Your team wants to unit test and integration test Pulumi infrastructure code before deploying to real cloud environments. How do you implement a comprehensive testing strategy for Pulumi programs?

// === Unit Test with Mocks (Jest + TypeScript) ===
import * as pulumi from "@pulumi/pulumi";

// Set up mocks BEFORE importing the Pulumi program
pulumi.runtime.setMocks({
  newResource: function(args: pulumi.runtime.MockResourceArgs): { id: string, state: any } {
    return {
      id: args.inputs.name + "-id",
      state: {
        ...args.inputs,
        arn: `arn:aws:s3:::${args.inputs.name || "test"}`,
      },
    };
  },
  call: function(args: pulumi.runtime.MockCallArgs) {
    return args.inputs;
  },
});

// Now import the infrastructure module
import { bucket, securityGroup } from "../index";

describe("Infrastructure", () => {
  test("S3 bucket has encryption enabled", async () => {
    const encryption = await new Promise<any>((resolve) =>
      bucket.serverSideEncryptionConfiguration.apply(resolve)
    );
    expect(encryption).toBeDefined();
    expect(encryption.rules[0].applyServerSideEncryptionByDefault.sseAlgorithm)
      .toBe("aws:kms");
  });

  test("Security group does not allow SSH from anywhere", async () => {
    const ingress = await new Promise<any[]>((resolve) =>
      securityGroup.ingress.apply(resolve)
    );
    const sshRules = ingress.filter(r => r.fromPort === 22);
    for (const rule of sshRules) {
      expect(rule.cidrBlocks).not.toContain("0.0.0.0/0");
    }
  });
});

// === Policy/Property Test ===
import { PolicyPack, validateResourceOfType } from "@pulumi/policy";
import * as aws from "@pulumi/aws";

new PolicyPack("compliance", {
  policies: [{
    name: "s3-no-public-read",
    description: "S3 buckets must not have public-read ACL",
    enforcementLevel: "mandatory",
    validateResource: validateResourceOfType(aws.s3.Bucket, (bucket, args, report) => {
      if (bucket.acl === "public-read") {
        report("S3 bucket must not be public-read");
      }
    }),
  }],
});

// === Integration Test (Automation API) ===
import { LocalWorkspace } from "@pulumi/pulumi/automation";
import axios from "axios";

describe("Integration", () => {
  let stack: any;
  beforeAll(async () => {
    stack = await LocalWorkspace.createOrSelectStack({
      stackName: `test-${Date.now()}`,
      workDir: "../",
    });
    await stack.setConfig("aws:region", { value: "us-west-2" });
    await stack.up();
  }, 300000);

  test("ALB responds with 200", async () => {
    const outputs = await stack.outputs();
    const resp = await axios.get(outputs.albDnsName.value);
    expect(resp.status).toBe(200);
  });

  afterAll(async () => {
    await stack.destroy();
    await stack.workspace.removeStack(stack.name);
  }, 300000);
});