Shift-Left Testing

Also Known As

TL;DR

Explanation

Traditional testing pyramid deferred integration and security testing to late stages. Shift-left brings it forward: pre-commit hooks run linting and unit tests locally, PRs trigger full CI (unit, integration, static analysis, SAST), feature branches deploy to ephemeral environments, and security scanning runs before merge. Cost of fixing a bug: $1 at commit time, $10 in PR review, $100 in staging, $1000 in production. Shift-left tools: pre-commit hooks, GitHub Actions, PHPStan, SAST scanners, contract tests.

Common Misconception

Why It Matters

Common Mistakes

• Slow pre-commit hooks — hooks over 10 seconds get bypassed with --no-verify.
• Only linting in pre-commit — include fast unit tests for immediate feedback.
• No ephemeral PR environments — developers cannot test their changes in isolation.
• Security scanning only before release — SAST should run on every PR.

Code Examples

// All testing deferred to staging:
// Developer commits → pushed to main → deployed to staging
// QA tests manually → finds bug after 3 days
// Developer context-switched to other work
// Fixing: 1 hour of relearning + 30 min fix
// Cost: 1.5 hours + delayed release

// Shift-left: caught immediately:
// pre-commit: phpcs + phpstan (10 seconds)
// PR: full CI in 5 minutes:
//   unit tests, integration tests
//   static analysis at level 8
//   SAST scan (SonarQube)
//   Lighthouse CI for performance
//   Ephemeral environment deployed
// Developer still has full context
// Fixing: 10 minutes

References

• ↗ https://www.ibm.com/topics/shift-left-testing

Tags

Related Terms