Task 5.2: Support testing and security

• AA reference to the model test with #file: tests/test_orders.py, asking Copilot to follow it

  Correct

  GitHub's cookbook says that if you have an existing test you want Copilot to use as a model, you can provide its path with #file in the prompt.

• BA second /tests run, because the second run uses the first run's output as context

  Incorrect

  Repeating the command adds no information about the existing framework.

• CThe /fixTestFailure command, because it rewrites new tests into the project's framework

  Incorrect

  /fixTestFailure finds and fixes a failing test; it does not set the framework for new tests.

• DA setting that disables next edit suggestions, so that Copilot stops predicting unittest patterns

  Incorrect

  Next edit suggestions are unrelated to which test framework chat uses.

Chat variables such as #file include specific context in a prompt. GitHub's cookbook notes that if you have an existing test you want Copilot to use as a model, you can provide its path with #file and say so in the prompt; Copilot can then follow the framework and structure of that test. Always review generated tests and add any that are missing.

• AWrite unit tests for deposit that mock NotificationSystem

  Incorrect

  The task is an integration test of the interaction; the tutorial's prompt asks for integration tests and for a check that the system is called.

• BWrite tests for deposit that call the live NotificationSystem in a staging account with real data

  Incorrect

  Calling a live service is what the developer wants to avoid.

• CWrite integration tests for the whole BankAccount class with every dependency mocked at once

  Incorrect

  The tutorial breaks the request into smaller pieces and names the specific method (deposit) to test.

• DWrite integration tests for deposit that mock NotificationSystem and verify it is called correctly

  Correct

  The prompt states the scope (integration tests), the method and class, the use of mocks, and the verification that NotificationSystem is called.

GitHub's tutorial on writing tests shows an integration test prompt that specifies integration tests for the deposit function, explicitly asks for mocks to simulate the NotificationSystem, and asks Copilot to verify that it is called correctly after a deposit. A follow-up prompt then adds the invalid-deposit case where the notification must not be sent.

• AThe plan is sound, because Copilot Chat checks every file in the repository for every known CWE

  Incorrect

  The guidance says not to rely on Copilot Chat for a comprehensive security analysis.

• BKeep code scanning; Copilot Chat helps with common flaws but is not a full security analysis

  Correct

  The cookbook says not to rely on Copilot for a comprehensive analysis and that code scanning more thoroughly ensures code is secure.

• CThe plan works only if the prompt is saved as a prompt file in .github/prompts

  Incorrect

  Saving the prompt doesn't change the limits of the analysis.

• DReplace code scanning only for JavaScript, which Copilot supports best

  Incorrect

  Language support does not turn chat into a full security analysis.

Copilot Chat can help find common vulnerabilities such as cross-site scripting, SQL injection and CSRF and suggest fixes. GitHub's cookbook notes that you should not rely on Copilot for a comprehensive security analysis; code scanning more thoroughly ensures your code is secure.

• AWhether to upgrade to a paid plan before generating tests

  Incorrect

  Test generation isn't gated behind an upgrade prompt.

• BWhether to share the project's code with the public code index

  Incorrect

  Copilot doesn't ask to publish your code.

• CWhether to switch the chat to plan mode first

  Incorrect

  The cookbook doesn't describe a mode switch here.

• DWhether you want to configure unit tests for the project

  Correct

  The first time you ask Copilot Chat to generate unit tests, it may ask if you wish to configure unit tests for your project.

GitHub's cookbook example on generating unit tests notes that if it is your first time asking Copilot Chat to generate unit tests, it may ask whether you wish to configure unit tests for your project. Copilot then provides a strategy for the tests and the tests themselves; responses are non-deterministic, so review them.

• AGenerating only snapshot files, because dynamic HTML can't be tested end to end

  Incorrect

  The cookbook shows end-to-end tests that interact with the page.

• BEnd-to-end tests that drive the page and check it, e.g. with Playwright

  Correct

  Copilot Chat can suggest code to interact with the webpage and validate expected results; the example uses Playwright, but Selenium or Cypress work too.

• CRunning the tests itself in Copilot Chat and reporting pass rates

  Incorrect

  Chat suggests test code; you run it.

• DRecording a video of the page for manual testers to follow

  Incorrect

  The cookbook is about generating test code.

Creating end-to-end tests for a webpage can be complex because the HTML is generated dynamically. Copilot Chat can suggest the code needed to interact with the page and validate results. The cookbook example uses Playwright, but other frameworks such as Selenium or Cypress can be used.

• AMock objects that stand in for the service

  Correct

  Copilot Chat can generate mock objects that abstract layers of the application, keeping unit tests isolated from external services.

• BA content exclusion for the database files

  Incorrect

  Exclusion stops Copilot reading files; it doesn't isolate tests.

• CA copy of the production database for tests to use

  Incorrect

  That keeps the database dependency the developer wants to avoid.

• DA load test that calls the real service many times

  Incorrect

  A load test is a different kind of test and still uses the service.

Unit tests should be isolated and not depend on external services. One way to achieve this is to create mock objects that abstract layers of the application. Copilot Chat can generate the code for such mocks, for example for a service that fetches data from a database.

• A"Write a test."

  Incorrect

  A minimal prompt gives Copilot no scope or scenarios.

• B"Make all of the existing tests in this file pass, whatever it takes."

  Incorrect

  This asks to change code or tests, not to widen coverage.

• C"Explain the BankAccount class."

  Incorrect

  This asks for an explanation, not tests.

• D"Write a comprehensive suite covering edge cases, exceptions and validation."

  Correct

  The tutorial's prompt states the scope and the scenarios: edge cases, exception handling and data validation.

GitHub's tutorial on writing tests asks for "a comprehensive suite of unit tests" for the BankAccount class with multiple test methods covering edge cases (boundary conditions such as negative amounts), exception handling (errors for invalid actions) and data validation. Stating scope and scenarios explicitly gets more than basic tests.