fastapi/fastapi
Testing is the repo's centre of gravity: 594 files under `tests/`, 213 top-level `test_*.py` modules, plus `tests/test_tutorial/` mirroring the 77 directories of `docs_src/` so every documented example is executed. The stack is pytest 9 with `pytest-xdist` (`-n auto --dist loadgroup`), `anyio[trio]`, `inline-snapshot` (used in ~299 files), `dirty-equals` (~31 files), `pytest-timeout` at 20s, and `filterwarnings = ["error"]`. CI enforces `coverage report --fail-under=100` over `fastapi`, `tests` and `docs_src` combined, across a matrix of Windows/macOS/Ubuntu and Python 3.10–3.14t, including free-threaded builds and a Starlette-from-git leg. Performance has its own gates via CodSpeed wall-clock and memory benchmarks. The notable gap is that everything runs through the in-process `TestClient`; there is no test that boots a real uvicorn server.
- The test command is `pytest -n auto --dist loadgroup tests scripts/tests/` with `PYTHONPATH=./docs_src`, so tutorial modules are importable by name from the tutorial tests.
- pytest is configured with `--strict-config --strict-markers --ignore=docs_src`, `strict_xfail = true`, `filterwarnings = ["error"]` and a 20-second per-test timeout, so any unexpected warning fails the suite.
- Coverage is measured over three source roots (`docs_src`, `tests`, `fastapi`) with `parallel = true` and per-runner `CONTEXT`, and the `coverage-combine` CI job ends with `coverage report --fail-under=100`.
- The CI matrix covers Windows and macOS on Python 3.14 and 3.14t (free-threaded) plus targeted Ubuntu/macOS legs for 3.10 (with `uv-resolution: lowest-direct` and a forced `pydantic==2.9.0`), 3.12, 3.13 and 3.14, and a `starlette-git` leg installing Starlette from main.
- A dedicated `regression-test` job checks out the PR base revision, applies only the PR's test diff, and warns via `::warning::` if the changed tests already pass without the code change — an automated 'does this test actually prove the fix' gate.
- Performance regressions are gated by two CodSpeed jobs: `pytest tests/benchmarks --codspeed` in simulation mode and `pytest tests/memory_benchmarks --codspeed` in memory mode.
- `inline-snapshot` is the dominant assertion style for OpenAPI and error payloads, appearing in roughly 299 test files, with CI setting `INLINE_SNAPSHOT_DEFAULT_FLAGS: review` to prevent silent snapshot rewrites.
- The new frontend feature is densely covered: `tests/test_frontend.py` has 40+ tests including Accept-header q-value parsing, path-segment boundary matching, trailing-slash normalization, dependency ordering across nested `include_router`, and `PermissionError`/`ENAMETOOLONG` lookup failures.
- Streaming has dedicated suites for SSE (`tests/test_sse.py`), cancellation (`tests/test_stream_cancellation.py`), item validation errors (`tests/test_stream_json_validation_error.py`), bare types and status codes, plus tutorial tests under `tests/test_tutorial/test_server_sent_events` and `test_stream_json_lines`.
- Security coverage is per-scheme and per-variant — around 30 files spanning `test_security_http_basic*`, `test_security_api_key_*`, `test_security_oauth2*`, `test_security_scopes*`, `test_security_openid_connect*`, plus `test_webhooks_security.py` and `test_top_level_security_scheme_in_openapi.py`.
- Performance claims in the code are pinned by behavioural tests: `tests/test_dump_json_fast_path.py` patches `starlette.responses.json.dumps` and asserts it is never called on the default-response-class path.
- Static analysis is part of the gate, not optional: `.pre-commit-config.yaml` runs ruff check/format, `mypy fastapi` (with `strict = true`), `ty check` (`error-on-warning = true`), typos, and `zizmor` over `.github/workflows/`.
- `tests/main.py` is a shared 'kitchen sink' app used by several suites, registering `api_route`, `add_api_route`, path converters and enum/http-status params against a single `FastAPI(openapi_external_docs=...)` instance.
- Uncovered by the suite: no test exercises a real ASGI server process — every HTTP assertion goes through Starlette's in-process `TestClient`, so uvicorn/h11 interactions (real backpressure, client disconnect over a socket) are untested here. (inferred)