Test Data Management

<objective>
Create, maintain, and clean up test data that is deterministic, isolated, realistic, and safe. Good test data is the foundation of reliable tests -- without it, tests are either flaky (shared mutable state), unrealistic (hardcoded nonsense values), or dangerous (production PII in test environments). This skill delivers factories, fixtures, idempotent seeds, anonymization pipelines, and cleanup strategies that survive parallel execution.
</objective>

---

Quick Route

---

Discovery Questions

Before designing a test data strategy, understand the current state. Check .agents/qa-project-context.md first -- if it exists, use it as the foundation and skip questions already answered there.

Current Data Practices

• How is test data created today? (manually, scripts, copy of production, none)
• Do tests share data or does each test create its own?
• How is test data cleaned up? (truncate, rollback, manual, never)
• Are there seed scripts? Are they idempotent?

Privacy and Compliance

• Does the product handle PII? (names, emails, addresses, phone numbers, SSNs)
• Are there GDPR, HIPAA, PCI-DSS, or other data protection requirements?
• Is production data ever used in test environments?

Scale and Complexity

• How large are the test datasets? (dozens of records, thousands, millions)
• How complex are the data relationships? (simple CRUD, deep nested hierarchies, polymorphic)
• Are there cross-service data dependencies? (microservices sharing data)

---

Core Principles

1. Each Test Owns Its Data

Tests that rely on pre-existing shared data are fragile. When Test A modifies shared data, Test B breaks. Every test should create exactly the data it needs, verify against that data, and clean up after itself. This enables parallel execution and eliminates ordering dependencies.

2. Factories Over Fixtures for Dynamic Data

Static fixtures (JSON/YAML files) are appropriate for reference data that does not change (country codes, currency lists). For entity data that tests create and manipulate (users, orders, products), use factory functions that generate fresh instances with sensible defaults and allow per-test overrides.

3. Anonymize Production Data Before Use

Production databases contain the most realistic data, but they also contain real user information. Never copy production data to test environments without anonymization. Replace PII with synthetic equivalents while preserving data distributions and relationships.

4. Deterministic Data Enables Reproducible Tests

Tests should produce the same results regardless of when or where they run. Avoid Math.random(), Date.now(), or auto-increment IDs in assertions. Use seeded random generators (faker.seed(n)), fixed timestamps, factory sequences, and -- when an ID must be a UUID you assert on -- a seeded faker.string.uuid() so it stays stable across runs.

5. Minimize Data, Maximize Signal

Create only the data each test needs. A test for user search does not need a complete user profile with billing address, payment method, and order history. Over-specified test data obscures the intent of the test and increases maintenance burden.

---

Factory Patterns

Factories are functions that produce test data with sensible defaults, allowing individual tests to override only what matters for their scenario. Fishery (2.4.0) is the default for TypeScript, FactoryBot (6.6.0) for Ruby, factory-boy (3.3.3) for Python; all pair with faker (v10.4.0) for realistic field values.

See references/factories.md for the full Fishery (with associations and deterministic UUIDs), FactoryBot (User + Product out_of_stock/discounted traits), Factory Boy (class Params + Trait), and Playwright fixture implementations. The shape every factory follows:

• Defaults + overrides — Factory.define produces sensible defaults; tests pass overrides for the one field they care about (userFactory.build({ role: 'admin' })).
• Sequences for unique fields — sequence (Fishery), sequence(:email) (FactoryBot), factory.Sequence (Factory Boy) — never hardcode IDs or emails.
• Traits for variants — name common states (:admin, :inactive, out_of_stock, discounted) instead of spawning a fixture file per combination.
• Associations — one factory builds another (an order builds its user), keeping referential structure without manual wiring.

When to Use Factories vs Fixtures

Decision rule: If the data has a lifecycle (created, modified, deleted during tests), use a factory. If the data is read-only reference material, use a fixture file.

---

Fixture Strategies

Three fixture shapes, all in references/factories.md:

• Static fixtures (JSON/YAML) — best for API response mocks (page.route + route.fulfill), config data, and golden file comparisons.
• Dynamic fixtures (Playwright) — test.extend creates data via API before the test and deletes it after await use(...). The standard per-test setup/teardown.
• Fixture composition — combine factory-built data (userFactory.build(), orderFactory.buildList(3)) inside a single test.extend that seeds and cleans up in one step.

---

Data Anonymization

When production data is needed for realistic testing, anonymize it before use.

PII Masking Rules

The anonymization pipeline -- seeded Faker for determinism, an in-memory lookup table, parent-records-first ordering, and a wrapping transaction -- is in references/seeding-and-synthetic.md (Anonymization with Faker.js, Referential Integrity During Anonymization). Anonymizing a user's email must also update that email everywhere it is referenced (orders, comments, audit logs); process parents first, children second, using the same lookup, all inside one transaction.

GDPR Compliance Checklist

• No real PII exists in any non-production environment
• Anonymization is irreversible (no lookup table mapping back to originals is stored)
• Anonymization preserves data distributions (age ranges, geographic spread) for realistic testing
• Anonymized data cannot be re-identified through combination of quasi-identifiers
• Data retention policies apply to test environments (auto-delete after N days)
• The anonymization pipeline runs automatically, not manually (eliminates human error)

---

Database Seeding

Idempotent Seed Scripts

Seed scripts must be safe to run multiple times without duplicating data. Use upsert -- INSERT ... ON CONFLICT (natural_key) DO UPDATE SET ... -- keyed on a stable natural key, not the primary key. A DELETE-then-INSERT "reset" is not idempotent: it breaks foreign keys and reassigns serial IDs. See references/seeding-and-synthetic.md (Idempotent Seed Scripts) for the full INSERT ... ON CONFLICT (code) DO UPDATE countries/currencies example and the reasoning.

Database Branching (DB-as-a-Service)

If your prod DB lives on Neon, Supabase, or PlanetScale, branching can give a PR its own database instead of seeding from scratch -- but the providers differ on whether the branch carries data:

• Neon Branching — copy-on-write Postgres branches in seconds, with data; ideal for ephemeral preview envs. The strongest "PR gets a real DB copy" story.
• Supabase Branching — supabase branches create pr-123 clones schema and (optionally, from a backup) data; preview env points at the branch URL.
• PlanetScale Branching — MySQL branches are schema-only by default (no data), so you still seed the branch. Note: PlanetScale removed its free Hobby tier (April 2024); MySQL now starts at ~$39/mo, Postgres ~$5/mo.

Pair with the Preview Environments pattern in test-environments.

Avoid: Snaplet (hosted) — shut down 31 Aug 2024; the team joined Supabase. @snaplet/seed lives on as supabase-community/seed (community-maintained, last meaningful release v0.98.0, July 2024, no feature work since). For new projects, prefer the DB-branching providers above plus factory-generated seeds.

Per-Test vs Per-Suite Data

For the worker-scoped fixture (test.extend with { scope: 'worker' }) that powers per-worker seeding, see references/factories.md (Worker-Scoped Seeding).