Best Practices - Code Review

Definition

Code review, often referred to as peer review, is a crucial software quality assurance activity. It involves one or more individuals examining a program by reviewing and reading parts of its source code, either after implementation or during the development process. At least one reviewer must not be the author of the code. Those conducting the review, excluding the author, are known as "reviewers."

Source of the Practice

The first detailed study and description of the code review process was introduced by Michael Fagan, who coined the term "inspection." Fagan's inspection process aims to identify defects in documents, such as source code or formal specifications, at various stages of software development. He is recognized as the pioneer of formal software inspections.

Why It Matters

• Enhanced Code Quality: Code reviews significantly improve internal code quality and maintainability, focusing on factors like readability, consistency, and understandability.
• Early Defect Detection: By enhancing the quality of the code, especially its correctness, code reviews help identify performance issues, security vulnerabilities, and injected malware early on. This proactive approach allows developers to address problems before they reach production, minimizing the need for emergency patches.
• Knowledge Transfer: Code reviews facilitate the transfer of knowledge about the codebase, solution approaches, and quality expectations. They enable junior developers to learn from senior colleagues, fostering a collaborative learning environment. This practice ensures that no individual becomes a single point of failure within the team.
• Increased Collaboration: Code reviews foster a sense of collective ownership and camaraderie among team members. When developers collaborate on solutions, they feel a stronger sense of belonging and accountability.
• Generating Better Solutions: The process encourages the development of innovative ideas and solutions that extend beyond the specific code in question.
• Compliance with QA Guidelines and Standards: In certain contexts, such as air traffic software and safety-critical systems, code reviews are mandatory.

When to Use

Code reviews should be conducted after successful automated checks (testing, style, other CI processes) but before merging code into the main branch of the repository.

Source: Freepik

How to Use

• Email Threads: Once the code is ready for review, it can be shared via email with relevant colleagues for feedback. While this method offers flexibility, it can quickly become complicated, leaving the original coder to navigate multiple suggestions and opinions.
• Pair Programming: This approach pairs developers to work side by side on the same code, allowing them to review each other’s work in real time. While effective for mentoring, it may lack objectivity due to the closeness of the collaborators.
• Over-the-Shoulder Reviews: This informal technique allows one developer to review another's code by sitting together and discussing it. While straightforward, it may be too lightweight if it lacks proper tracking or documentation.
• Tool-Assisted Reviews: Software-based code review tools provide a systematic way to track comments and proposed fixes, allowing for asynchronous reviews without the need for meetings. These tools enhance efficiency and can also help manage requirements documentation effectively.

Outputs

The main output of a code review is constructive feedback on the code, which may include suggestions for improvements or corrections.

Case Study

Here is a user case from Measures:

A product development company implemented daily code walkthroughs to enhance their development process. Starting in November 2009, they dedicated an hour each day for code reviews, pairing one author with an expert. With 200 developers and 70 system testers, the company established a comprehensive set of measures to promote this practice.

Institutional Measures:

• Implementing a daily one-hour review session.
• Establishing a review process and checklist.
• Conducting quality checks on the reviews by the Software Quality Assurance (SQA) team.

Metrics Measures:

• Measuring the efficiency and workload of code reviews.

Awareness Measures:

• Promoting the importance of code reviews through slogans and publicizing metrics.

Training Measures:

• Collecting typical cases and providing education on effective code reviews.

Tool Measures:

• Analyzing correlations between static analysis tool alerts and bugs found during testing.

After one month, the data revealed that code reviews were 4.25 times more effective at detecting defects than system testing.

This case underscores the significant benefits of implementing systematic code reviews in enhancing software quality and development efficiency.

References:

1. https://en.wikipedia.org/wiki/Code_review
2. https://about.gitlab.com/topics/version-control/what-is-code-review/
3. https://smartbear.com/learn/code-review/what-is-code-review/