this post was submitted on 20 Mar 2026
24 points (76.1% liked)

Programming

26193 readers
182 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev

founded 2 years ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
UlrikHD@programming.dev
bugsmith@programming.dev
Spyro@programming.dev
24
Your thoughts on Code Reviews (infosec.pub)
submitted 3 days ago* (last edited 3 days ago) by mattreb@feddit.it to c/programming@programming.dev
48 comments fedilink hide all child comments
 

Hey, I want your opinion on code reviews, what is the best way to use them in a professional environment? Pick one of the following and give me your thoughts (from the most forgiving to the most strict):

  1. no code reviews, they are useless
  2. optional code reviews
  3. mandatory reviews on code that is already merged, optional fixes
  4. mandatory reviews on code before merging (like a pull request), with a time-frame for optional fixes (i.e. whether to fix what has been pointed out is up to the author), merge will occur anyway.
  5. mandatory reviews on code before merging (PR) with mandatory fixes.

Of course in open source development with public contributions, you'll often see (5), but I'm not convinced it could work in professional dev.

Edit: I'm talking about a team of 5 mid to senior devs (no junior or interns) working on a 2-3 year project without many security concerns, but feel free to give me your general opinion.

you are viewing a single comment's thread
view the rest of the comments
[–] coredev@programming.dev -3 points 2 days ago (4 children)

In a small shop where people really know and trust each other and all have high quality standards and would never break main - is code review necessary and for what purposes if so?

[–] ikirin@feddit.org 1 points 1 day ago* (last edited 1 day ago)

I work in a similar environment. Most of our projects lifecycle we were 4 devs who knew each other reasonably well and all had high trust in each other. Unless it was a one-liner or a hotfix at 4am did get merged without a code review. Most if the reviews were just hitting the checkmark, things look fine done. But sometimes someone makes a mistake, as is human. In that case we caught it before it hit main.

[–] KairuByte@lemmy.dbzer0.com 17 points 2 days ago

Yes, absolutely.

“Never break main” is the same concept as “never get in a car accident.” Good in theory, but it’s no replacement for insurance.

Everyone makes mistakes. PRs help catch those mistakes. Yes, bugs will still sneak in, no one is perfect, but a proper PR process is absolutely vital no matter the team size.

[–] pipe01@programming.dev 9 points 2 days ago

Even well intentioned people can make mistakes

[–] TehPers@beehaw.org 4 points 2 days ago

Yes, it's necessary. Even if everyone writes perfect, bug-free code, people learn from code reviews.