code-review

Code Review Skill

Reusable workflow extracted from rex-code-reviewer expertise.

Purpose

Perform comprehensive code review with focus on quality, security, design patterns, and best practices to prevent bugs before merge.

When to Use

• Pull request reviews before merge
• Code quality assessment for legacy code
• Security vulnerability identification
• Design pattern evaluation
• Pre-release code audits
• Technical debt quantification

Workflow Steps

1. Context Understanding
2. Understand the purpose and scope of the code change
3. Review related issue/ticket context
4. Identify affected components and dependencies

1. Architecture Review
2. Verify alignment with overall system architecture
3. Check adherence to SOLID principles
4. Validate design pattern usage
5. Assess maintainability impact

1. Logic & Security Review
2. Validate business logic correctness
3. Check edge case handling
4. Scan for OWASP Top 10 vulnerabilities
5. Verify input validation and sanitization
6. Check authentication/authorization

1. Performance & Quality Check
2. Identify potential bottlenecks
3. Check algorithmic complexity
4. Verify database query optimization
5. Assess resource management

1. Style & Standards
2. Verify adherence to team coding standards
3. Check naming conventions
4. Validate documentation quality
5. Review test coverage adequacy

1. Generate Feedback
2. Categorize issues by severity (CRITICAL/HIGH/MEDIUM/SUGGESTION)
3. Provide file:line references
4. Include concrete fix recommendations
5. Acknowledge good patterns

Inputs Required

• Code to review: Pull request diff, file paths, or commit range
• Context: Purpose of changes, related requirements
• Standards: Team coding standards, style guides
• Scope: Full review vs focused review (security, performance, etc.)

Outputs Produced

• Review Report: Detailed findings by severity with file:line references
• Security Issues: Vulnerabilities flagged with severity levels
• Pattern Assessment: Design pattern usage evaluation
• Refactoring Roadmap: Prioritized improvements with effort estimates
• Decision: Approve / Request Changes / Comment

Review Categories

Severity Levels

• 🔴 CRITICAL: Must fix before merge - security issues, data loss risks, breaking bugs
• 🟠 HIGH: Should fix - significant maintainability or performance issues
• 🟡 MEDIUM: Consider fixing - code smell, minor inefficiencies
• 🟢 SUGGESTION: Nice to have - style improvements, minor optimizations
• 💡 LEARNING: Educational - explaining why certain patterns are preferred

Checklist Format

Security Checklist

• [ ] No hardcoded secrets or credentials
• [ ] Input validation and sanitization present
• [ ] SQL injection prevention (parameterized queries)
• [ ] XSS prevention (output encoding)
• [ ] Authentication/authorization properly implemented
• [ ] Sensitive data encrypted at rest and in transit
• [ ] No security misconfigurations

Quality Checklist

• [ ] Code without tests is incomplete - tests present
• [ ] Edge cases and error conditions handled
• [ ] No hardcoded values - configuration used
• [ ] Logging comprehensive with context
• [ ] No TO-DO/FIX-ME comments without tickets
• [ ] Documentation updated for public APIs
• [ ] No scope creep - focused on specific change

Performance Checklist

• [ ] No N+1 query patterns
• [ ] Appropriate indexing for queries
• [ ] Efficient algorithms (check Big O)
• [ ] Proper connection pooling
• [ ] Caching strategy implemented where appropriate
• [ ] Resource cleanup (connections, files, memory)

Example Usage

Input: Review pull request #123 adding user authentication

Workflow Execution:
1. Context: New OAuth2 implementation for user login
2. Architecture: Clean separation of auth logic, follows existing patterns
3. Security: ✅ Tokens stored securely, ❌ Missing rate limiting
4. Performance: ✅ Cached token validation
5. Standards: ✅ Tests present, ❌ Missing API documentation

Output:
🔴 CRITICAL: Add rate limiting to prevent brute force attacks
   File: src/auth/oauth.py:45
   Fix: Implement token bucket rate limiter with Redis

🟠 HIGH: Missing API documentation for new endpoints
   File: src/api/auth.py:12-67
   Fix: Add OpenAPI/Swagger documentation

🟢 APPROVE with changes required

Related Agents

• rex-code-reviewer - Full agent with reasoning and adaptation
• thor-quality-assurance-guardian - Quality standards enforcement
• luca-security-expert - Deep security analysis
• baccio-tech-architect - Architecture pattern validation
• dario-debugger - Root cause analysis support

ISE Engineering Fundamentals Alignment

• Every PR must be reviewed before merge
• Improve code quality by identifying defects early
• Foster learning through knowledge sharing
• Build shared understanding of codebase
• "Value quality and precision over completing fast"