What is a Code Review? Complete Guide [2023]

Pros

Here are the main benefits of software reviews:

• Find defects early, improving code quality and reducing errors.
• Improve code quality through consistent formatting, naming conventions, and adherence to standards.
• Identify alternative solutions and improve designs.
• Facilitate knowledge transfer and best practices sharing.
• Promote team awareness and transparency by allowing feedback on changes.
• Foster a culture of shared code ownership and responsibility.

Total cost: Before $368k vs After $152k.

Cons

Code reviews are not always rainbows and unicorns.

Here are the main cons of software reviews:

• Time-suck: If your codebase is massive you may find yourself drowning in a sea of code for hours on end.
• Subjectivity: Code reviews can be subjective, and the feedback provided may depend on the reviewer's personal preferences, biases, or expertise. This can result in inconsistent feedback and potentially impact code quality.
• Over-reliance on reviewers: In some cases, developers may become overly dependent on code reviewers to catch errors or identify issues, rather than taking responsibility for their own code quality.
• Negative impact on morale: If not conducted properly, code reviews can become a source of conflict or negativity within a team or organization. This can impact morale and lead to decreased productivity.
• Resistance to change: Developers may resist feedback or changes suggested during code reviews, particularly if they feel that their code is being criticized unfairly or that changes will negatively impact their work.

Types of code reviews

1. Tool-Assisted reviews

Tool-Assisted reviews are the most popular type of code review.

Code review tools make it easy to see code differences, leave review comments, and apply suggestions.

2. Over-the-shoulder reviews

Over-the-shoulder reviews involve one person reviewing another person's code in person or on a call.

This informal approach is a quick way to get feedback on code changes. In-person code reviews are usually unstructured and may be done spontaneously without prior planning.

3. Pair-Programming

Pair programming is a collaborative approach to code development where two developers work together on a single task, taking turns typing and reviewing code.

This approach can help catch errors early in the development process, promote knowledge sharing, and improve code quality.

4. Formal inspections

Formal inspections are a type of code review process that involves a rigorous and structured approach to examining code.

This method typically involves a group of reviewers who systematically examine the code for defects, compliance with coding standards, and adherence to design principles.

How does a code review work?

A modern code review follows these steps:

1. A developer submitting their code to a reviewer to identify and address errors before merging it into the codebase.
2. The reviewer provides feedback to ensure the code meets quality standards.
3. The original developer refactors code based on feedback.
4. The process iterates.
5. After necessary changes are made, the code is approved and ready for check-in or build incorporation.

Research at Google found that over 80% of all changes involve at most one iteration of resolving comments.

Code Review Tools

Code reviews would be impossible without modern code reviews tools such as GitHub, GitLab, and Azure DevOps.

They integrate with source code management systems and use policies to enforce the code review process.

For example:

• requiring a certain number of approvals before merging code,
• ensuring that code has been reviewed before being merged, and
• enforcing specific guidelines for code reviews.

Beyond enforcing, these tools offer features like code highlighting, commenting, and suggesting that facilitate collaboration.

Code Review Stats

• At Google, 80% of code reviews lead to code improvements.
• Unreviewed code is 2X more likely to introduce defects than reviewed code.
• Finding defects is the first motivation for code review for 383 of the programmers (44%), followed by code improvements (39%) for 204 (23%), and third for 96 (11%) - Bacchelli and Bird
• Code review increases the number of distinct files a developer knows about by 66% to 150% depending on the project. - Rigby and Bird

Who does a code review?

Code reviews are performed by one or more fellow members of the software development team.

Reviewers must be skilled in the given programming language. Also, they need to have a basic understanding of the business logic surrounding the code to make sure the code does what it's supposed to do.

When to perform code reviews?

Code reviews can be performed in different stages of the Software Development Life Cycle (SDLC):

• Change-based
  • Pre-commit: Before merging the code change. (most popular)
  • Post-commit: After merging the code change.
• Periodically: All code changes are reviewed on a schedule. For example, every 2 weeks.

In 2017, a survey of 240 development teams revealed that 90% of them use a change-based review process.

How long does a code review take?

The turnaround time for a code review should be less than 24 hours.

Researches Rigby and Bird analyzed the differences between various software projects, including two Google-led projects (Android and Chromium OS), three Microsoft projects (Bing, Office, and MS SQL), and projects internal to AMD.

Key takeaways:

• At Google, Median wait time for initial feedback is under 1 hour for small changes and about 5 hours for very large changes.

• AMD has short review intervals, with the median review taking 17.5 hours.

• Median developers at Google make 3 changes per week and 80% make less than 7.

• Median changes reviewed per week is 4 and 80% of reviewers review fewer than 10 changes.

• Overall median latency for the entire review process is under 4 hours.

• Google's review sizes: over 35% modify only 1 file, 90% modify fewer than 10 files, and median number of lines modified is 24.

What kind of feedback do code reviews provide?

Useful code reviews provide constructive feedback:

• Points out bugs, defects, or security vulnerabilities.
• Improves performance or resource consumption.
• Praises positives.
• Increases code readability.
• Transfers knowledge between developers.

How effective are code reviews?

In Code Complete, Steve McConnell states that code reviews are the most effective code quality process.

Here's the average effectiveness of software defect detection:

Psychological safety

As a developer, you are putting your work out there for someone to criticize comment on.

It's a very vulnerable feeling that can cause a lot of stress if the development team doesn't develop psychological safety.

Software development is a craft and developers that pride in their creation.

In my career, I've seen many conflicts arise because of code reviews.

But remember: Code reviews exist to improve code quality. It's not about you or me. We all just want to make better software.

How to perform an effective code review?

In May 2006, Cisco Systems® conducted a case study of peer code review for their MeetingPlace® software:

• 50 developers from three continents reviewed every code change for over 10 months.
• 2500 reviews of a total of 3.2 million lines of code were collected.
• They collected process metrics automatically, including the number of lines of code, amount of person-hours spent in the review, and number of defects found.

Here's what you need to know:

• Don't review too much code at once (<200-400 LOC). Defect density decreased dramatically when the number of lines of code under inspection went above 200.

  

• Take your time (<500 LOC/hour). Reviewers who went through the code at rates above 1000 LOC/hour probably weren't actually looking at the code.

• Spend less than 60 minutes reviewing. Performance starts dropping off after 60-90 minutes.

  

What is Secure Code Review?

Secure code review audits an application's source code to identify security flaws and ensure proper security controls are in place.

For effective security code reviews, a combination of human effort and technology support does the best.

The goal of a secure code review is to ensure that a penetration test does not discover any additional vulnerabilities after a proper security code review has been conducted.