code-reviewer

Code Reviewer

Automated code review tools for analyzing pull requests, detecting code quality issues, and generating review reports.

Table of Contents

• [Tools](#tools)
• [PR Analyzer](#pr-analyzer)
• [Code Quality Checker](#code-quality-checker)
• [Review Report Generator](#review-report-generator)
• [Reference Guides](#reference-guides)
• [Languages Supported](#languages-supported)

Tools

PR Analyzer

Analyzes git diff between branches to assess review complexity and identify risks.

# Analyze current branch against main
python scripts/pr_analyzer.py /path/to/repo

# Compare specific branches
python scripts/pr_analyzer.py . --base main --head feature-branch

# JSON output for integration
python scripts/pr_analyzer.py /path/to/repo --json

What it detects:

• Hardcoded secrets (passwords, API keys, tokens)
• SQL injection patterns (string concatenation in queries)
• Debug statements (debugger, console.log)
• ESLint rule disabling
• TypeScript any types
• TODO/FIXME comments

Output includes:

• Complexity score (1-10)
• Risk categorization (critical, high, medium, low)
• File prioritization for review order
• Commit message validation

Code Quality Checker

Analyzes source code for structural issues, code smells, and SOLID violations.

# Analyze a directory
python scripts/code_quality_checker.py /path/to/code

# Analyze specific language
python scripts/code_quality_checker.py . --language python

# JSON output
python scripts/code_quality_checker.py /path/to/code --json

What it detects:

• Long functions (>50 lines)
• Large files (>500 lines)
• God classes (>20 methods)
• Deep nesting (>4 levels)
• Too many parameters (>5)
• High cyclomatic complexity
• Missing error handling
• Unused imports
• Magic numbers

Thresholds:

| Issue | Threshold | |-------|-----------| | Long function | >50 lines | | Large file | >500 lines | | God class | >20 methods | | Too many params | >5 | | Deep nesting | >4 levels | | High complexity | >10 branches |

Review Report Generator

Combines PR analysis and code quality findings into structured review reports.

# Generate report for current repo
python scripts/review_report_generator.py /path/to/repo

# Markdown output
python scripts/review_report_generator.py . --format markdown --output review.md

# Use pre-computed analyses
python scripts/review_report_generator.py . \
  --pr-analysis pr_results.json \
  --quality-analysis quality_results.json

Report includes:

• Review verdict (approve, request changes, block)
• Score (0-100)
• Prioritized action items
• Issue summary by severity
• Suggested review order

Verdicts:

| Score | Verdict | |-------|---------| | 90+ with no high issues | Approve | | 75+ with ≤2 high issues | Approve with suggestions | | 50-74 | Request changes | | <50 or critical issues | Block |

Reference Guides

Code Review Checklist

references/code_review_checklist.md

Systematic checklists covering:

• Pre-review checks (build, tests, PR hygiene)
• Correctness (logic, data handling, error handling)
• Security (input validation, injection prevention)
• Performance (efficiency, caching, scalability)
• Maintainability (code quality, naming, structure)
• Testing (coverage, quality, mocking)
• Language-specific checks

Coding Standards

references/coding_standards.md

Language-specific standards for:

• TypeScript (type annotations, null safety, async/await)
• JavaScript (declarations, patterns, modules)
• Python (type hints, exceptions, class design)
• Go (error handling, structs, concurrency)
• Swift (optionals, protocols, errors)
• Kotlin (null safety, data classes, coroutines)

Common Antipatterns

references/common_antipatterns.md

Antipattern catalog with examples and fixes:

• Structural (god class, long method, deep nesting)
• Logic (boolean blindness, stringly typed code)
• Security (SQL injection, hardcoded credentials)
• Performance (N+1 queries, unbounded collections)
• Testing (duplication, testing implementation)
• Async (floating promises, callback hell)

Languages Supported

| Language | Extensions | |----------|------------| | Python | .py | | TypeScript | .ts, .tsx | | JavaScript | .js, .jsx, .mjs | | Go | .go | | Swift | .swift | | Kotlin | .kt, .kts |

Troubleshooting

| Problem | Cause | Solution | |---------|-------|----------| | Error: /path is not a git repository | PR Analyzer requires a .git directory at the target path | Run from inside a git repo or pass the correct repo root path | | No changes detected between branches | The --base and --head refs are identical, or the branch has no diverging commits | Verify branch names with git branch -a; use explicit --base and --head flags | | Script times out on large repositories | git diff or file analysis exceeds the 30-second (PR Analyzer) or 300-second (Quality Checker) subprocess timeout | Narrow the scope with --language filter or analyze a subdirectory instead of the repo root | | Unsupported file type error | Code Quality Checker only processes .py, .ts, .tsx, .js, .jsx, .mjs, .go, .swift, .kt, .kts | Use the --language flag to target a supported language, or add extensions to LANGUAGE_EXTENSIONS in the script | | False-positive hardcoded secrets | Regex pattern matches test fixtures, example strings, or documentation | Review flagged lines manually; the pattern (password\|secret\|api_key\|token)\s*[=:]\s*['"][^'"]+['"] intentionally casts a wide net to avoid misses | | Review Report shows score of 0 | Multiple critical and high findings compound deductions past the floor | Address critical findings first; each critical risk deducts 15 points and each high risk deducts 10 | | Commit message issues flagged incorrectly | PR Analyzer enforces conventional commit format (feat:, fix:, etc.) | Adopt conventional commits or ignore the commit_issues section if your team uses a different convention |

Success Criteria

• Review turnaround under 4 hours: Automated pre-screening with PR Analyzer reduces manual triage time so reviewers focus on logic, not hygiene.
• Zero false-positive critical findings: Every critical-severity flag (hardcoded secrets, SQL injection) corresponds to a genuine risk requiring human verification.
• Code quality score above 80 on all merged PRs: Teams gate merges on the Quality Checker score, ensuring consistent baseline quality.
• 100% of PRs reviewed with a structured report: Every pull request gets a Review Report with verdict, score, and prioritized action items before merge.
• Commit message compliance above 95%: PR Analyzer commit validation drives adoption of conventional commit format across the team.
• Reduction in post-merge defects by 30%+: Systematic detection of code smells, SOLID violations, and risky patterns catches issues before they reach production.
• Review order adoption by reviewers: At least 80% of reviewers follow the suggested file priority order, ensuring security-sensitive files are inspected first.

Scope & Limitations

Covers:

• Static pattern-based risk detection in git diffs (secrets, SQL injection, debug statements, lint bypasses)
• Structural code quality analysis: function length, class size, cyclomatic complexity, parameter count, SOLID violations
• PR metadata assessment: file categorization by risk priority, commit message validation, complexity scoring
• Consolidated review reports with verdicts, scores, and prioritized action items across text, markdown, and JSON formats

Does NOT cover:

• Runtime or dynamic analysis -- use senior-qa for test execution and qa-browser-automation for end-to-end testing
• Security vulnerability scanning (CVE databases, dependency audits) -- use senior-security or senior-secops for SAST/DAST and supply chain analysis
• Performance profiling or benchmarking -