Business Review: The Gateway to Automation

Automation is a must. Not only because it's the main principle for REAL DevOps but also because is the only way to work properly on the Cloud. As you move your workloads to the cloud, you will learn you will need to change your mindsets too. Automation is something everybody talks about at the end of the day people dont create 100% automation overnight. Often people dont know what to automate and that a problem with often is not tackle by teams. Today I want to share a kanban practice that I do since 2009 and hope this help your team to increase automation. This practice is called business review.  Most modern teams dont have QA anymore and engineers are responsible for creating their own tests, however often as engineers, we could get sloppy and forget to do proper testing and this sloppiness has a price of bugs created by the lack of tests. Business Review is a peer review process where engineers review their peers work, similar to the Code Review but looking to different things.
 Why Code Review is Not Enough? 

Code Review is great, dont get me wrong. However, is not enough. Often code review focus on the technical quality.  Concerns such as the following are evaluated: 
  • Is the Design correct?
  • Is the performance acceptable? 
  • Are we using the best algorithms and Data Structures?
  • Are we doing any kind of danger coding? throw exceptions? null return? 
  • Are all validations in place?
  • Are the tests in place? Unit? Integration? Mocked? Stress? Chaos? 
IMHO We should not focus in style for code review. Because style is pointless. Clean Code often makes you focus on the wrong things like should I use a for streams in java for instance. Changing for to Streams is a waste of time, not mention is slow. So if code reviews get all these great things to mention before, why this is not enough? Because we are missing Business. Therefore we are missing automation. However this review cannot be done only looking to the source code, we need to do more stuff. 

The Principles Behind Business Review

First of all. Does the UI works? do we see any bad CSS or ugly thing? Secondly is the i18n right? If all is good. Them some clicks won't kill anyone. These clicks are called exploratory tests.  Exploratory tests are important, you dont need to spend an hour doing clicks and testing things but for sure a couple of minutes won't kill anyone. Your findings might also reduce bugs but more important REVEAL automation points that might be missing like: 
   A) Do we have proper CI/CD/GitOps pipeline in place?
   B) Is the test coverage good? 
   C) Are we missing an error or failure scenarios? 

Business Review also serves for you to check the contract TESTS to see if any API was broken. That could be for the backend or even for the frontend.  After a couple of cycles, you should get nothing more on the business review. If you are not adding more tests and increasing your automation the business review loses his point. Because if you dont increase automation you are just doing manual QA and manual QA dont scale and is super expensive. Remember the point is to have a gateway drug to automation. Business Review is best captured by a kanban queue and all engineers should do BR(Business Review) in regular rotations. 

Increasing Parallelism with Mock Contract Tests

Frontend always will depend on the backend. However, is not cool to let the frontend guys waiting to engineer something if the backend is not done. Because this will increase LEAD TIME and we want to the other way around and reduce LEAD TIME. In order to do that we need to have the contract of the APIs defined by the discovery TEAM(Architect + UX + BA)  and the developers must receive the contract defined by the discovery. Having the contract the frontend and backend can work in parallel and this will reduce the waiting time. 

Greater parallelism has a price. You will see more merges, which is completely fine. Also, you will need additional story to unplug the mocks at some point and test the system as a whole. During the process, you might create E2E or Integration Tests. Integration Tests are great but they should be a very small percentage of your tests, you should have way more unit tests them integration ones. 

The issue with integration tests is that they are SLOW and they depend on Data and easily you might lose this data or get outdated and this is WASTE for the developer.  But hold on a second, as we do the thing in parallel how do we know we dont break each other, well there are 2 actions we can take to make sure that does not happen. First, the contracts(best defined in Swagger nowadays) come from the discovery and the developers cannot change the contract without talking with the discovery team. Second, instead of doing lots of integration testes we do MOCK CONTRACT tests.  These tests can be done with regular mocking tools and uni testing tools, for instance in java could be JUnit + Mockito. Contract tests should be versioned and they must be lightweight so developers can run all the time and this will make sure we are not breaking each other(frontend and backend). 

As the time pass and you gain more traction is fine to remove the business review queue from kanban at some point. In the beginning, is very important to have this queue with very explicit queue policies in order to have developer aware what they need to do like: click on the ui, do exploratory tests, check the internationalization, run all testes, check the deb scripts and so on and on. 

Cheers,
Diego Pacheco

Popular posts from this blog

C Unit Testing with Check

Image
When I start on IT, several years ago(+15), C was the first language that I learned. But was not the first language I mastered and deployed in production which was...surprisingly Visual Basic 6.0. However, when I learned C or any language back on that old and arcane time noddy was into testing. However now is impossible to work professionally in any language without tests. C is a low-level language but still kicks ass and has several interesting libs/frameworks. People use to fear C a lot because of lack of syntactical sugar but once you get used to it is not that hard at all. Today I want to show how you can do Unit Testing with C. I will not show how to do Unit Testing with C++ but with C ANSI actually. We will be using Check a unit test lib for C ANSI.
read more »

Having fun with Zig Language

Image
Zig is a general-purpose language created in 2016 by Andrew Kelly .  Zig aims to fix the issues C language has while being pragmatic and simple at the same time. Zig really shines as being simple by not having any hidden control flows, not having hidden memory allocations, no pre-processors, and no macros. Basically, it's one language and one language only. Since pre-processors and macros can get really complex and become their own universe. Sure it's not the Zig Philosophy.  Zig Compiler(Zig cc) also is a C compiler, and the interoperability from C to Zig is very good. Clearly, we can see influence from other languages like Go and Rust; however, Zig is pretty unique and different from Go and Rust.  Zig is fast. Zig is perfect for system programming. I bet we will see a lot of solutions being built in Zig. As a languages aficionado, I like to learn at least one language per year and sometimes more; Zig was my 2021 pick, did not regret it. Even if you dont use all language...
Keep reading

HMAC in Java

Image
In 2018 AWS CTO(Vogels) said : "Security is everyone's job". For the last 2 years, there was so many famous and big data leaks and breaks that made that statement be very true more than ever. Security often could mean worst performance and worst user experience so in order to get it right you really need to think about the designs before jumping into to code and consider performance and user experience has main requirements.  I was thinking about writing about how to do HMAC in Java for a while and recently Redis 6.0.0 come out and to my surprise, there was a refactoring on the password part in order to use HMAC.  Security easily could scare engineers often because it is not something well spread yet but I believe this will change soon. It does not matter if you have to deal with PII Data or not, security is super relevant because everybody is running their workloads at the cloud or with IoT and Edge devices which means more distribution, more code, more points of fail...
read more »