QA & Testing · Guide

Testing Fundamentals

What testing is actually for, the shape of a suite people trust, and how to write a bug report that gets fixed.

— min read QA & Testing

Testing Buys Information, Not Certainty

Testing cannot prove software correct. It can only show that specific behaviours held under specific conditions — so the job is choosing the conditions that carry the most information per minute spent.

That framing settles most arguments about coverage. A suite is not better because it runs more assertions; it is better because a failure in it means something is genuinely broken, and a pass means the risky parts still work.

Two roles sit underneath the word QA. Verification asks whether the thing was built to spec. Validation asks whether the spec was worth building. A team that only does the first ships a product that matches a document and disappoints its users.

Types of Testing

The vocabulary is worth pinning down, because half of testing disagreements are two people using one word for different things.

TypeAnswers
UnitDoes this function behave, in isolation
IntegrationDo these pieces agree at their boundary
End-to-endCan a user complete the journey
RegressionDid fixing that break this
SmokeIs this build worth testing further
AcceptanceDoes this satisfy the person who asked for it

Cutting the same space another way: functional testing asks whether it does the right thing, and non-functional testing asks whether it does it fast enough, safely enough and for enough people at once. The second kind is skipped far more often and causes the more expensive incidents.

Black box tests the behaviour with no view of the code, white box uses that view to reach the awkward branches. Neither is more rigorous — they find different bugs, and a suite of only one kind has a predictable blind spot.

The Testing Pyramid

The pyramid is a claim about cost and feedback speed, not about virtue. Tests near the bottom are fast, cheap and precise about what broke. Tests near the top are slow, expensive and the only ones that prove the product actually works.

LayerShareRuns inTells you
UnitMostMillisecondsExactly which function is wrong
IntegrationSomeSecondsWhich boundary disagrees
End-to-endFewMinutesSomething in this journey is broken
Invert it — mostly end-to-end tests — and you get the ice cream cone: a suite that takes forty minutes, fails for environmental reasons twice a week, and points at a screen rather than a cause. Teams stop trusting it, then stop reading it.

The shape is guidance, not arithmetic. A thin service that is mostly glue between other systems genuinely needs more integration tests than units, because its own logic is small and its risk is at the seams.

Writing Test Cases

A test case is a claim about behaviour that someone else can check. It needs a precondition, an action, and an expected result specific enough to be wrong.

WeakUsable
"Check login works""Given a verified account, entering the correct password lands on the dashboard within 3s"
"Test the form""Submitting with an empty email shows the field error and does not call the API"
"Verify the list""With 0 results the empty state is shown, not a blank panel"

Two techniques do most of the work of choosing inputs. Equivalence partitioning says values that should behave alike need one representative each, not fifty. Boundary value analysis says the bugs live at the edges — 0, 1, the maximum, one past the maximum, empty, and null.

Test the unhappy paths deliberately. Most production incidents are the case nobody wrote a case for: the expired token, the duplicate submit, the 40-character surname, the user who pressed back.

Bug Reports That Get Fixed

A bug report is a request for someone else's time. The ones that get acted on quickly all contain the same six things.

FieldWhy it decides the outcome
TitleRead in a list of two hundred — state the symptom, not "broken"
StepsNumbered, from a known starting state, reproducible by a stranger
Expected vs actualWithout both, it is an opinion
EnvironmentBuild, browser, device, account — half of bugs are conditional
EvidenceScreenshot, video, logs, network trace, request id
Severity and frequencyImpact and how often — the two inputs to priority
"Doesn't work" costs the developer an hour of guessing and usually comes back as "cannot reproduce". Ten minutes narrowing it down is the cheapest work in the whole cycle.

Separate severity from priority. Severity is how badly it behaves; priority is how soon it should be fixed. A crash in an unused admin screen can be severe and low priority; a typo on the pricing page is trivial and urgent.

Interview Questions

Can testing prove software is correct?

No. It can only demonstrate that particular behaviours held under particular conditions. The skill is picking the conditions that carry the most information for the time spent.

Verification versus validation?

Verification asks whether it was built to spec; validation asks whether the spec solves the user's problem. Teams that only verify ship things that match a document and miss the point.

Why is the pyramid shaped that way?

Cost and feedback speed. Unit tests are fast and say exactly what broke; end-to-end tests are slow and flaky but are the only ones that prove the journey works. Invert it and the suite gets ignored.

What is the ice cream cone anti-pattern?

A suite dominated by end-to-end tests. It takes tens of minutes, fails for environmental reasons, and reports a screen rather than a cause — so people stop trusting the results.

What are equivalence partitioning and boundary values?

Partitioning groups inputs that should behave identically so you test one from each. Boundary analysis then targets the edges of those groups — 0, 1, max, max+1, empty, null — where bugs actually cluster.

Severity or priority — what is the difference?

Severity is how bad the behaviour is; priority is how soon it gets fixed. A crash in an unused screen is severe and low priority; a pricing typo is trivial and urgent.

Quick Quiz

1. The testing pyramid argues for mostly…
2. Boundary value analysis targets…
3. A bug report missing expected-vs-actual is…
4. Non-functional testing covers…
5. A crash in an unused admin screen is typically…