What is code review?

There are many stages that code must go through before we can deploy it as part of an application. A crucial step in the pipeline is code review. This is among the last steps of the Software Development Life Cycle (SDLC).

We perform code reviews to thoroughly comb through the code and find vulnerabilities or bugs. This is a properly documented process in which many peers and experts weigh in with suggestions and improvements.

A trained moderator (who may not be the author) presents the code to the dev team, and management is usually not involved. A technical code review may or may not be formal and typically includes having discussions, making decisions, suggesting improvements, and finding and solving problems.

Common methods for code review

We can employ multiple methods for code reviews, depending on how formally we want to execute the review.

• Over the shoulder: This is one of the oldest and most informal methods of code review. It is also very intuitive and engaging. Once the code is ready, the author requests a colleague or peer to review it at their computer or workstation. This method may become too informal, so the involved parties must make sure that the conversation does not move away from the code and that they pay proper attention to finding problems and vulnerabilities.

• Email thread: This method is more formal, as there is some documentation recorded in the form of emails. Once the code is ready, the author sends it to colleagues or peers over email. This is not as quick as the over-the-shoulder method, as the peers review the code at their own convenience. However, allowing more time also allows for better and more thorough reviews. The parties involved must make sure that the email thread does not become too convoluted for the author to sift through.

• Pair programming: This method is slightly formal as well, as it puts developers side-by-side. The author becomes the driver, who writes the code, and the reviewer becomes the navigator, who checks each line of code as it is added. This is a good method for senior developers to mentor junior developers. However, this method may take up more time and resources than the previously mentioned methods.

• Tool-assisted: In this method, the team uses extra tools that are specifically designed for code reviews (e.g, GitHub pull request review). This method is the most efficient because the tools are designed for this purpose. They prevent derailment and convolution and allow the review to be added per line of code. This makes it easier to keep track of comments and solutions. Commonly used tools for code review include GitHub, Gerrit, Crucible, Upsource, and more.