DEV Community

Discussion on: Should my small team really, really, really do code reviews?

Collapse
 
davidteren profile image
David Teren • Edited

Good post. As you mention Velocity I assume you have Quality in your pipeline.
It would benefit readers to mention the use of a build pipeline that fails if checks do not pass can go a long way towards minimising code-review overhead. It can be helpful if all failures are addressed before requesting a review.
On GitHub, you can use Actions, Security advisories, Dependabots not only to validate the app but also as mentioned in the above post, to require at least one review before merging is permitted.

Available tooling is language and framework dependent.

For example Ruby on Rails apps can employ:

Bonus security checks.

  • Bundler Audit for security vulnerabilities in libs.
  • Brakeman for static analysis tool which checks Ruby on Rails applications for security.
  • Snyk for security checks.
Collapse
 
aurelio profile image
Aurelio

Hi David, you raise good points.

Having automation in place is a big win. We do use Code Climate's Quality as you guessed, along other tools you mention. They help the developer get rid of errors and inconsistencies so that the reviewers can really focus on what matters and what only a human can do, i.e. provide contextual feedback on the code.

All these tools are generally trivial to set up in a pipeline and provide great advantages (most of them at little to no cost per month) so that there's really no point in working without them. They offer invaluable help in lowering the margin for errors and increasing speed of delivery.

I would say this is even worth a dedicated post. Thanks for the comment, I really appreciate it.