Domain 3 of 6 · Chapter 2 of 2

Support Testing and Security

Unlock the complete study guide.

Bundled into the existing GitHub Copilot premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • The check loop: Copilot proposes, evidence decides
  • Test levels: unit, integration, and end-to-end
  • Generating unit tests from the target code
  • Mocks: what a test double proves and what it does not
  • Integration tests: verifying component interactions
  • End-to-end tests: user-visible flows
  • Edge cases: limits, unusual inputs, and failure paths
  • Test structure: Arrange, Act, Assert
  • Assertions that prove the contract
  • Asking Copilot what is still untested
  • Security review prompts and their limits
  • Vetting the packages Copilot suggests
  • Performance optimization as a hypothesis
  • Testing, security, and performance scenarios and responses

Unit, integration and end-to-end tests: what each Copilot prompt must name

What you decideUnit testIntegration testEnd-to-end test
What it verifiesOne function or class against its contractThe interaction between named componentsA user-visible flow through the application
What the prompt namesThe target function or class, plus edge cases and exceptionsThe components, the interaction, and which dependency is real or mockedThe user flow, the expected page behavior, and the API responses
External dependenciesReplaced by mocks or stubsChosen per dependency: real or mockedAPI responses mocked in GitHub's Playwright example
Typical assertionReturn value, state, or the raised exceptionThe mock was called once with the expected argumentsThe page shows the product, or an error message for a 404
GitHub Docs example`BankAccount` deposit and withdraw`BankAccount` with a mocked `NotificationSystem`A product details page tested with Playwright

Decision tree

Testing what thecode should do?YesWhich scope doesthe test exercise?one functionor classUnit testdependencies mockednamed componentsinteractingIntegration testname real vs mockeda user-visibleflowEnd-to-end testassert what the user seesNoExploitable weakness ininput, access or data?YesSecurity reviewthen code scanningNo: slow codePerformance reviewselect the hotspotThen: run the result, measure it when speed is the concern, and ask Copilot what is missing
Cheat sheet

Cheat sheet

  • Unit-test generation starts from target code
  • Existing tests convey framework conventions
  • Complex unit-test generation needs staged prompts
  • Unit tests isolate external dependencies
  • Unit tests should target observable behavior
  • Integration tests verify component interactions
  • Integration prompts should specify dependency handling
  • End-to-end tests cover user-visible flows
  • Generated integration tests must be executed and reviewed
  • Boundary tests exercise values around limits
  • Input tests include null, empty, and unexpected types
  • Failure paths should preserve protected state
  • Copilot can inventory missing scenarios
  • Assertions should verify contract outputs
  • Assertions should verify expected errors
  • Assertions can verify collaborator interactions
  • Generated tests should separate setup, action, and assertion
  • Security review checks untrusted input handling
  • Security review checks authentication and authorization
  • Security review checks sensitive-data exposure
  • Suggested dependencies require independent verification
  • Copilot security feedback does not replace security controls
  • Performance prompts should identify the hotspot
  • Copilot can suggest algorithm and data-structure changes
  • Loop-invariant work should not repeat per iteration
  • Performance review includes data access and blocking work
  • Performance suggestions require measurement and correctness checks

Unlock with Premium — includes all practice exams and the complete study guide.

References

  1. https://docs.github.com/en/copilot/tutorials/write-tests
  2. https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/gh-300
  3. https://docs.github.com/en/copilot/tutorials/copilot-cookbook/testing-code/create-end-to-end-tests
  4. https://docs.github.com/en/copilot/tutorials/copilot-cookbook/testing-code/generate-unit-tests
  5. https://docs.github.com/en/copilot/responsible-use/chat
  6. https://docs.github.com/en/copilot/tutorials/customization-library/prompt-files/generate-unit-tests
  7. https://docs.github.com/en/copilot/tutorials/copilot-cookbook/testing-code/create-mock-objects
  8. https://docs.github.com/en/copilot/tutorials/review-ai-generated-code
  9. https://docs.github.com/en/copilot/tutorials/customization-library/prompt-files/review-code
  10. https://docs.github.com/en/copilot/tutorials/copilot-cookbook/analyze-security/find-vulnerabilities
  11. https://docs.github.com/en/copilot/tutorials/optimize-code-reviews
  12. https://docs.github.com/en/code-security/concepts/code-scanning/code-scanning
  13. https://docs.github.com/en/code-security/concepts/secret-security/secret-scanning
  14. https://cheatsheetseries.owasp.org/cheatsheets/NPM_Security_Cheat_Sheet.html
  15. https://docs.github.com/en/copilot/tutorials/copilot-cookbook/refactor-code/refactor-for-optimization
  16. https://learn.microsoft.com/en-us/dotnet/api/system.collections.specialized.listdictionary
  17. https://learn.microsoft.com/en-us/dotnet/api/system.collections.hashtable
  18. https://learn.microsoft.com/en-us/dotnet/standard/collections/selecting-a-collection-class
  19. https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.dictionary-2