Loading…
Code Review
8 posts about Code Review. Every summary links to the original.
Why AI-Generated Code Is Easy but Engineering Trust Is Hard
At Salesforce, engineering teams discovered that AI coding agents could produce internally consistent code and passing test suites that still failed to meet actual requirements. To ensure correctness before writing code, the team developed an agentic Spec-Driven Development workflow centered on explicit specifications and gated verification. The system separates evidence-based repository lookups handled by agents from subjective judgment calls escalated to human engineers. Implementation plans must cite repository evidence reviewed by a Skeptic Agent, while a Compliance Matrix traces each success criterion directly to executable test proof. Finally, a multi-agent review system evaluates the implementation under an asymmetric rule allowing an independent judge to downgrade passing checks but never override failed gates.
Scott NybergGithub ·
Turn one giant AI-generated pull request to a reviewable stack
Coding agents often consolidate full-stack features into monolithic pull requests spanning thousands of lines, resulting in delayed reviews and lower feedback quality. To resolve this bottleneck, engineers can decompose comprehensive features into ordered, single-concern layers using GitHub stacked pull requests and the gh-stack CLI extension. Distinct specialized agents handle individual branches—ranging from foundational data access modules up to client interfaces—while CI checks continuously evaluate each layer against the stack base. When reviewers request upstream modifications, running gh stack sync executes a cascading rebase across all dependent branches, preserving commit signatures and keeping the entire pull request chain mergeable.
Julia MuiruriGithub ·
The cost of saying yes has changed
Generating initial code patches has become significantly cheaper with AI agents, shifting the primary expense of small feature requests from writing code to debating scope in meetings. Teams can use agent-generated patches as diagnostic probes rather than final deliverables, turning abstract scope debates into concrete artifacts that reveal true system touchpoints and risks. However, low generation costs do not translate to low ownership costs, as changes touching areas like authorization, compliance, or public contracts still demand significant human review. Constrained attempts allow engineers to price uncertainty quickly and shift scope discipline from pre-implementation speculation to evidence-based code review.
Dalia AbuadasGithub ·
Better tools made Copilot code review worse. Here’s how we actually improved it.
When migrating GitHub Copilot code review from custom navigation tools to shared Unix-style CLI utilities—grep, glob, and view—benchmarks revealed higher review costs and fewer caught issues. Rather than an issue with the underlying tools, trace analysis showed the agent used general-purpose coding assistant instructions that triggered expansive repository browsing loops. In response, the team rewrote the tool guidance to enforce a review-specific workflow anchored to pull request diffs. The updated instructions direct the agent to narrow candidate call sites and files using batched discovery before reading minimal line ranges with view. This workflow tuning reduced average review costs by approximately 20% in production while maintaining review quality.
Napalys KliciusDropbox ·
How Dropbox uses MCP and Dash to close the design-to-code security gap
Dropbox developed a system using the Model Context Protocol (MCP) and Dash's semantic search to bridge the gap between security threat models and code implementation. By retrieving original security documents during pull requests, an LLM agent automatically evaluates whether the proposed code adheres to previously agreed-upon security requirements. This approach surfaces design regressions and missing controls that traditional static analysis tools miss.
Ilya Yakovlev,Andrew Cheung,Binoy Dash,Simran Jumani,Dmitriy Meyerzon,Mark Breitenbach,Ishan MishraDropbox ·
Beyond code generation: rethinking engineering productivity in the age of AI agents
Dropbox shares how widespread AI code generation shifts software development bottlenecks downstream into code review, CI infrastructure, and validation pipelines. To adapt, they built Nova, an internal coding agent platform that safely automates scoped tasks such as migrations and flaky test remediation. They also evolved their developer productivity framework to measure end-to-end customer impact and code quality rather than simple pull request throughput.
Ilya Yakovlev,Andrew Cheung,Binoy Dash,Simran Jumani,Dmitriy Meyerzon,Mark Breitenbach,Ishan Mishra,Kazuaki OkumuraGrab ·
How OVO determined the right technology stack for their web-based projects
OVO faced maintainability issues caused by fragmented web technology stacks, including PHP, Vue, React, Nuxt, and Go, alongside outdated documentation. This fragmentation resulted in severe context-switching costs during code reviews and prolonged onboarding times for new engineers. To establish a single primary front-end stack, the team compared React and Vue against maintainability principles encompassing operability, simplicity, and evolvability. Vue was selected because its standardized framework structure and documentation minimized architectural variations across projects. Implementation entailed creating a standardized Vue boilerplate, updating the internal UI library, and scheduling periodic upgrades for legacy React services rather than migrating them entirely.
George Matthew LimonganGrab ·
Embracing a Docs-as-Code approach
Engineers at Grab faced difficulties finding and writing technical documentation because materials were fragmented across various platforms and disconnected from daily workflows. To establish a single source of truth, the organisation adopted a Docs-as-Code approach starting in 2021. Under this system, documentation is written in plaintext Markdown within dedicated folders inside each service's Git repository. An internal developer portal automatically builds and publishes documentation whenever updates are committed, integrating documentation maintenance into the standard code development and review workflow. By April 2022, approximately 80% of Grab services were projected to host their documentation on the internal portal, with the model also expanding to technical training content.
Shu Juan Cheong