What is the difference between smoke, sanity, and regression testing, and when does each run?

A smoke test is broad and shallow, checking that a build is stable enough to test at all, and it runs immediately after deployment. A sanity check is narrow and deep, verifying one specific fix or area after a change. Regression testing is the broad suite confirming existing behavior still works, run nightly or before release since it is too slow for every commit.

I think of it on two axes, breadth and depth. Smoke is wide and shallow: does the app start, does the home page render, can a user log in, does the main API respond. It runs right after every deployment to any environment and it gates whether it is even worth running anything else. If smoke fails we stop and fix the build rather than debugging fifty downstream failures. Sanity is narrow and deep: a developer fixed a discount calculation, so I exercise that calculation hard plus whatever sits immediately around it. It is fast, targeted, and runs on the branch before merge. Regression is the broad suite confirming that everything that used to work still works, and because it is slow it runs nightly and before a release rather than on every commit. The part I actively manage is regression suite growth. Suites only ever get bigger unless someone prunes them, so I periodically hunt for tests that have never failed for a real reason, tests duplicating coverage at a lower layer, and tests for features that were removed. A four hour suite nobody trusts is worth less than a forty minute one people act on.