Code Review
Perform a structured code review. Produce actionable findings with exact file+line citations.
Determine Review Mode
- Change review (PR, diff, CL): review only code introduced by the change. Go to "Change Review Workflow."
- Codebase review (full repo, specific files/modules): review the code as-is. Go to "Codebase Review Workflow."
Change Review Workflow
1. Establish what to review
Obtain access to the post-change files for accurate line citations.
- Local checkout: use
git diff (unstaged/staged) or a commit range
- GitHub PR: use
gh to clone/checkout the PR branch (see references/github-gh.md)
- GitLab MR: use
glab to clone/checkout the MR branch (see references/gitlab-glab.md)
- If only a diff snippet is provided: ask for a branch/commit or full file contents
2. Scope the change
Constrain the review to code introduced by the change:
git diff --name-only # changed files (working tree)
git diff --stat # change size per file (working tree)
python scripts/diff_changed_ranges.py --json # changed line ranges per file (working tree)
# PR/MR branch: diff vs base branch (use base from `gh pr view` / `glab mr view`)
git diff --name-only origin/main...HEAD
git diff --stat origin/main...HEAD
python scripts/diff_changed_ranges.py --range origin/main...HEAD --json
3. Broad assessment
Read the CL/PR description and skim all changed files. Ask: "Does this change make sense as a whole?"
- If the change should not proceed at all, provide immediate feedback with reasoning
- If the overall design is wrong, flag it before reviewing details
4. Critical components
Identify the most significant files (largest logical changes) and review those first. This provides context for smaller modifications.
If fundamental design issues emerge, communicate immediately -- major restructuring may invalidate subsequent code.
5. Systematic review
Review remaining files in logical order. Read tests before implementation when it helps clarify intent. Apply the review checklist (step 6 below).
Rules:
- Do not comment on pre-existing issues unless the change makes them newly reachable
- Prefer blocker/high-severity items over nits
- Review every line of human-written code
6. Verdict
- Approve if the CL improves overall code health, even if imperfect
- Request changes if the CL degrades code health or has blocking issues
- Technical facts override personal preference; accept the author's valid approach when multiple exist
Codebase Review Workflow
1. Establish scope
Determine what to review:
- Entire repo: scan project structure, identify key modules
- Specific files/modules: focus on the requested scope
- Specific concern (e.g., "review security," "review architecture"): focus the checklist on that area
2. Understand the architecture
- Read project structure, entry points, and dependency graph
- Identify layers (domain, infrastructure, API, etc.)
- Note the tech stack, patterns, and conventions in use
3. Systematic review
Walk through the code module by module. Apply the review checklist below, focusing on all areas or the specific concern requested.
4. Summary
Provide an overall assessment of code health with prioritized findings.
Review Checklist
For each file/hunk under review, evaluate against these areas (see references/what-to-look-for.md for full details):
| Area |
Key questions |
| Design |
Right architecture? Belongs here? Proper separation of concerns? |
| Functionality |
Does what's intended? Edge cases handled? |
| Complexity |
Simplest correct solution? Over-engineered? |
|
|
| Security |
Injection, XSS, secrets, auth, IDOR, input validation? |
| Performance |
N+1, missing indexes, re-renders, memory leaks, blocking async, caching? |
|
|
| Code Quality |
DRY, SRP, deep nesting, magic values, error handling, type coverage? |
| Tests |
Present, correct, edge cases, no flaky patterns, mocked at boundaries? |
|
|
| Naming |
Descriptive, follows conventions? |
| Comments |
Explain why, not what? |
| Style |
Follows style guide? Consistent? |
| Docs |
Updated if behavior changed? Breaking changes documented? |
Verify Citations
Before writing each finding, verify exact line numbers:
python scripts/print_lines.py <file> <startLine> <endLine>
Use citation format: path/to/file.ts#L10-L42
Write Comments
Follow comment best practices (see references/review-comments.md for full guide):
- Comment on the code, never the developer
- Explain why the issue matters
- Use severity labels: Blocker, High, Nit:, Optional:, FYI:
- One issue per comment
- Acknowledge good work
Produce the Review
Fill the template from assets/review_template.md. Each finding must include:
- Severity (Blocker / High / Medium / Low)
- Actionable fix direction
- Exact
file#Lx-Ly citation
End with:
- Verdict:
approve, request changes, or comment only
- 1-2 sentence justification
- Confidence: 0.0 to 1.0
Reference Files
- references/review-standard.md -- Core review standard: when to approve vs request changes, conflict resolution
- references/what-to-look-for.md -- Full checklist of review areas with details for each
- references/review-comments.md -- How to write effective comments, severity labels, handling pushback
- references/github-gh.md -- GitHub PR review workflow using
gh
- references/gitlab-glab.md -- GitLab MR review workflow using
glab
1---2name: code-review3description: Review code with a structured, high-signal review process. Use when asked to review code, review a PR/MR (GitHub PRs via `gh`, GitLab MRs via `glab`), review a codebase, give feedback on a changelist, audit code quality, or perform a code review. Supports both diff/PR reviews and full codebase reviews. Produces actionable findings with severity labels, exact file+line citations, and a final verdict. Covers design, functionality, complexity, tests, naming, comments, style, documentation, security, and performance.4---56# Code Review78Perform a structured code review. Produce actionable findings with exact file+line citations.910## Determine Review Mode11121. **Change review** (PR, diff, CL): review only code introduced by the change. Go to "Change Review Workflow."132. **Codebase review** (full repo, specific files/modules): review the code as-is. Go to "Codebase Review Workflow."1415---1617## Change Review Workflow1819### 1. Establish what to review2021Obtain access to the post-change files for accurate line citations.2223- Local checkout: use `git diff` (unstaged/staged) or a commit range24- GitHub PR: use `gh` to clone/checkout the PR branch (see [references/github-gh.md](references/github-gh.md))25- GitLab MR: use `glab` to clone/checkout the MR branch (see [references/gitlab-glab.md](references/gitlab-glab.md))26- If only a diff snippet is provided: ask for a branch/commit or full file contents2728### 2. Scope the change2930Constrain the review to code introduced by the change:3132```bash33git diff --name-only # changed files (working tree)34git diff --stat # change size per file (working tree)35python scripts/diff_changed_ranges.py --json # changed line ranges per file (working tree)3637# PR/MR branch: diff vs base branch (use base from `gh pr view` / `glab mr view`)38git diff --name-only origin/main...HEAD39git diff --stat origin/main...HEAD40python scripts/diff_changed_ranges.py --range origin/main...HEAD --json41```4243### 3. Broad assessment4445Read the CL/PR description and skim all changed files. Ask: "Does this change make sense as a whole?"4647- If the change should not proceed at all, provide immediate feedback with reasoning48- If the overall design is wrong, flag it before reviewing details4950### 4. Critical components5152Identify the most significant files (largest logical changes) and review those first. This provides context for smaller modifications.5354If fundamental design issues emerge, communicate immediately -- major restructuring may invalidate subsequent code.5556### 5. Systematic review5758Review remaining files in logical order. Read tests before implementation when it helps clarify intent. Apply the review checklist (step 6 below).5960Rules:61- Do not comment on pre-existing issues unless the change makes them newly reachable62- Prefer blocker/high-severity items over nits63- Review every line of human-written code6465### 6. Verdict6667- **Approve** if the CL improves overall code health, even if imperfect68- **Request changes** if the CL degrades code health or has blocking issues69- Technical facts override personal preference; accept the author's valid approach when multiple exist7071---7273## Codebase Review Workflow7475### 1. Establish scope7677Determine what to review:7879- **Entire repo**: scan project structure, identify key modules80- **Specific files/modules**: focus on the requested scope81- **Specific concern** (e.g., "review security," "review architecture"): focus the checklist on that area8283### 2. Understand the architecture8485- Read project structure, entry points, and dependency graph86- Identify layers (domain, infrastructure, API, etc.)87- Note the tech stack, patterns, and conventions in use8889### 3. Systematic review9091Walk through the code module by module. Apply the review checklist below, focusing on all areas or the specific concern requested.9293### 4. Summary9495Provide an overall assessment of code health with prioritized findings.9697---9899## Review Checklist100101For each file/hunk under review, evaluate against these areas (see [references/what-to-look-for.md](references/what-to-look-for.md) for full details):102103| Area | Key questions |104|------|--------------|105| **Design** | Right architecture? Belongs here? Proper separation of concerns? |106| **Functionality** | Does what's intended? Edge cases handled? |107| **Complexity** | Simplest correct solution? Over-engineered? |108| | |109| **Security** | Injection, XSS, secrets, auth, IDOR, input validation? |110| **Performance** | N+1, missing indexes, re-renders, memory leaks, blocking async, caching? |111| | |112| **Code Quality** | DRY, SRP, deep nesting, magic values, error handling, type coverage? |113| **Tests** | Present, correct, edge cases, no flaky patterns, mocked at boundaries? |114| | |115| **Naming** | Descriptive, follows conventions? |116| **Comments** | Explain why, not what? |117| **Style** | Follows style guide? Consistent? |118| **Docs** | Updated if behavior changed? Breaking changes documented? |119120## Verify Citations121122Before writing each finding, verify exact line numbers:123124```bash125python scripts/print_lines.py <file> <startLine> <endLine>126```127128Use citation format: `path/to/file.ts#L10-L42`129130## Write Comments131132Follow comment best practices (see [references/review-comments.md](references/review-comments.md) for full guide):133134- Comment on the **code**, never the developer135- Explain **why** the issue matters136- Use severity labels: **Blocker**, **High**, **Nit:**, **Optional:**, **FYI:**137- One issue per comment138- Acknowledge good work139140## Produce the Review141142Fill the template from `assets/review_template.md`. Each finding must include:143144- Severity (Blocker / High / Medium / Low)145- Actionable fix direction146- Exact `file#Lx-Ly` citation147148End with:149- **Verdict**: `approve`, `request changes`, or `comment only`150- 1-2 sentence justification151- **Confidence**: 0.0 to 1.0152153## Reference Files154155- **[references/review-standard.md](references/review-standard.md)** -- Core review standard: when to approve vs request changes, conflict resolution156- **[references/what-to-look-for.md](references/what-to-look-for.md)** -- Full checklist of review areas with details for each157- **[references/review-comments.md](references/review-comments.md)** -- How to write effective comments, severity labels, handling pushback158- **[references/github-gh.md](references/github-gh.md)** -- GitHub PR review workflow using `gh`159- **[references/gitlab-glab.md](references/gitlab-glab.md)** -- GitLab MR review workflow using `glab`