Code Review
Code review is the practice of having other engineers examine proposed changes before they merge. It catches defects, spreads knowledge across a team, enforces conventions, and improves design quality through structured peer feedback on pull requests or changesets.
itSoftware engineering | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic — Code Review
Code review is the practice of having someone else examine your proposed changes before they merge into the shared codebase. It catches defects, spreads knowledge, and improves design — but its real power is that it forces you to explain your intent to another human, which is often when you discover your own assumptions were wrong.
Before review existed, code went from author to production with whatever path it could find. The result was predictable: bugs hiding in assumptions no one else held, designs that made sense to one person and baffled everyone else, and knowledge concentrated in the single brain that wrote the thing. Review distributes that risk across the team.
The pull request — a proposal containing intent, code, tests, and discussion — is the working unit. The author makes the proposal clear; the reviewer brings independent judgment. That independence does not mean distance or hostility. It means you verify the change instead of assuming that its implementation proves its correctness.
Read in layers: start with purpose, find the center of the change, inspect the complete diff in context, then form a decision. Separate defects that block approval from optional improvements. Comment on the code, not the person — state the problem, the consequence, and the expected outcome. A strong comment names the behavior and the risk; a weak one just says "this is wrong."
The decision is not about perfection. Approval means the change improves the codebase and meets the team's standard. Request changes means blocking work remains. Comment means feedback without a decision. Technical facts, requirements, and agreed standards should control disagreements — not personal taste.
The one thing that surprises most people: fast review matters more than thorough review. Prompt feedback reduces waiting, keeps context fresh, and lets the author revise while they still remember what they were thinking. A review that takes four hours to complete but arrives in three minutes is better than one that takes thirty minutes but sits in a queue for two days.
Read the Introduction for the full framework, the Cheatsheet for the decision guide and comment pattern, and the Slides for the mental model.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://google.github.io/eng-practices/review/reviewer/
Supports
- The reviewer workflow, review standard, inspection order, response-time guidance, comments, and disagreement handling
- The course mental model, review sequence, decision threshold, and first two study-path rationales
- https://google.github.io/eng-practices/review/reviewer/standard.html
Supports
- Approval based on improving code health rather than achieving perfection
- Technical evidence and adopted style guides taking precedence over personal preference
- https://google.github.io/eng-practices/review/reviewer/looking-for.html
Supports
- Review lenses for design, functionality, complexity, tests, naming, comments, documentation, style, context, and every assigned line
- Stating scope when review responsibility is divided
- https://google.github.io/eng-practices/review/reviewer/navigate.html
Supports
- Reading the description first, examining the main design early, and then covering the remaining files
- Sending major design findings before spending time on details that may be replaced
- https://google.github.io/eng-practices/review/reviewer/comments.html
Supports
- Courteous comments about code, explanations of reasoning, balanced guidance, positive feedback, and explicit severity labels
- The course comment pattern and comment-writing examples
- https://google.github.io/eng-practices/review/reviewer/speed.html
Supports
- Prompt reviewer responses, focused work boundaries, early broad feedback, and splitting oversized changes
- The healthy-loop material in the introduction, slides, cheatsheet, and narration
- Field notes spine and signal cards on response time as the leading indicator of review culture health
- https://google.github.io/eng-practices/review/developer/
Supports
- Author guidance on useful descriptions, small changes, and handling comments
- The author-handoff checklist and author-guide link rationale
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/about-pull-request-reviews
Supports
- Pull request review collaboration, line comments, suggestions, review requests, code owners, required reviews, and the three review states
- The GitHub overview link rationale
- https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request
Supports
- Understanding pull request purpose, reviewing files and diffs, tracking viewed files, and submitting a review
- The tool-workflow link rationale
- https://cheatsheetseries.owasp.org/cheatsheets/Secure_Code_Review_Cheat_Sheet.html
Supports
- Manual secure code review as a complement to automated tools
- Security review of business logic, data flow, authentication, authorization, cryptography, and context-specific vulnerabilities
- The OWASP Cheat Sheet link rationale and security-focused quiz answers
- https://owasp.org/www-project-code-review-guide/
Supports
- The guide's intended audience and its coverage of review practice and vulnerability identification
- The advanced OWASP study-path rationale
- https://doi.org/10.1145/3183519.3183525
Supports
- Empirical baselines for modern review: median time-to-approval under 4 hours, developers spending 3.2 hours per week reviewing, most changes small
- Field notes difficulty card on the real challenge of review being approach evaluation under author constraints
- Timeline milestone on research establishing empirical baselines for modern review practices
- https://futurion.blog/what-makes-a-good-code-review-and-what-most-teams-get-wrong/
Supports
- The most common code review failure being oversized PRs, with defect detection declining beyond 400 lines
- The distinction between design feedback and bug detection as the primary purpose of review
- Field notes mistake card on oversized PRs eroding review quality
- https://github.blog/news-insights/pull-requests-2-0/
Supports
- Pull Requests 2.0 transforming PRs from merge notifications into permanent, revision-aware discussions with inline commenting
- Timeline milestone on the shift to review-as-discussion
- https://rdnlsmith.com/posts/2023/004/pull-request-origins/
Supports
- The history of pull requests from Linux kernel mailing lists through BitKeeper to GitHub's launch
- Timeline milestones on GitHub launch and GitLab launch
- https://www.gerritcodereview.com/about.html
Supports
- Gerrit's origin as a Rietveld fork for AOSP, the Mondrian and Rietveld lineage, and the shift to change-based review
- Timeline milestones on Mondrian, Rietveld, and Gerrit
- https://gitnation.com/contents/a-brief-history-of-code-review-and-whats-next
Supports
- The arc from Fagan inspections through email-based review to pull requests and AI-augmented review
- Timeline milestone on AI-augmented review entering the workflow
- https://www.stackfyi.com/guides/best-code-review-tools-2026
Supports
- Comparative analysis of GitHub, GitLab, Gerrit, CodeRabbit, SonarQube, and other code review tools
- Product descriptions for the Landscape tab
- https://www.guideflow.com/blog/code-review-tools
Supports
- Tool categorization into platform-native, AI-assisted, and static analysis types for the code review landscape
- Product descriptions for the Landscape tab
