CI/CD pipeline guides — integrate automated testing into your deployment pipeline and ship with confidence.
Visual Testing
Reg-Suit is a visual regression testing framework built around a plugin architecture. Unlike tools that are opinionated about screenshot capture, Reg-Suit focuses on the comparison and reporting layer — you bring your own screenshots, and Reg-Suit handles storage, comparison, and CI status reporting. Architecture Reg-Suit separates three concerns: 1. Screenshot capture
iOS
Running xcodebuild test directly gives you raw XML logs, cryptic failures, and no easy way to integrate results into your CI pipeline. Fastlane's scan action wraps xcodebuild with sensible defaults, human-readable output, JUnit XML for CI consumption, HTML reports, and built-in Slack notifications. This guide covers scheme configuration,
Testing
SPF, DKIM, and DMARC misconfigurations are the most common reason transactional emails land in spam. This guide shows how to validate these DNS records in CI so you catch deliverability regressions before they reach production users. We cover automated DNS checks, DKIM signature verification, and integration with GitHub Actions. Why
Trivy
Trivy is a fast, comprehensive open-source vulnerability scanner from Aqua Security that scans container images, filesystems, Git repositories, Kubernetes manifests, and IaC files. This guide covers local scanning, GitHub Actions integration, SBOM generation, and managing findings with .trivyignore. Key Takeaways Trivy scans more than just OS packages. It detects vulnerabilities
Snyk
Snyk scans your dependencies, container images, infrastructure-as-code, and source code for vulnerabilities and license violations. This guide covers CLI integration for Node.js and Python, pull request checks in GitHub Actions, container image scanning, and managing false positives with policy files. Key Takeaways Snyk finds vulnerabilities in transitive dependencies, not
Semgrep
Semgrep is a fast, syntax-aware static analysis tool that lets you write custom security rules in YAML using code patterns rather than regular expressions. This guide covers rule syntax, writing custom rules for your codebase, using community rulesets, CI integration, and reducing false positives through triage and rule refinement. Key
OWASP ZAP
OWASP ZAP is the most widely used open-source web application security scanner. This guide covers integrating ZAP's Docker-based full scan and API scanning into GitHub Actions CI/CD pipelines, configuring authentication for authenticated scans, and handling alert triage to keep pipelines actionable. Key Takeaways Run ZAP as Docker
GraphQL
GraphQL schemas evolve, and every change carries the risk of breaking clients. Contract testing catches breaking changes before deployment by comparing schema versions and validating that client queries still work against the new schema. This post covers what counts as a breaking change, how to use GraphQL Inspector for schema
Maestro
Maestro is a mobile testing framework that replaces imperative test code with declarative YAML flows. You describe what the user does — tap this, type that, assert visible — and Maestro handles synchronization, retries, and cross-platform execution. This guide covers the flow syntax, handling dynamic content, CI integration, and how Maestro compares
Testing
Micro-frontends enable independent deployment — teams can release new versions of their micro-frontend without coordinating with other teams. But this independence creates CI/CD testing challenges: how do you test a remote in isolation, how do you verify the composition still works after a remote deploys, and how do you roll
Testing
Desktop apps must work on Linux, macOS, and Windows — and each platform has different rendering engines, file system behaviors, system APIs, and distribution formats. A CI/CD pipeline that only tests on one platform misses platform-specific bugs. This guide covers building cross-platform CI/CD testing pipelines for desktop applications built
Test Automation
EAS Build creates native iOS and Android builds in the cloud. For testing, EAS provides three distinct opportunities: preview builds for QA teams, build-time validation of native plugins, and production-equivalent builds for E2E testing. This guide covers testing strategies across the EAS Build pipeline: structuring build profiles, validating environment configs,