Frameworks & Libraries — By Language (Java · Python · TypeScript/JS · Tools)¶
A per-language cheat sheet of every framework/library you've actually used, what each one does, and where you used it — so when an interviewer asks "what libraries do you use in Java? in Python?" you can rattle them off with a one-line purpose each.
This is the by-language complement to ../Project_QnA/frameworks-per-project.md (which is organised by project). Versions are the real ones from your repos — read the ⚠️ Don't over-claim notes at the bottom before an interview.
How to say it: lead with the category ("for API testing I use REST Assured"), then the library, then why. Don't recite versions unless asked.
JAVA — Selenium / API automation stack¶
(from B2BProjectTest and RestAssured_API)
| Library | Version | Category | What it does / why |
|---|---|---|---|
| Java | 1.7 / 1.8 | Language | The automation language; JDK 8 gives lambdas/Streams |
| Maven | — | Build & dependency | Builds the project, manages dependencies (pom.xml), runs tests via Surefire |
| TestNG | 7.0.0 / 7.5 | Test framework | Annotations, suite XMLs, groups (smoke/regression), @DataProvider, dependsOnMethods, listeners, parallel |
| Selenium WebDriver | 4.0.0-alpha-5 / 4.x | UI automation | Drives the browser (find elements, click, type, waits) |
| WebDriverManager | 4.2.2 | Driver management | Auto-downloads ChromeDriver/GeckoDriver (Selenium 4.6+ does this natively via Selenium Manager) |
| ngwebdriver | — | Angular sync | Waits for Angular to settle before interacting (the B2B app is Angular) |
| REST Assured | 4.4.0 / 5.1.1 | API testing | given/when/then HTTP calls + response validation |
| Hamcrest | — | Assertions | Matcher-style assertions (equalTo, hasItem) used by REST Assured |
| AssertJ | — | Assertions | Fluent assertions + SoftAssertions (collect failures, assert at end) |
| Jackson (databind) | 2.13 | JSON | Serialize/deserialize JSON ↔ Java objects (POJOs) |
| Gson | — | JSON | Alternative JSON parsing |
| org.json | — | JSON | Lightweight JSON object handling |
| json-path | — | JSON query | Extract values from responses ($.data.id) |
| json-schema-validator | 4.3.1 | Contract testing | matchesJsonSchema() — 21+ schemas; fails on backend contract drift ← your standout |
| OpenCSV | — | Test data | Read CSV inputs for data-driven tests |
| Apache POI | — | Test data | Read/write Excel for data-driven tests |
| ExtentReports | 2.41.1 (legacy 2.x) | Reporting | Rich HTML reports + screenshot-on-failure via a custom IReporter listener |
🎤 Say-this (Java): "For UI it's Selenium 4 with TestNG, Page Object Model, WebDriverManager for drivers, and ngwebdriver for Angular sync. For API it's REST Assured with Hamcrest/AssertJ assertions, Jackson/Gson for JSON, and json-schema-validator for contract checks. Build is Maven, reporting is ExtentReports, data is CSV/Excel/JSON via OpenCSV and Apache POI."
PYTHON — LLM-evaluation & test stack¶
(from the LLM-eval framework — bkg/FMCG/HoAD — the bce practice-repo, and cicd-cloud-lab)
| Library | Version | Category | What it does / why |
|---|---|---|---|
| Python | 3.10 / 3.11 / 3.12 | Language | The eval + tooling language |
| pytest | ≥7.4.3 | Test runner | Runs all tests; markers, fixtures, parametrize |
| pytest-asyncio | — | Async testing | async/await tests for the streaming SSE/WebSocket chatbot |
| pytest-timeout | — | Test safety | Kills hung tests (LLM calls can stall) |
| Pydantic (+ pydantic-settings) | 2.5 | Config & validation | Typed, validated config from env; validate/parse LLM JSON output |
| OpenAI SDK | — | LLM judge | gpt-4o-mini as an LLM-as-judge, strict JSON-schema output, temp 0 |
| Anthropic SDK | — | LLM judge | claude-haiku-4-5, forced tool-use for structured output |
| google-genai | — | LLM (optional) | Gemini 2.5-flash in the practice-repo |
| sentence-transformers | (all-MiniLM-L6-v2) | Embeddings | Local semantic similarity without an API |
| OpenAI embeddings | text-embedding-3-small | Embeddings | Cloud embeddings for semantic scoring |
| psycopg2 | — | Database | Read-only PostgreSQL access for the ground-truth oracle |
| sqlglot | — | SQL validation | Parse/validate SQL claims the chatbot makes |
| requests / httpx | — | HTTP | REST calls to the chatbot API (httpx for async) |
| websocket-client | — | WebSocket | Test the chat WebSocket channel |
| Playwright (Python) | — | UI channel | Browser-level tests of the chatbot UI |
| sqlite3 (stdlib) | — | Caching | Judge cache (7-day TTL) + regression DB — cuts eval cost |
| Langfuse | — | Observability | Writes eval traces / reads chatbot traces to debug which step failed |
| Jinja2 | — | Reporting | Self-contained HTML eval reports |
| RAGAS / langchain-openai | — | Reference only | RAG metrics library — reference in the practice-repo, not used in the real repos |
| Flask | ≥3 | Web (lab app) | The sample app in cicd-cloud-lab that's under test |
| gunicorn | — | Web server | Production WSGI server for the Flask app in Docker |
| black / flake8 / mypy / isort | — | Code quality | Format, lint, type-check, import-sort |
| pre-commit (+ detect-secrets) | — | Quality gates | Run checks before commit; detect-secrets blocks leaked credentials |
🎤 Say-this (Python): "Tests run on pytest with pytest-asyncio for the streaming channel. Config/validation is Pydantic. Judges are the OpenAI and Anthropic SDKs at temperature 0 with structured output; embeddings via sentence-transformers or OpenAI. The ground-truth oracle reads PostgreSQL with psycopg2 and validates SQL with sqlglot. Langfuse for tracing, SQLite for caching, Jinja2 for HTML reports, and black/flake8/mypy/pre-commit + detect-secrets for quality."
TYPESCRIPT / JAVASCRIPT — Playwright stack¶
(from Morrie_automation, questt.ai)
| Library | Version | Category | What it does / why |
|---|---|---|---|
| TypeScript | 5.2 | Language | Typed JS; catches errors before runtime |
Playwright Test (@playwright/test) |
^1.35 | Test framework | UI+API framework: auto-wait, parallel-by-default, fixtures, Trace Viewer |
| Axios | 1.4 | API client | BaseApi with 700ms throttle + 429 Retry-After handling ← your standout |
| Node.js / npm | — | Runtime / packages | npm ci for reproducible installs; runs the suite |
| Built-in reporters | — | Reporting | Playwright HTML + JSON + JUnit XML |
Design pieces (not libraries, worth naming): Page Object Model (Login/Dashboard/Agent/PageBuilder), 8 custom fixtures, global-setup.ts with storageState (log in once), two projects (chromium + api), fullyParallel: true, trace on-first-retry.
🎤 Say-this (TS): "It's Playwright Test with TypeScript — POM plus custom fixtures, an Axios API layer that rate-limits itself, and storageState so I log in once. Reports are Playwright's HTML/JUnit, and it runs fully parallel in CI."
DEVOPS / CI / SECURITY — tools across all projects¶
| Tool | Category | What it does / where |
|---|---|---|
| Git / GitHub | Version control | Branches, PRs, code review — daily |
| GitHub Actions | CI/CD | eval_ci.yml (Python: lint→mypy→pytest), Morrie build, cicd-cloud-lab pipeline |
| Jenkins | CI (self-hosted) | Local jobs (api_automation, playwright-automation, maven_test) — real hands-on |
| Docker / docker-compose | Containers | Package the app + deps; multi-service test environments |
| AWS | Cloud | Elastic Beanstalk/App Runner (deploy), S3 (artifacts), IAM (least-privilege), CloudWatch (logs/alarms) |
| OWASP ZAP | Security (DAST) | Automated web/API vuln scanning (VAPT) |
| Burp Suite | Security (proxy) | Intercept/tamper/replay requests (VAPT) |
| Nmap / Nikto | Security (recon) | Port/service recon; web-server misconfig scan (VAPT) |
TOOLS (named) — the full QA/SDET toolbox¶
A library is code you import; a tool is an application you run. Interviewers often ask "what tools do you use?" separately. Here they are, by category. ✅ = verified on your system / in your repos · ➕ = standard QA tool — claim it only if you actually use it.
IDE / Editor¶
- ✅ Eclipse — your Java/Selenium/REST Assured work lives in
eclipse-workspace - ✅ VS Code — for the Python/TypeScript projects
- ➕ IntelliJ IDEA — the other common Java IDE (mention if you use it)
Build & dependency¶
- ✅ Maven — Java build, dependencies, running TestNG via Surefire
- ➕ Gradle — the alternative build tool (only if you've used it)
Version control & hosting¶
- ✅ Git — branching, commits, day-to-day
- ✅ GitHub — remotes, PRs, code review, Actions
CI / CD¶
- ✅ Jenkins — local jobs (
api_automation,playwright-automation,maven_test) — real hands-on - ✅ GitHub Actions — pipelines for the LLM-eval repo, Morrie, and cicd-cloud-lab
Containers & cloud¶
- ✅ Docker + docker-compose — containerize the app + spin up multi-service test envs
- ✅ AWS — Elastic Beanstalk/App Runner, S3, IAM, CloudWatch (cicd-cloud-lab)
- ➕ Kubernetes — orchestration; know the concept, deep k8s optional for QA
API testing & inspection¶
- ➕ Postman — manual API exploration, collections, quick checks (the standard companion to REST Assured — claim if used)
- ✅ Keploy.io — API record-and-replay / auto-test-generation POC (
POC-RestAssured_KeployIo) — a strong AI-tooling talking point - ➕ Insomnia / curl — lightweight API calls
- ✅ (libraries) REST Assured (Java), requests/httpx (Python), Axios (TS)
Browsers & cross-browser infrastructure¶
- ✅ Chrome / Firefox + DevTools — primary test browsers
- ✅ Selenium Manager (Selenium 4.6+) / WebDriverManager — driver binaries
- ➕ Selenium Grid — distribute tests across browsers/machines
- ➕ BrowserStack / Sauce Labs / AWS Device Farm — cloud cross-browser/device testing (mention as the scalable alternative to a local grid)
Test management & defect tracking¶
- ➕ Jira — user stories, defect tracking, sprints (name your workflow: log bug → severity/priority → link to story)
- ➕ TestRail / Zephyr / Xray — test-case management & traceability
- ➕ Confluence — test plans / documentation
Reporting¶
- ✅ ExtentReports — rich HTML reports + screenshot-on-failure (Java/B2B)
- ✅ Playwright HTML report + Trace Viewer — TS project
- ✅ Jinja2 HTML reports — Python LLM-eval
- ➕ Allure — popular cross-framework report (name it; pairs with TestNG/pytest/Playwright)
Performance / load¶
- ➕ JMeter — the classic load-testing tool
- ➕ k6 / Gatling — modern code-based load testing (mention for cloud endpoints)
Security / VAPT¶
- ✅ OWASP ZAP — automated DAST scanning
- ✅ Burp Suite — intercepting proxy, manual request tampering
- ✅ Nmap — port/service recon
- ✅ Nikto — web-server misconfiguration scanning
Databases¶
- ✅ PostgreSQL (via psycopg2) — the LLM-eval ground-truth oracle
- ➕ DBeaver / pgAdmin / MySQL Workbench — DB GUI clients for verifying data in tests
AI / LLM tooling¶
- ✅ Langfuse — LLM tracing/observability (which chatbot step produced a bad answer)
- ✅ OpenAI / Anthropic / Google AI (Gemini) consoles + SDKs — LLM-as-judge
- ➕ garak — "nmap for LLMs" red-teaming scanner (referenced in your AI-testing prep)
Code quality & secrets¶
- ✅ black / flake8 / mypy / isort — Python format/lint/type/imports
- ✅ pre-commit + detect-secrets — pre-commit gates; block leaked credentials
- ➕ SonarQube — static code-quality/coverage gate in CI (name it if used)
🎤 Say-this (tools): "IDE is Eclipse for Java, VS Code for Python/TS. Build Maven, version control Git/GitHub. CI is Jenkins and GitHub Actions, containers with Docker, cloud on AWS. For APIs I use REST Assured and Postman, and I've done a Keploy record-and-replay POC. Reporting is ExtentReports / Allure / Playwright HTML. Defects/test-cases in Jira (+ TestRail). Security work with ZAP, Burp, Nmap, Nikto, and for AI I use Langfuse for tracing."
ONE-SCREEN SUMMARY (memorize this)¶
| Area | Java | Python | TypeScript |
|---|---|---|---|
| Language | Java 8 | Python 3.11 | TypeScript 5.2 |
| Test runner | TestNG | pytest (+asyncio) | Playwright Test |
| UI | Selenium 4 | Playwright (py) | Playwright |
| API | REST Assured | requests / httpx | Axios |
| Assertions | Hamcrest / AssertJ | pytest asserts + Pydantic | Playwright expect |
| Data | OpenCSV / Apache POI / JSON | JSON / golden sets | JSON fixtures |
| Build/pkg | Maven | pip / venv | npm |
| Reporting | ExtentReports | Jinja2 HTML / JUnit | Playwright HTML/JUnit |
| Contract check | json-schema-validator | Pydantic schema | — |
⚠️ Don't over-claim (accuracy — read before interview)¶
- RAGAS / DeepEval — your real eval repos use a custom judge/metrics, not RAGAS/DeepEval. RAGAS is only a reference in the practice-repo. Say "I built the metrics myself; RAGAS is the open-source equivalent I know."
- RRF (Reciprocal Rank Fusion, k=60) — only in FMCG-chat-evaluation. bkg/HoAD use cosine + keyword fusion, not a literal RRF.
- Jenkins vs GitHub Actions — the Morrie repo uses GitHub Actions. You do have local Jenkins jobs (real hands-on) — so claim Jenkins as general experience, but not "for the Morrie repo."
- Versions differ across repos — B2B: Java 8, Selenium 4.0.0-alpha-5, TestNG 7.0.0, REST Assured 4.4.0, ExtentReports 2.41.1. RestAssured_API: Java 7, REST Assured 5.1.1, TestNG 7.5. Don't mix them up; if unsure, say "Selenium 4 / REST Assured 5" and offer the exact version if pushed.
- Committed secrets — several repos have committed keys/passwords. If asked about secrets management, use it as your story: "I found committed credentials in older repos, moved to env vars/vault, and added a detect-secrets pre-commit hook."
Cross-reference: the full per-project stacks, "why these frameworks," and "what I'd improve" talking points are in ../Project_QnA/frameworks-per-project.md.