Loading AI tools
Activity where one or more people check a program's code From Wikipedia, the free encyclopedia
Code review (sometimes referred to as peer review) is a software quality assurance activity in which one or more people check a program, mainly by viewing and reading parts of its source code, either after implementation or as an interruption of implementation. At least one of the persons must not have authored the code. The persons performing the checking, excluding the author, are called "reviewers".[1][2]
This article may require copy editing for grammar, style, cohesion, tone, or spelling. (July 2024) |
Although direct discovery of quality problems is often the main goal,[3] code reviews are usually performed to reach a combination of goals:[4][5]
This definition of code review distinguishes it from related software quality assurance techniques, such as static code analysis, self-checks, testing, and pair programming. In static code analysis the main checking is performed by an automated program, in self-checks only the author checks the code, in testing the execution of the code is an integral part, and pair programming is performed continuously during implementation and not as a separate step.[1]
There are many variations of code review processes, some of which are detailed below. Additional review types are part of IEEE 1028.
IEEE 1028-2008 lists the following review types:[6]
Historically, the first code review process that was studied and described in detail was called "Inspection" by its inventor, Michael Fagan.[7] This Fagan inspection is a formal process that involves a careful and detailed execution with multiple participants and multiple phases. Formal code reviews are the traditional method of review, in which software developers attend a series of meetings and review code line by line, usually using printed copies of the material. Formal inspections are extremely thorough and have been proven effective at finding defects in the code under review.[7]
In recent years,[when?] many industry teams have introduced a more lightweight type of code review in which the scope of each review is based on the changes to the codebase performed in a ticket, user story, commit, or some other unit of work.[8][3] Furthermore, there are rules or conventions that embed the review task into the development process (e.g., "every ticket must be reviewed"), commonly as part of a pull request, instead of explicitly planning each review. Such a review process is called "regular, change-based code review".[1] There are many variations of this basic process. A survey among 240 development teams from 2017 found that 90% of the teams use a review process that is based on changes (if they use reviews at all), and 60% use regular, change-based code review.[3] Also, most large software corporations such as Microsoft,[9] Google,[10] and Facebook follow a change-based code review process.
Capers Jones' ongoing analysis of over 12,000 software development projects showed that the latent defect discovery rate of formal inspection is in the 60-65% range. For informal inspection, the figure is less than 50%. The latent defect discovery rate for most forms of testing is about 30%.[11][12] A code review case study published in the book Best Kept Secrets of Peer Code Review contradicted the Capers Jones study,[11] finding that lightweight reviews can uncover as many bugs as formal reviews but were faster and more cost-effective.[13]
Studies have found that up to 75% of code review comments affect software evolvability/maintainability rather than functionality,[14][15][4][16] suggesting that code reviews are an excellent tool for software companies with long product or system life cycles.[17] This also means that less than 15% of the issues discussed in code reviews are related to bugs.[18]
The effectiveness of code review was found to depend on the review speed. Code review rates should be between 200 and 400 lines of code per hour.[19][20][21][22] Inspecting and reviewing more than a few hundred lines of code per hour for critical software (such as safety critical embedded software) may be too fast to find errors.[19][23]
Static code analysis software lessens the task of reviewing large chunks of code on the developer by systematically checking source code for known vulnerabilities and defect types.[24] A 2012 study by VDC Research reports that 17.6% of the embedded software engineers surveyed currently use automated tools to support peer code review and 23.7% expect to use them within two years.[25]
Seamless Wikipedia browsing. On steroids.
Every time you click a link to Wikipedia, Wiktionary or Wikiquote in your browser's search results, it will show the modern Wikiwand interface.
Wikiwand extension is a five stars, simple, with minimum permission required to keep your browsing private, safe and transparent.