DevOps e QA: Integrando Qualidade no Pipeline de Entrega Contínua

---

A Evolução de QA para DevOps

DevOps representa a fusão de desenvolvimento e operações, com QA como ponte essencial entre os dois mundos. A qualidade não é mais uma fase separada, mas um valor integrado em cada etapa do pipeline.

Transformação Cultural

Tradicional	DevOps
QA como gatekeeper	QA como habilitador
Testes no final	Testes contínuos
Releases trimestrais	Deploys diários
Siloed teams	Squads multifuncionais
Reativo	Proativo

---

Pipeline de CI/CD com Qualidade Integrada

Visão Geral do Pipeline

Code → Build → Test → Security → Deploy → Monitor → Feedback
  ↓      ↓       ↓       ↓          ↓         ↓         ↓
Commit  Unit   Integration  SAST/DAST  Staging  APM     Retrospectiva
Review  Tests   + E2E       SCA        Deploy   Alerts

Estrutura do Pipeline

1. Stage: Code (Commit)

# .github/workflows/code-quality.yml
name: Code Quality

on: [push, pull_request]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

- name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

- name: Install linters
        run: pip install ruff black flake8

- name: Run Ruff (Linter)
        run: ruff check .

- name: Run Black (Formatter)
        run: black --check .

- name: Run type checker
        run: pip install mypy && mypy src/

2. Stage: Build

  build:
    needs: lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

- name: Build Docker image
        run: |
          docker build 
            --tag app:${{ github.sha }} 
            --tag app:latest 
            .

- name: Run Trivy (Container scan)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'app:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'

3. Stage: Unit Tests

  unit-tests:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

- name: Run Unit Tests
        run: |
          docker-compose run --rm test pytest 
            --cov=src 
            --cov-report=xml 
            --cov-fail-under=80

- name: Upload coverage
        uses: codecov/codecov-action@v3

4. Stage: Integration Tests

  integration-tests:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:15
        env:
          POSTGRES_DB: test
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
        ports:
          - 5432:5432

steps:
      - uses: actions/checkout@v4

- name: Run Integration Tests
        env:
          DATABASE_URL: postgresql://test:test@localhost:5432/test
        run: |
          docker-compose run --rm test pytest 
            tests/integration/ 
            -v 
            --tb=short

5. Stage: E2E Tests

  e2e-tests:
    runs-on: ubuntu-latest
    if: github.event_name == 'push'

steps:
      - uses: actions/checkout@v4

- name: Run E2E Tests
        run: |
          npm ci
          npx playwright install --with-deps
          npm run test:e2e

- name: Upload test results
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: playwright-report
          path: playwright-report/

6. Stage: Security Scan

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

- name: SAST with Semgrep
        uses: returntocorp/semgrep-action@v1

- name: SCA with Snyk
        uses: snyk/actions/python@master
        with:
          args: --severity-threshold=high

- name: DAST with OWASP ZAP
        run: |
          docker run -t owasp/zap2docker-stable 
            zap-baseline.py 
            -t https://staging.exemplo.com 
            -J zap-results.json

7. Stage: Deploy (Quality Gates)

  deploy-staging:
    needs: [security, e2e-tests]
    runs-on: ubuntu-latest
    environment: staging

steps:
      - name: Deploy to Staging
        run: |
          kubectl apply -f k8s/staging/

- name: Smoke Tests
        run: |
          curl -f https://staging.exemplo.com/health || exit 1

- name: Notify
        run: |
          echo "Deploy concluído para staging"

---

Quality Gates

Quality Gates são pontos de verificação que determinam se o código pode avançar no pipeline.

Critérios de Quality Gate

Gate	Critério	Ação se Falhar
Code Coverage	>80{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442}	Blocker
Code Quality	No critical issues	Blocker
Security Scan	No high/critical CVEs	Blocker
Unit Tests	100{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442} passing	Blocker
E2E Tests	>95{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442} passing	Blocker
Performance	P95 < 500ms	Warning

Implementação de Quality Gates

# Quality Gate no GitHub Actions
name: Check Quality Gates
  run: |
    # Verificar cobertura
    COVERAGE=$(cat coverage/coverage.xml | grep -oP '(?<=line-covered=")d+')
    TOTAL=$(cat coverage/coverage.xml | grep -oP '(?<=line-count=")d+')
    PERCENTAGE=$((COVERAGE * 100 / TOTAL))

echo "Coverage: ${PERCENTAGE}{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442}"

if [ $PERCENTAGE -lt 80 ]; then
      echo "❌ Coverage below 80{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442}"
      exit 1
    fi

# Verificar security
    if [ -f "snyk/snyk.sarif" ]; then
      VULNS=$(cat snyk/snyk.sarif | grep -c "high|critical")
      if [ $VULNS -gt 0 ]; then
        echo "❌ Security vulnerabilities found"
        exit 1
      fi
    fi

echo "✅ All quality gates passed"

---

TestContainers para Testes de Integração

# testcontainers_example.py
import pytest
from selenium import webdriver
from selenium.webdriver.common.by import By
from testcontainers.postgres import PostgresContainer
from testcontainers.redis import RedisContainer

@pytest.fixture(scope="class")
def postgres():
    with PostgresContainer("postgres:15") as postgres:
        url = postgres.get_connection_url()
        yield url

@pytest.fixture(scope="class")
def redis():
    with RedisContainer("redis:7") as redis:
        yield redis.get_connection_url()

@pytest.fixture(scope="class")
def app(postgres, redis):
    """SUT com dependências reais"""
    import os
    os.environ['DATABASE_URL'] = postgres
    os.environ['REDIS_URL'] = redis

from app import create_app
    app = create_app()
    app.config['TESTING'] = True

with app.app_context():
        from models import db
        db.create_all()

yield app

@pytest.fixture
def client(app):
    return app.test_client()

---

Métricas DevOps de Qualidade

Four Keys (DORA Metrics)

Métrica	Descrição	Target Elite
Deployment Frequency	Frequência de deploys	On-demand (várias vezes/dia)
Lead Time for Changes	Tempo do commit ao prod	<1 hora
Time to Restore	Tempo para recovery	<1 hora
Change Failure Rate	{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442} de deploys com falha	<15{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442}

Dashboard de Qualidade

# Métricas para Grafana
panels:
  - title: "Test Coverage"
    query: "coverage_percentage{job='unit-tests'}"
    thresholds:
      - value: 80
        color: green
      - value: 60
        color: yellow
      - value: 0
        color: red

- title: "Test Pass Rate"
    query: "rate(test_passed_total[5m]) / rate(test_total[5m])"
    thresholds:
      - value: 0.95
        color: green

- title: "Pipeline Duration"
    query: "histogram_quantile(0.95, pipeline_duration_bucket)"
    unit: "s"

- title: "Failed Deployments"
    query: "rate(deployment_failed_total[1h])"

---

Estratégia de Deploy

Canary Deployment

# Argo Rollouts Canary
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: my-app
spec:
  strategy:
    canary:
      steps:
        - setWeight: 5
        - pause: {duration: 10m}
        - setWeight: 20
        - pause: {duration: 10m}
        - setWeight: 50
        - pause: {duration: 30m}
      analysis:
        templates:
          - templateName: success-rate
        args:
          - name: service-name
            value: my-app-canary

Feature Flags

# Feature Flags com LaunchDarkly
import launchdarkly_server_sdk

client = launchdarkly_server_sdk.Client("sdk-key")

user = {
    "key": user_id,
    "email": email,
    "custom": {
        "team": team
    }
}

# Check feature flag
if client.variation("new_checkout", user, False):
    return new_checkout_flow()
else:
    return legacy_checkout_flow()

---

Conclusão

Integrar QA no DevOps não é apenas sobre ferramentas – é uma mudança cultural. As chaves para o sucesso são:

1. Automação em primeiro lugar – Tudo que pode ser automatizado deve
2. Quality Gates efetivos – Critérios claros para avanzar
3. Feedback rápido – Detectar problemas cedo
4. Métricas de qualidade – Medir é melhorar
5. Melhoria contínua – Retrospectivas e ajustes

---

FAQ

P: Como começar a integrar QA em DevOps?
R: Comece com unit tests no CI, depois expanda para integração e E2E gradualmente.

P: Quantos testes devo ter no pipeline?
R: Priorize por impacto e risco. Cobertura >80{6727d158e4474b0847515bd23a8ee4bebd5f1aac7a18bc968e51d8985dccb442} é bom target.

P: Quality Gates devem ser obrigatórios?
R: Para código em main, sim. Para feature branches, podem ser warnings.

P: Como medir ROI de DevOps QA?
R: DORA metrics + redução de bugs em produção + tempo economizado.