authorization
• Rate limiting

Contract Testing

Purpose

• Verify API contracts between services
• Prevent breaking changes
• Consumer-driven contracts

Tools

• Pact - Consumer-driven contracts
• Spring Cloud Contract - Contract testing
• OpenAPI - Schema validation

CI/CD Testing

Pipeline Stages

1. Lint and format checks 2. Unit tests 3. Integration tests 4. Build artifacts 5. E2E tests (staging) 6. Deploy to production

Best Practices

• Run fast tests first
• Parallel test execution
• Cache dependencies
• Fail fast on errors
• Test migrations before deployment

Performance Testing

Types

• Load Testing - Normal expected load
• Stress Testing - Beyond normal capacity
• Spike Testing - Sudden load increases
• Endurance Testing - Sustained load

Tools

• k6 - Load testing
• Artillery - Performance testing
• Apache JMeter - Load testing

Test Coverage

Metrics

• Line coverage
• Branch coverage
• Function coverage
• Statement coverage

Targets

• 80%+ for unit tests
• 60%+ for integration tests
• Critical paths for E2E tests