.agents/skills/testing-guidelines/SKILL.md
Guide for writing tests. Use when adding new functionality, fixing bugs, or when tests are needed. Emphasizes integration tests, real-world fixtures, and regression coverage.
npx skillsauth add getsentry/warden testing-guidelinesInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Follow these principles when writing tests for this codebase.
ALWAYS mock third-party network services. ALWAYS use fixtures based on real-world data.
[email protected], user-123)Focus on end-to-end style tests that validate inputs and outputs, not implementation details.
Don't test every variant of a problem.
When a bug is identified, ALWAYS add a test that would have caught it.
Note: Regression tests are for unintentional broken behavior (bugs), not intentional changes. Intentional feature removals, deprecations, or breaking changes do NOT need regression tests—these are design decisions, not defects.
ALWAYS have at least one basic test for each customer/user entry point.
Note: "Entry point" means the public interface—exported functions, CLI commands, API routes. Internal/private functions are NOT entry points, even if they handle user-facing flags or options. Test entry points; internal functions get coverage through those tests.
Tests are how we validate ANY functionality works before manual testing.
*.test.ts extensionfoo.ts → foo.test.tsEvery test must:
afterEach hooksimport { describe, it, expect, beforeEach, afterEach } from 'vitest';
import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
describe('my feature', () => {
let tempDir: string;
beforeEach(() => {
tempDir = join(tmpdir(), `warden-test-${Date.now()}`);
mkdirSync(tempDir, { recursive: true });
});
afterEach(() => {
rmSync(tempDir, { recursive: true, force: true });
});
it('does something with files', () => {
writeFileSync(join(tempDir, 'test.ts'), 'content');
// ... test code
});
});
For pure functions without side effects, no special setup is needed:
import { describe, it, expect } from 'vitest';
import { matchGlob } from './matcher.js';
describe('matchGlob', () => {
it('matches exact paths', () => {
expect(matchGlob('src/index.ts', 'src/index.ts')).toBe(true);
});
});
pnpm test # Run all tests in watch mode
pnpm test:run # Run all tests once
development
Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.
development
Finds real correctness bugs in code changes. Use for adversarial code review, bug hunts, regression review, PR correctness review, logic errors, data loss, race conditions, state bugs, interface contract breaks, error handling bugs, edge cases, broken builds, or broken workflows. Excludes style, readability, architecture, AppSec, and best-practice-only feedback unless the issue causes a demonstrable bug.
development
Run Warden to analyze code changes before committing. Use when asked to "run warden", "check my changes", "review before commit", "warden config", "warden.toml", "create a warden skill", "add trigger", or any Warden-related local development task.
development
Full-repository code sweep. Scans every file with Warden, verifies findings through deep tracing, creates draft PRs for validated issues. Use when asked to "sweep the repo", "scan everything", "find all bugs", "full codebase review", "batch code analysis", or run Warden across the entire repository.