# Infrastructure-as-Code Testing Strategies

Comprehensive testing approach for Nickel configurations and deployments.

## Test Categories

### 1. Syntax Validation

```nushell
def test-nickel-syntax [] {
    print "Testing Nickel syntax..."

    let files = (find workspace/config -name "*.ncl")

    $files | each { | file |
        let result = (provisioning validate syntax --file $file)

        if $result.status != "valid" {
            print $"✗ ($file): ($result.error)"
            return 1
        }
    }

    print $"✓ All ($files | length) Nickel files have valid syntax"
}
```

### 2. Schema Validation

```nushell
def test-schema-compliance [] {
    print "Validating configurations against schemas..."

    let schemas = [
        "provisioning/schemas/main.ncl",
        "provisioning/schemas/compute.ncl",
        "provisioning/schemas/database.ncl",
        "provisioning/schemas/networking.ncl"
    ]

    let configs = (find workspace -name "*.ncl" ! -name "schema.ncl")

    $configs | each { | config |
        let result = (
            provisioning validate schema \
                --config $config \
                --schemas $schemas
        )

        if $result.status != "compliant" {
            print $"✗ ($config) schema violations:"
            $result.violations | each { | violation |
                print $"  - ($violation.field): ($violation.message)"
            }
            return 1
        }
    }

    print $"✓ All configurations comply with schemas"
}
```

### 3. Policy Validation

```nushell
def test-security-policies [] {
    print "Validating against security policies..."

    let policies = [
        "require-encryption: true",
        "require-tags: true",
        "require-backup: true",
        "restrict-public-access: true",
        "enforce-tls-1.3: true"
    ]

    let result = (
        provisioning validate policies \
            --config workspace/config/production.ncl \
            --policies $policies
    )

    if $result.status != "compliant" {
        print "✗ Policy violations detected:"
        $result.violations | table
        return 1
    }

    print "✓ All security policies satisfied"
}
```

### 4. Cost Estimation

```nushell
def test-cost-estimation [] {
    print "Estimating infrastructure costs..."

    let estimate = (
        provisioning estimate cost \
            --config workspace/config/production.ncl \
            --region us-east-1 \
            --annual true
    )

    print $"Monthly Cost: $($estimate.monthly_cost)"
    print $"Annual Cost: $($estimate.annual_cost)"

    # Verify against budget
    if $estimate.monthly_cost > 10000 {
        print "✗ Estimated cost exceeds budget!"
        return 1
    }

    print "✓ Estimated cost within budget"
}
```

## Unit Tests

### Testing Nickel Functions

```nickel
# workspace/config/tests/compute.test.ncl
let compute = import "compute.ncl"

let test_instance_sizing = {
  name = "Instance sizing calculation",
  test = fun () =>
    let result = compute.calculate_instance_type {
      cpu_required = 16,
      memory_required_gb = 64
    }
    result.instance_type == "t3.2xlarge"
}

let test_invalid_cpu = {
  name = "Reject invalid CPU count",
  test = fun () =>
    (compute.validate_cpu 0) == false
}

[test_instance_sizing, test_invalid_cpu]
```

### Running Nickel Unit Tests

```bash
provisioning test unit \
    --config-path workspace/config/tests \
    --match "*.test.ncl"

# Output:
# Test: Instance sizing calculation ... PASSED
# Test: Reject invalid CPU count ... PASSED
# Tests: 2 passed, 0 failed
```

## Integration Tests

### Testing Deployment Workflow

```nushell
def test-deployment-integration [] {
    print "Running integration test: complete deployment..."

    # Use test environment
    let test_workspace = "test-integration-$(date now | date to-record | get timestamp)"

    # Step 1: Create test workspace
    provisioning workspace create \
        --name $test_workspace \
        --from-template "workspace-template"

    # Step 2: Deploy to test environment
    let deployment = (
        provisioning deploy \
            --workspace $test_workspace \
            --environment test \
            --skip-approval
    )

    # Step 3: Run smoke tests
    let tests = (
        provisioning test smoke \
            --workspace $test_workspace \
            --checks [
                "health-endpoint",
                "database-connectivity",
                "cache-availability",
                "api-functionality"
            ]
    )

    if $tests.status != "passed" {
        print "✗ Integration test failed"
        return 1
    }

    # Step 4: Cleanup
    provisioning workspace delete --name $test_workspace --force

    print "✓ Integration test passed"
}
```

## End-to-End Tests

### Testing Production Deployment

```nushell
def test-production-deploy-e2e [] {
    print "Running E2E test: production deployment..."

    # Use staging environment
    let staging_config = (
        provisioning config export \
            --workspace production \
            --environment staging
    )

    # Deploy to staging (mirrors production)
    let staging_deploy = (
        provisioning deploy \
            --config $staging_config \
            --environment staging
    )

    # Run comprehensive test suite
    let test_results = (
        provisioning test comprehensive \
            --environment staging \
            --test-suites [
                "authentication",
                "data-consistency",
                "performance",
                "security",
                "compliance"
            ]
    )

    if $test_results.all_passed != true {
        print "✗ E2E tests failed in staging:"
        $test_results.failures | table
        return 1
    }

    print "✓ All E2E tests passed in staging"
    print "Production deployment approved"
}
```

## Mutation Testing

### Testing Configuration Resilience

```nushell
def test-mutation-resilience [] {
    print "Testing configuration mutation resilience..."

    let mutations = [
        {
            target = "database.backup_retention_days",
            change = "from 30 to 7",
            expected_warning = "low_retention_period"
        },
        {
            target = "compute.instance_count",
            change = "from 3 to 1",
            expected_warning = "insufficient_redundancy"
        },
        {
            target = "security.encryption",
            change = "from aes-256 to none",
            expected_error = "encryption_required"
        }
    ]

    $mutations | each { | mutation |
        let mutated_config = (
            provisioning config mutate \
                --config workspace/config/production.ncl \
                --target $mutation.target \
                --change $mutation.change
        )

        let validation = (
            provisioning validate config --config $mutated_config
        )

        if $mutation.expected_error {
            if ($validation.errors | any { | | e $e.code == $mutation.expected_error }) {
                print $"✓ Caught expected error: ($mutation.expected_error)"
            } else {
                print $"✗ Did not catch expected error: ($mutation.expected_error)"
                return 1
            }
        } else if $mutation.expected_warning {
            if ($validation.warnings | any { | | w $w.code == $mutation.expected_warning }) {
                print $"✓ Generated expected warning: ($mutation.expected_warning)"
            }
        }
    }

    print "✓ Configuration resilience verified"
}
```

## Performance Testing

### Load Testing Deployment

```nushell
def test-deployment-performance [] {
    print "Running performance tests..."

    let load_test = (
        provisioning test load \
            --workspace test \
            --concurrent-users 100 \
            --duration 5m \
            --ramp-up 1m
    )

    let results = {
        avg_response_time: $load_test.avg_latency_ms,
        p95_response_time: $load_test.p95_latency_ms,
        p99_response_time: $load_test.p99_latency_ms,
        error_rate: $load_test.error_rate,
        throughput: $load_test.throughput
    }

    print "Performance Test Results:"
    print $"Avg Response Time: ($results.avg_response_time)ms"
    print $"P95 Response Time: ($results.p95_response_time)ms"
    print $"P99 Response Time: ($results.p99_response_time)ms"
    print $"Error Rate: ($results.error_rate)%"
    print $"Throughput: ($results.throughput) req/s"

    if $results.p99_response_time > 200 {
        print "✗ P99 latency exceeds 200ms threshold"
        return 1
    }

    if $results.error_rate > 0.1 {
        print "✗ Error rate exceeds 0.1% threshold"
        return 1
    }

    print "✓ Performance tests passed"
}
```

## Compliance Testing

### Testing Regulatory Compliance

```nushell
def test-compliance [] {
    print "Testing compliance requirements..."

    let frameworks = ["soc2", "gdpr", "pci-dss", "hipaa"]

    $frameworks | each { | framework |
        let result = (
            provisioning test compliance \
                --config workspace/config/production.ncl \
                --framework $framework
        )

        if $result.status != "compliant" {
            print $"✗ ($framework) compliance violations:"
            $result.violations | each { | violation |
                print $"  - ($violation.control): ($violation.message)"
            }
            return 1
        }

        print $"✓ ($framework) requirements satisfied"
    }

    print "✓ All compliance frameworks validated"
}
```

## Test Automation in CI/CD

```yaml
# .github/workflows/iac-test.yml
name: Infrastructure-as-Code Tests

on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: Syntax validation
        run: provisioning test syntax --path workspace/config

      - name: Schema validation
        run: provisioning test schema --path workspace/config

      - name: Policy validation
        run: provisioning test policies --path workspace/config

      - name: Cost estimation
        run: provisioning test cost --path workspace/config

      - name: Unit tests
        run: provisioning test unit --path workspace/config/tests

      - name: Integration tests
        run: provisioning test integration --environment test

      - name: Compliance tests
        run: provisioning test compliance --framework soc2,gdpr,pci-dss

      - name: Security scan
        run: provisioning test security --path workspace/config

      - name: Generate report
        if: always()
        run: provisioning test report --output test-report.html

      - name: Upload report
        if: always()
        uses: actions/upload-artifact@v2
        with:
          name: test-report
          path: test-report.html
```

## Test Coverage Metrics

```bash
provisioning test coverage \
    --workspace production \
    --output coverage-report.html

# Output:
# Infrastructure-as-Code Test Coverage Report
#
# Test Category         | Coverage | Details
# Syntax Validation     | 100%     | All .ncl files validated
# Schema Validation     | 100%     | 45/45 configs compliant
# Policy Validation     | 95%      | 19/20 policies enforced
# Unit Tests            | 87%      | 52/60 functions tested
# Integration Tests     | 85%      | 17/20 deployments tested
# E2E Tests             | 80%      | 4/5 workflows validated
# Compliance Tests      | 100%     | 4/4 frameworks certified
#
# Overall Coverage: 90%
```

## See Also

- [Testing Infrastructure](../development/testing-infrastructure.md)
- [Nickel Guide](../infrastructure/nickel-guide.md)
- [Configuration System](../infrastructure/configuration-system.md)
