#qa #ci #shift-left

The most expensive tester in my company is me

Asif Foysal Meem1 July 20268 min readViews

Read as

↳working implementation · tests

Build treatmentUpdated 14 Jul 2026

Production quality · Shift-left systems

What you will leave with

Build one precise gate, prove its negative path, and make it impossible to bypass silently.

For engineers converting staging-walk findings into required delivery gates.~3 min read

PrerequisitesA repository with CIOne reproducible defectOwnership of a merge or deploy boundary

01 · System view

What you will build

A small conveyor that turns human discovery into permanent machine enforcement.

01Failure fixtureThe smallest reproducible forbidden state.
02DetectorA deterministic observation with useful output.
03CI jobStable identity, runtime, and exit status.
04Required policyMerge or promotion refuses every non-success state.
05OwnerSomeone maintains precision, latency, and recovery.

02 · Implementation

Build it in sequence

Write the invariant before the test

Describe what must always be true in production and the defect class it excludes. Avoid implementation wording; “anonymous users cannot execute protected functions” survives a database or framework refactor.

quality/invariants.ymlyaml

- id: protected-functions-deny-anon
  invariant: anonymous roles cannot execute protected functions
  boundary: pull-request
  owner: platform
  failure_cost: paid data exposure

Observe the effective system

Rebuild from committed migrations, then query actual privileges. For links, use the resolved destination; for notifications, observe the side effect; for UI, inspect the rendered surface. Test the fact users experience, not an intermediate configuration.

tests/permissions/protected-functions.sql · sanitizedsql

DO $$
BEGIN
  IF has_function_privilege(
    'anon', 'private.generate_report(uuid)', 'EXECUTE'
  ) THEN
    RAISE EXCEPTION 'anon can execute protected function';
  END IF;
END $$;

Prove the negative path

In an ephemeral test database, grant the forbidden privilege and require the gate to fail with the exact object named. A detector watched only in its green state is still an assumption.

Make the job required

Give the check a stable name and make merge or promotion accept only explicit success. Pending, skipped, cancelled, and missing are not green.

Design recovery with enforcement

Failure output should name the invariant, observation, owner, and remediation. If an emergency exception is necessary, make it approved, expiring, visible, and followed by work.

03 · Review

Definition of done

The invariant names a user-visible or security-relevant fact.
The detector observes the effective artifact or authority.
A deliberately broken fixture fails with useful output.
Delivery policy requires explicit success.
The gate has an owner and an audited exception path.

04 · Failure modes

What breaks and what it means

The check passes locally but fails from-zero CI.

Repair migration or configuration drift; do not teach CI about the manually repaired environment.

Developers bypass the gate because it is noisy.

Fix precision and remediation first. Enforcement without credibility decays into ceremony.

Public discussion

Questions, corrections, and useful disagreement

Moderated on GitHub ↗

Sign in with GitHub to join the conversation. Comments are public. Article views are anonymous and counted once per browser, per article, each day.