SHRASIT Solutions
Services · QA & Testing

Quality engineering, in CI.

Strategy, automation, performance, security, accessibility and data-quality testing, engineered into the pipeline you already run. Not a manual squad brought in three sprints before go-live, an in-CI gating contract that turns every merge into a release candidate.

ci.shras.io / build #21847Live

  • Lint

    01

  • Unit

    02

  • Integration

    03

  • E2E

    04

  • Deploy

    05

Suite

2,184

Pass

2,178

Flake

6

Defects caught pre-prod
0%
Automation coverage on shipped suites
0%
Mean time to repair on flake
0 min
Quality gates wired into CI
0

The pyramid we ship

Heavy at the base. Cheap to run. Hard to fool.

Shift-left is not a slogan. The fastest, most deterministic tests live next to the code, gated on every push. E2E and exploratory carry weight only where the lower tiers genuinely cannot.

Coverage shape · target distributionShift-left
  • Unit62%

    Fast, deterministic, written next to the code. Vitest, JUnit, pytest. Runs on every push.

  • Integration22%

    Service contracts, persistence, queue handlers, API boundaries. Pact and Testcontainers.

  • E2E12%

    Critical user journeys only. Playwright sharded across browsers, retried with bisect on flake.

  • Manual exploratory4%

    Charter-led, time-boxed sessions on areas the suite does not cover. Recorded, not free-form.

What we run

Six test types, one accountable practice.

A test isn’t shipped until it gates. Each type below ships with a CI contract, a flake budget and a remediation owner.

Functional

Behaviour, end to end.

  • Critical journeys gated on every PR, not nightly
  • BDD specs reviewed by product, not just QA
  • Visual regression with Percy or Chromatic on design-system surfaces
PlaywrightCypressSeleniumWebdriverIO
Performance

Load, soak, stress, spike.

  • Production-shaped traffic synthesised from real telemetry, not flat RPS
  • P95 / P99 budgets per endpoint, broken-build on regression
  • Soak runs that surface leaks the smoke pass misses
k6JMeterGatlingLocust
Security

OWASP, SAST, DAST, SCA.

  • Authenticated DAST scans on staging, not just unauthed crawls
  • Dependency and container scanning on every merge
  • Manual penetration tests by certified consultants on quarterly cadence
OWASP ZAPBurp SuiteSnykTrivySemgrep
Accessibility

WCAG 2.2 AA, audited.

  • Automated axe-core in CI, plus structured manual screen-reader walks
  • Keyboard-only journey tests on every flagship flow
  • Remediation specs with line-level guidance, not just JIRA tickets
axe-corePa11yLighthouseNVDAVoiceOver
API

Contracts, schemas, lifecycles.

  • OpenAPI / GraphQL schema drift caught at PR time
  • Consumer-driven contracts via Pact across service boundaries
  • Replay-based regression on prod-shaped traffic captures
PostmanRestAssuredPactKarateNewman
Data quality

Pipelines that fail loudly.

  • Schema, distribution and freshness checks on every batch
  • Lineage assertions and dbt tests wired into orchestration
  • Row-level expectations published as data contracts
dbt-testsGreat ExpectationsSodaMonte Carlo

In-CI gating

The gate is the contract.

Every quality outcome is expressed as a stage, a budget and a fail condition. The pipeline is the source of truth, not a wiki page or a release-manager call.

Below: a stylised version of the YAML we drop into your repo. Real configs are tuned per service.

quality-gates.yml
CI contract
# .github/workflows/quality-gates.yml lint:  eslint: error-on-warn       # zero warnings ship to main  prettier: required  stylelint: required unit:  threshold: 85%             # branch coverage gate  flake_budget: 0            # quarantine on first flake integration:  contract_tests: required   # provider + consumer  data_fixtures: hermetic e2e:  playwright: smoke + critical  axe_a11y: 0 violations     # WCAG 2.2 AA  perf_budget: lcp < 2.0s    # Lighthouse CI security:  zap_baseline: required  snyk: high+ blocks merge  secret_scan: required deploy:  approval: human            # only after the gates above  rollback_plan: required

Tooling bench

The tools we run today, by category.

Tool choice is a strategy output, not a starting position. If your stack pins a different vendor, we have shipped on it.

Web

  • Playwright
  • Cypress
  • Selenium
  • WebdriverIO
  • Percy

Mobile

  • Appium
  • Maestro
  • XCUITest
  • Espresso
  • Detox

API

  • Postman
  • RestAssured
  • Pact
  • Karate
  • Newman

Performance

  • k6
  • JMeter
  • Gatling
  • Locust
  • Artillery

Security

  • OWASP ZAP
  • Burp Suite
  • Snyk
  • Trivy
  • Semgrep

Accessibility

  • axe-core
  • Pa11y
  • Lighthouse
  • NVDA
  • VoiceOver

Data

  • dbt-tests
  • Great Expectations
  • Soda
  • Monte Carlo

Methodology

Five steps. First gate live in week one.

  1. 01

    Strategy

    Risk model and test charter. We identify the journeys the business will not tolerate failing and write the gating contract before a line of test code is written.

  2. 02

    Design

    Pyramid shape, environment plan, data strategy and tooling decisions. Synthetic data, masked production, and seeded fixtures, chosen per service.

  3. 03

    Author

    Tests live next to the code, paired with the developer who wrote the feature. SDETs do not throw scripts over a wall.

  4. 04

    Run

    Sharded, retried, parallelised on the CI runner you already pay for. GitHub Actions, GitLab CI, Azure DevOps or Jenkins, with a flake budget.

  5. 05

    Govern

    Quarterly suite review: kill the dead tests, rebalance coverage, retune thresholds. Quality is a living portfolio, not a backlog.

WCAG 2.2 AA

Accessibility is table-stakes, not a deliverable label.

Government, healthcare and large-enterprise procurement now require WCAG 2.2 AA conformance, often before the master service agreement signs. We treat it as a first-class gate, not a slide bolted on at UAT.

Section 508 and EN 301 549 reporting layered on request.

What we audit

  • Keyboard-only journeys on every flagship flow
  • NVDA, JAWS and VoiceOver structured walks
  • Colour, contrast and reduced-motion conformance
  • Forms, ARIA, live regions and focus management

What we deliver

  • VPAT-ready audit report against WCAG 2.2 AA
  • Recorded screen-reader walkthroughs per journey
  • Line-level remediation specs, not just JIRAs
  • axe-core wired into CI with a regression budget

Where this fits

Three commercial shapes. Pick the one that matches your gap.

Mode 01Advisory

Test-strategy advisory

An eight-week reset for an existing QA function.

We audit your suite, environments and CI gates, then deliver a target operating model, prioritised remediation backlog and a budget for the next twelve months.

  • Fixed-fee, eight-week engagement
  • Two senior consultants and a principal SDET
  • Deliverables: audit report, target model, twelve-month plan
Fixed fee
Mode 02Embedded

Embedded SDET squad

Two to six SDETs, in your standups, on your repos.

A pod that pairs directly with your engineers under your sprint cadence and your tooling. We bring playbooks; we leave with your team upskilled and the suite in their hands.

  • Per-engineer monthly rate
  • Three-month minimum, scale up or down monthly
  • Senior pair-lead included at no extra fee
T&M, monthly
Mode 03Outcome

Outcome-based managed QA

We carry the gate, you carry the release.

Managed QA against agreed outcomes: escape rate, gate latency, automation coverage, accessibility conformance. SLA penalties on misses, bonuses on overshoot.

  • Outcome-based pricing with SLA credits
  • Twelve-month minimum, follow-the-sun coverage
  • Quarterly business reviews against agreed quality KPIs
Outcome SLA

FAQ

The questions procurement always asks.

If yours isn’t here, brief us, an SDET principal will reply, not a sales rep.

Should we keep QA in-house or hand it to you?Open

Most enterprises do both. The product team owns unit and integration tests; we own the cross-cutting layers, performance, security, accessibility, data quality, and the CI gating contract. Embedded SDET pods leave with your team upskilled, not dependent.

We have a tooling preference. Will you respect it?Open

Yes. The tools listed on this page are what we run most often, but we have shipped on Selenium, Robot Framework, Karate, JMeter, LoadRunner, Tricentis Tosca and others. Tool selection is part of the strategy phase, never the first decision.

What is your accessibility scope?Open

WCAG 2.2 AA against the journeys your customers and your regulator both care about. Automated axe-core in CI, structured manual screen-reader walks on the flagship flows, and remediation specs with line-level guidance. We can layer Section 508 or EN 301 549 reporting on top.

How do you handle data privacy in test environments?Open

Synthetic data first, masked production second, never raw production. We build masking pipelines that preserve referential integrity for realism without exposing PII or PHI. Compliant with GDPR, PDPL, HIPAA and the GCC residency rules our enterprise clients operate under.

What does a typical engagement look like in week one?Open

Day one: charter and risk model workshop. Day three: environment and data audit complete. Week one closes with the gating contract drafted, a flake-budget agreed, and the first three pipeline stages instrumented in your CI. No three-month discovery before any tests run.

Related practices

QA rarely ships alone. The four it most often ships with.

Talk to sales
Partner with us
Join the team