Review Workflows

Review Workflows

Transform code reviews from bottlenecks into accelerators. Learn AI-powered review workflows that catch more issues, provide better feedback, and turn reviews into learning opportunities.

The AI Review Revolution

Traditional code review challenges:

• Time-consuming manual inspection
• Inconsistent review quality
• Missed bugs and security issues
• Delayed feedback cycles
• Review fatigue

AI-powered review benefits:

• Instant comprehensive analysis of all changes
• Consistent quality checks across all PRs
• Automated security scanning and bug detection
• Educational feedback with explanations
• Focus human attention on architecture and design

Impact: Complete reviews 5x faster while catching 3x more issues.

Core Review Patterns

Automated Pre-Review

AI catches issues before human review

Review Enhancement

Augment human reviews with AI insights

Learning Reviews

Turn reviews into teaching moments

Review Automation

Automate repetitive review tasks

Pattern 1: The Pre-Review Protocol

AI First Pass Before Human Review

1. Automatic PR Analysis

   .github/workflows/ai-review.yml

   name: AI Code Review
   on:
     pull_request:
       types: [opened, synchronize]
   
   jobs:
     ai-review:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v3
         - name: Run AI Review
           run: |
             cursor review \
               --pr ${{ github.event.pull_request.number }} \
               --checks "bugs,security,performance,style" \
               --comment-on-issues

2. BugBot Configuration

   .cursor/BUGBOT.md

   ## Review Focus Areas
   
   ### Security Critical
   
   - SQL injection vulnerabilities
   - XSS attack vectors
   - Authentication bypasses
   - Exposed secrets or keys
   
   ### Performance Issues
   
   - N+1 query problems
   - Memory leaks
   - Inefficient algorithms
   - Missing indexes
   
   ### Code Quality
   
   - Complex functions (>50 lines)
   - Deep nesting (>4 levels)
   - Magic numbers
   - Missing error handling

3. AI Review Results

   ## 🤖 AI Review Summary
   
   ### 🚨 Critical Issues (2)
   
   1. **SQL Injection Risk** - Line 45 in `user.controller.js`
   
      ```javascript
      // Vulnerable code
      const query = `SELECT * FROM users WHERE id = ${userId}`;
   
      // Suggested fix
      const query = 'SELECT * FROM users WHERE id = ?';
      db.query(query, [userId]);
      ```

   2. Missing Authentication - DELETE /api/users/:id endpoint
      • No auth middleware applied
      • Any user can delete any account

   ⚠️ Warnings (3)

   1. Performance: Potential N+1 query in order loading
   2. Style: Inconsistent error handling pattern
   3. Maintenance: Function complexity too high (cyclomatic: 15)

   ✅ Improvements (5)

   • Good test coverage for new features
   • Proper input validation added
   • Clear documentation included

Pattern 2: Human-AI Collaborative Review

Enhancing Human Reviews with AI

Reviewer Assistance

# AI-Assisted Review Process

## Step 1: Get AI Summary
@pr #1234 Provide a comprehensive summary of this PR:
1. What problem does it solve?
2. What are the main changes?
3. What are the risks?
4. What needs careful review?

## Step 2: Deep Dive on Complex Areas
@file src/payments/processor.js
Analyze this payment processing logic:
- Are there edge cases not handled?
- Could this cause double charges?
- Is error handling comprehensive?

## Step 3: Security Check
Review all changes for security issues:
- Authentication/authorization
- Input validation
- Data exposure
- Third-party dependencies

Author Assistance

# Pre-Submission Self-Review

## Before Creating PR
@git diff main
Review my changes and:
1. Identify potential issues
2. Suggest improvements
3. Check for breaking changes
4. Verify test coverage

## PR Description Generation
Generate a comprehensive PR description:
- Problem statement
- Solution approach
- Testing performed
- Breaking changes
- Deployment notes

## Review Response Helper
@comment "Please add more tests"
Help me address this review comment:
1. What tests should I add?
2. Generate the test code
3. Explain the coverage improvement

Pattern 3: Educational Code Reviews

Turn Reviews into Learning Opportunities

## Review with Teaching Focus

@pr #1234
@file src/auth/jwt.js

Provide an educational review that:

1. **Explains Issues** (not just identifies them)
   - Why is this a problem?
   - What could go wrong?
   - Real-world examples of failures

2. **Teaches Best Practices**
   - Industry standards for this pattern
   - Links to authoritative resources
   - Alternative approaches with trade-offs

3. **Provides Examples**
   - Show the corrected code
   - Demonstrate edge cases
   - Include test cases

4. **Suggests Learning Resources**
   - Documentation to read
   - Similar well-implemented code in the codebase
   - External tutorials or courses

Example Output:
"""

### Security Issue: JWT Secret Handling

**What's wrong:** The JWT secret is hardcoded in the source file.

**Why it matters:** Anyone with access to your code (including public repos) can forge valid tokens, completely bypassing authentication.

**Real incident:** In 2019, a major app exposed JWT secrets in their public repo, leading to unauthorized access to millions of accounts.

**Best practice:** Store secrets in environment variables or a secure vault.

**How to fix:**

```javascript
// Bad
const secret = 'my-secret-key';

// Good
const secret = process.env.JWT_SECRET;
if (!secret) {
  throw new Error('JWT_SECRET environment variable not set');
}
```

Learn more:

• OWASP on Key Management
• Similar pattern in our codebase: src/config/database.js
• Course: “Secure Node.js Development” on Pluralsight """

## Pattern 4: Automated Review Actions

### Streamline Repetitive Review Tasks

1. **Auto-Fix Simple Issues**
   ```javascript
   // Cursor review action configuration
   {
     "autoFix": {
       "enabled": true,
       "issues": [
         "formatting",
         "imports",
         "simple-linting",
         "obvious-typos"
       ],
       "requireApproval": false
     }
   }

2. Auto-Approve Safe Changes

   # Auto-approve certain PRs
   rules:
     - name: 'Documentation Only'
       conditions:
         - files: '**/*.md'
         - no-files: '**/*.{js,ts,py,java}'
       action: 'auto-approve'
   
     - name: 'Dependency Updates'
       conditions:
         - author: 'dependabot'
         - files: '**/package-lock.json'
         - ci-status: 'passing'
       action: 'auto-approve'

3. Smart Review Assignment

   Use Cursor Agent to analyze PRs and suggest reviewers:

   Workflow:

   1. Open the PR diff in Cursor
   2. Use Agent mode (Ctrl+I) with this prompt:

   Analyze @Git changes and suggest appropriate reviewers based on:
   
   - Files modified and their ownership
   - Technical domains affected (auth, database, UI, etc.)
   - Complexity of changes
   - Required expertise
   
   Consider our team structure:
   
   - Security team: auth, crypto, permissions
   - Database team: migrations, queries, schema
   - Frontend team: UI components, styling, UX

   GitHub Integration Script:

   analyze-pr-reviewers.sh

   #!/bin/bash
   # Get PR files
   PR_FILES=$(gh pr view $1 --json files -q '.files[].path')
   
   # Create analysis prompt
   echo "Analyzing PR #$1 for reviewer suggestions..."
   echo "$PR_FILES" > pr-files.txt
   cursor pr-files.txt

Pattern 5: Review Quality Metrics

Measuring and Improving Review Effectiveness

# Review Quality Metrics Workflow in Cursor

## Analyze PR Quality with Agent Mode:

1. Open PR in Cursor
2. Use Agent (`Ctrl+I`) to analyze:
   - "Evaluate the quality of this PR based on @Git changes"
   - "Check test coverage for @Recent Changes"
   - "Identify potential issues in @Files"

## Track Metrics Using Cursor Rules:

Create `.cursor/rules/review-metrics.md`:

```javascript
return {
      // Time metrics
      timeToFirstReview: pr.firstReviewTime - pr.createdAt,
      timeToMerge: pr.mergedAt - pr.createdAt,

      // Quality metrics
      issuesFoundByAI: aiAnalysis.issues.length,
      issuesFoundByHumans: pr.comments.filter(c => c.isIssue).length,
      issuesMissedByHumans: aiAnalysis.issues.filter(i =>
        !pr.comments.some(c => c.line === i.line)
      ).length,

      // Coverage metrics
      filesReviewed: pr.filesChanged,
      linesReviewed: pr.additions + pr.deletions,
      testCoverage: aiAnalysis.testCoverage,

      // Outcome metrics
      bugsInProduction: await trackPostMergeBugs(pr),
      requiredHotfixes: await trackHotfixes(pr)
    };

}
};

## Advanced Review Techniques

### Technique 1: Architecture Review Automation

```markdown
## AI Architecture Review

@pr #1234
@folder src/

Perform an architecture review:

1. **Dependency Analysis**
   - New dependencies added
   - Circular dependencies
   - Dependency security audit
   - Bundle size impact

2. **Design Pattern Compliance**
   - Follows established patterns?
   - Introduces new patterns?
   - Maintains consistency?

3. **Performance Impact**
   - Database query analysis
   - API call patterns
   - Frontend bundle impact
   - Memory usage patterns

4. **Scalability Concerns**
   - Will this scale to 10x users?
   - Database index requirements
   - Caching opportunities
   - Rate limiting needs

5. **Maintenance Impact**
   - Code complexity increase
   - Documentation needs
   - Testing requirements
   - Monitoring additions

Technique 2: Cross-Team Review Coordination

Using Cursor for Cross-Team Impact Analysis:

1. Create Impact Analysis Template

   Save as .cursor/templates/cross-team-review.md:

   # Cross-Team Review Analysis
   
   ## Check for Breaking Changes:
   
   Use @Git to analyze changes for:
   
   - API contract modifications
   - Database schema changes
   - Shared library updates
   - Configuration changes
   
   ## Team-Specific Analysis:
   
   ### Mobile Team Impact:
   
   - Check @Files in /api/\* for endpoint changes
   - Review @Recent Changes for response format updates
   
   ### Data Team Impact:
   
   - Check @Files in /migrations/\* for schema changes
   - Review @Recent Changes in database models
   
   ### Frontend Team Impact:
   
   - Check @Files in /shared/\* for component changes
   - Review @Recent Changes for UI library updates

2. Workflow Script

   cross-team-review.sh

   #!/bin/bash
   # Generate impact report using Cursor
   echo "Analyzing PR #$1 for cross-team impact..."
   
   # Open Cursor with the review template
   cursor .cursor/templates/cross-team-review.md
   
   # In Cursor Agent, use prompts like:
   # "Analyze @Git changes for breaking changes that affect other teams"
   # "Check if @Recent Changes impact mobile API contracts"
   # "Review database @Files for schema changes requiring migration"

Technique 3: Review Learning System

// Learn from review patterns
class ReviewLearningSystem {
  async learnFromReview(pr) {
    // Collect what was missed
    const missedIssues = await this.findProductionIssues(pr);

    if (missedIssues.length > 0) {
      // Update AI rules
      await this.updateReviewRules({
        pattern: this.extractPattern(missedIssues),
        description: 'Check for similar issues',
        examples: missedIssues,
      });

      // Alert team
      await this.notifyTeam({
        title: 'New review pattern detected',
        pattern: pattern,
        action: 'Please review and acknowledge',
      });
    }
  }
}

Review Workflow Templates

PR Template with AI Assistance

## Pull Request Description

### 🎯 Purpose

<!-- AI will help summarize the purpose -->

### 🔄 Changes

<!-- AI will list all significant changes -->

### 🧪 Testing

- [ ] Unit tests added/updated
- [ ] Integration tests passed
- [ ] Manual testing completed
- [ ] AI test generation run

### 🔍 Review Checklist

- [ ] Code follows style guidelines
- [ ] Self-review completed
- [ ] AI pre-review addressed
- [ ] Documentation updated
- [ ] No security issues

### 🤖 AI Review Summary

<!-- Automatically populated by AI -->

### 📝 Additional Notes

<!-- Any special instructions for reviewers -->

Review Metrics & Impact

Metric	Before AI	With AI	Improvement
Review time	45 min	15 min	67% faster
Issues found	3-5	10-15	3x more
Security issues	20% missed	2% missed	90% better
Review consistency	Variable	High	Standardized
Learning value	Low	High	Educational

Best Practices

Tip

Golden Rules for AI-Assisted Reviews:

1. AI First, Human Second - Let AI catch obvious issues
2. Focus on Architecture - Humans review design, AI reviews implementation
3. Educate, Don’t Just Critique - Make reviews learning opportunities
4. Automate Repetitive Checks - Save human attention for complex issues
5. Track and Improve - Use metrics to enhance review process

Common Pitfalls

Caution

Review Anti-Patterns to Avoid:

1. Over-relying on AI - Human judgment still essential
2. Ignoring AI warnings - Investigate all AI-flagged issues
3. Review theater - Don’t just approve because AI passed
4. Missing the big picture - AI might miss architectural issues
5. Delayed reviews - Use AI to review immediately

Review Checklists

Pre-Review Checklist

• AI review completed
• All CI checks passing
• PR description complete
• Changes are focused
• Tests included

During Review Checklist

• Understand the purpose
• Check AI-flagged issues
• Review architecture impact
• Verify test coverage
• Consider edge cases

Post-Review Checklist

• All comments addressed
• Re-review if significant changes
• Documentation updated
• Deployment plan clear
• Team notified if needed

Next Steps

Master review workflows to:

• Reduce review cycle time by 70%
• Catch critical issues before production
• Turn reviews into learning experiences
• Build better team collaboration

Continue with:

• Time Savers - More productivity techniques
• Testing Patterns - Ensure quality before review
• Debugging Workflows - When issues slip through

Remember: The best code review is one that catches bugs, teaches developers, and ships quickly. Use AI to handle the mechanical parts while humans focus on design and knowledge sharing.