代码级测试（静态分析与动态测试与变异测试）

<!-- Maven 项目集成 SonarQube：pom.xml 关键配置 -->
<plugin>
    <groupId>org.sonarsource.scanner.maven</groupId>
    <artifactId>sonar-maven-plugin</artifactId>
    <version>5.0.0.4389</version>
    <!-- 通过 sonar.token 认证（v10 起废弃 sonar.login） -->
</plugin>

<!-- 同时在 settings.xml 中配置 sonar.host.url 与 sonar.token -->
<!-- 扫描命令：mvn clean verify sonar:sonar -->

# .github/workflows/sonarqube.yml —— GitHub Actions 集成
name: SonarQube Analysis
on:
  pull_request:
    types: [opened, synchronize, reopened]
jobs:
  sonarqube:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # SonarQube 需要完整 Git 历史计算新代码
      - uses: SonarSource/sonarqube-scan-action@v5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}

# Semgrep 自定义规则示例：禁止硬编码密钥
rules:
  - id: hardcoded-secret-detection
    pattern-regex: '(api[_-]?key|secret)\s*[:=]\s*["''][^"'']{16,}["'']'
    languages: [python, javascript, java]
    message: 检测到硬编码密钥，应改用环境变量或密钥管理服务
    severity: ERROR

<!-- JaCoCo Maven 配置：pom.xml -->
<plugin>
    <groupId>org.jacoco</groupId>
    <artifactId>jacoco-maven-plugin</artifactId>
    <version>0.8.12</version>
    <executions>
        <execution>
            <id>prepare-agent</id>
            <goals><goal>prepare-agent</goal></goals>
        </execution>
        <execution>
            <id>report</id>
            <phase>test</phase>
            <goals><goal>report</goal></goals>
        </execution>
        <execution>
            <id>check</id>
            <goals><goal>check</goal></goals>
            <configuration>
                <rules>
                    <rule>
                        <element>BUNDLE</element>
                        <limits>
                            <!-- 行覆盖率门槛：80% -->
                            <limit>
                                <counter>LINE</counter>
                                <value>COVEREDRATIO</value>
                                <minimum>0.80</minimum>
                            </limit>
                            <!-- 分支覆盖率门槛：70% -->
                            <limit>
                                <counter>BRANCH</counter>
                                <value>COVEREDRATIO</value>
                                <minimum>0.70</minimum>
                            </limit>
                        </limits>
                    </rule>
                </rules>
            </configuration>
        </execution>
    </executions>
</plugin>

# 运行测试并收集覆盖率
coverage run -m pytest
coverage report -m          # 终端报告，显示未覆盖行号
coverage html               # 生成 HTML 详细报告
# 配置文件 .coveragerc 可设置 source、omit、fail_under 等门槛

// Jazzer 模糊测试示例：自动发现解析函数的边界异常
import com.code_intelligence.jazzer.api.FuzzedDataProvider;

public class ParserFuzzTest {
    public static void fuzzerTestOneInput(FuzzedDataProvider data) {
        String input = data.consumeRemainingAsString();
        try {
            // 不验证具体返回值，只关注是否触发未预期异常
            Parser.parse(input);
        } catch (IllegalArgumentException e) {
            // 业务预期的异常，吞掉
        }
        // 其他异常（如 NullPointerException）将被 Jazzer 记录为缺陷
    }
}

<!-- PIT pitest Maven 配置：pom.xml -->
<plugin>
    <groupId>org.pitest</groupId>
    <artifactId>pitest-maven</artifactId>
    <version>1.16.1</version>
    <dependencies>
        <!-- 支持 JUnit 5 -->
        <dependency>
            <groupId>org.pitest</groupId>
            <artifactId>pitest-junit5-plugin</artifactId>
            <version>1.2.1</version>
        </dependency>
    </dependencies>
    <configuration>
        <targetClasses>
            <param>com.example.*</param>  <!-- 待变异的目标类 -->
        </targetClasses>
        <targetTests>
            <param>com.example.*Test</param>  <!-- 测试类 -->
        </targetTests>
        <mutators>
            <mutator>STRONGER</mutator>  <!-- 启用更强算子集 -->
        </mutators>
        <outputFormats>
            <param>HTML</param>           <!-- HTML 报告 -->
            <param>XML</param>
        </outputFormats>
        <mutationThreshold>85</mutationThreshold>  <!-- 变异分数门槛 85% -->
    </configuration>
</plugin>
<!-- 执行命令：mvn org.pitest:pitest-maven:mutationCoverage -->

# mutmut 使用流程
mutmut run                    # 运行变异测试
mutmut results                # 查看结果
mutmut show <mutant-id>       # 查看具体变异内容
mutmut html                   # 生成 HTML 报告
# 配置文件 setup.cfg 中可指定 paths_to_mutate 与 tests_dir

# Python Hypothesis 示例：验证字符串编解码的通用属性
from hypothesis import given, strategies as st

@given(st.text())  # 自动生成任意 Unicode 字符串
def test_encode_decode_roundtrip(s):
    """编解码往返属性：encode 后 decode 应得到原字符串"""
    encoded = s.encode('utf-8')
    decoded = encoded.decode('utf-8')
    assert decoded == s

@given(st.lists(st.integers(min_value=0, max_value=1000)))
def test_sum_non_negative(xs):
    """非负数列表求和结果非负"""
    assert sum(xs) >= 0