Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates to reflect best practices for PR review #220

Merged
merged 26 commits into from
Jan 26, 2024
Merged
Show file tree
Hide file tree
Changes from 18 commits
Commits
Show all changes
26 commits
Select commit Hold shift + click to select a range
1da15ef
Updates to reflect best practices for PR review
trmartin4 Oct 27, 2023
f0a30b3
Clarify PR size requests
trmartin4 Oct 27, 2023
bfc1f00
Added back note on bugs in the SDLC.
trmartin4 Oct 27, 2023
276e501
Changed verbiage around requesting changes.
trmartin4 Oct 31, 2023
6df2155
Added a section on addressing feedback.
trmartin4 Nov 1, 2023
8deb2f9
Close <bitwarden> tag to fix compile error.
trmartin4 Nov 1, 2023
3281269
Grammatical changes from PR review.
trmartin4 Nov 1, 2023
6aeb877
Fixed comments section
trmartin4 Nov 1, 2023
2d22f5f
Fixed re-visit.
trmartin4 Nov 1, 2023
dbdc507
Added tips for notifications.
trmartin4 Nov 1, 2023
bb4f05d
Merge branch 'master' into pr-review-updates
withinfocus Nov 1, 2023
5b1a34d
Updated dash
trmartin4 Nov 5, 2023
4929c05
Removed comma
trmartin4 Nov 5, 2023
53445fe
Added pair programming to code review suggestions.
trmartin4 Nov 5, 2023
6b06140
Updated conventional comment note
trmartin4 Nov 5, 2023
38a5c86
Updated dash
trmartin4 Nov 5, 2023
c116672
Removed conventional comments section.
trmartin4 Nov 5, 2023
0fa729a
Linting
trmartin4 Nov 5, 2023
440c84d
Restructured branching doc to provide tips for breaking down work.
trmartin4 Nov 8, 2023
7d93823
Updated link to new section on branching.
trmartin4 Nov 8, 2023
522f424
Updated grammatical error.
trmartin4 Nov 8, 2023
b78e66a
Updated timeframe for reviews.
trmartin4 Nov 8, 2023
3131dcf
Updated time expectations to 48 hours.
trmartin4 Nov 10, 2023
760b5b8
Merge branch 'main' into pr-review-updates
trmartin4 Jan 25, 2024
97745a9
Updated PR review expectations to be in days not hours.
trmartin4 Jan 25, 2024
815208e
Fixed broken link.
trmartin4 Jan 25, 2024
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/contributing/pull-requests/branching.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
---
sidebar_position: 1
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why are we setting sidebar positions on these? Do we dislike the alphabetical ordering?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It wasn't ordering alphabetically before - the positions are to order it alphabetically. I'll take them out and double-check that I'm correct in that statement.

sidebar_custom_props:
access: bitwarden
---
Expand Down
1 change: 1 addition & 0 deletions docs/contributing/pull-requests/chromatic.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
---
sidebar_position: 3
sidebar_custom_props:
access: bitwarden
---
Expand Down
60 changes: 45 additions & 15 deletions docs/contributing/pull-requests/code-review.md
Original file line number Diff line number Diff line change
@@ -1,24 +1,28 @@
---
sidebar_position: 2
---

# Code Review Guidelines

At Bitwarden, we encourage everyone to participate in code reviews. A team will focus primarily on
their own code reviews, but if you see something interesting, feel free to jump in and discuss.

To have efficient code reviews there are a few things to keep in mind (from
[Best Practices for Code Review | SmartBear](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/)):
A few general guidelines:

- Pull requests should be manageable. If the PR is too large -- significantly above a few hundred
lines -- ask the contributor if it can be split it up into multiple PRs before reviewing.
- This can be tricky in our code base since many things are tightly coupled.
- This can be tricky in our codebase since many things are tightly coupled.
- Take your time when reviewing - expect a rate of less than 500 lines of code per hour.
- Take breaks - don’t review for longer than 60 minutes.

Don’t feel bad for taking your time when doing code reviews! They often take longer than you think,
and we should be spending as much time as needed.
and we should be spending as much time as needed. When you find a bug or defect during PR review,
the cost of fixing it is much smaller than if it escapes further into the development lifecycle.

:::tip
:::tip Want to read more?

Bugs or defects found early in the development cycle have a much smaller cost associated with fixing
them.
You can find more tips for PR review here:
[Best Practices for Code Review | SmartBear](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/)

:::

Expand All @@ -33,7 +37,16 @@ always welcome! For example, it’s okay to leave some general comments or feedb
that you don’t have enough knowledge to approve the changes. The author can ask for another review
from someone else, and there’s nothing wrong in having two reviewers on a PR.

:::info Note
When undertaking a review, keep in mind that you are taking an ownership stake in the changes. You
should always strive to provide actionable feedback to the author and to make yourself available for
any clarifying questions or to pair on fixes suggested.

While we mostly use an asynchronous review process, please don't hesitate to schedule a meeting with
the author to discuss the changes. While asynchronous communication can be useful, it incurs a time
penalty which can drag out the review process. Sometimes setting up a short call to discuss the
changes can save a lot of time.

:::info Assumptions

<a id="assumptions-note"></a> When reviewing code, remember that all software is built to conform to
a set of assumptions. Features, bug fixes, and other requirement changes represent a change in those
Expand All @@ -44,22 +57,36 @@ requirements, which may not necessarily be in line with the previous solution.

### Review statuses

Please use the review statuses appropriately.
When completing a review, you can either add comments, request changes, or approve the PR. It is
important that both the reviewer and the author understand the expectations around each type of
review, so we use the guidelines below.

:::tip Tip for effective feedback

When providing comments or requesting changes, keep in mind the experience level of the author.

If the engineer is new to the company and the codebase or less experienced overall, they would
probably welcome more explicit background on your concerns and more concrete suggestions, whereas a
more experienced engineer would prefer general guidance so that they can solve the problem
themselves.

:::

#### Comment

Comment is a great way to discuss things without explicitly approving or requesting changes.
Using comments is a great way to discuss things without explicitly approving or requesting changes.

#### Request changes

Request changes should be used when you believe something **needs** to change prior to the PR
getting merged, as it will prevent someone else from approving the PR before your concerns have been
tackled.

We shouldn’t hesitate to use this status, however we should give clear feedback on what needs to
change for the PR to get approved. Likewise a PR author should not be discouraged by a _request for
changes_, it's simply an indication that changes should be made prior to the PR being merged. This
is common.
We shouldn’t hesitate to use this status. However, it does come with obligations for the reviewer.
By blocking the PR from progressing, you are taking on additional responsibility and should give
clear feedback on what needs to change for the PR to get approved. Likewise, a PR author should not
be discouraged by a request for changes, it's simply an indication that changes should be made prior
to the PR being merged. This is common.

:::warning Discarding reviews

Expand All @@ -76,12 +103,14 @@ scenarios where discarding the reviews are generally seen as accepted.

#### Approve

Approving a PR means that you have confidence in that the code works, and that it does what the PR
Approving a PR means that you have confidence in that the code works and that it does what the PR
claims. This can be based on testing the change or on previous domain knowledge.

- The PR targets the [correct branch](branching/#which-branching-model-to-choose).
- You have verified that the linked Jira issue description matches the changes made in the PR.
- You have read and understood the full impact of the changes suggested by the PR.
- You have verified that all possible changes have been
[unit tested](./../testing/unit/naming-conventions.mdx).
Comment on lines +112 to +113
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a major change to our current practices, which are less strict about this. This is worth highlighting when this is shared more broadly.

- You attest that the changes
- Solve the intended problem,
- [solve the requirements in the best way](#assumptions-note),
Expand Down Expand Up @@ -113,6 +142,7 @@ a time.
- Does the PR change the areas you expect to be changed?
- Are any missing?
- Are any present you didn't expect?
- Are unit tests present?
- Micro View - Focus on individual files.
- Is the code style adhered?
- Is the code readable?
Expand Down
105 changes: 89 additions & 16 deletions docs/contributing/pull-requests/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -97,33 +97,106 @@ changes” to a PR forcing the reviewer to start over again.

:::

## Creating a Pull Request
## Creating a pull request

The Bitwarden repositories have a _Pull Request template_ which should be followed. This will ensure
the PR review goes smoothly since it will provide context to the reviewer. <community> Once a
community PRs has been created, they will be automatically be linked to an internal Jira ticket. The
internal ticket is used for prioritization and tracking purposes.</community><bitwarden>Include a
Jira ticket reference so the reviewer can gain all context on the work.</bitwarden> Tag
`@dept-design` as a reviewer for any UI changes.
the PR review goes smoothly since it will provide context to the reviewer.<community> Once a
community PR has been created, it will be automatically be linked to an internal Jira ticket. The
internal ticket is used for prioritization and tracking purposes.</community><bitwarden> When
creating the PR include a Jira ticket reference so the reviewer can gain all context on the work as
well as links to any associated PRs in other repositories.</bitwarden>

## Review process
<bitwarden>

<community>
### Tagging reviewers

Once a Community PR has been created a Bitwarden developer will perform a code review, while we try
to this in a reasonable time-frame, please understand that we have internal roadmaps and priorities
that may delay this process.
We use `CODEOWNERS` in each repository to assign the reviewing teams based on the files in the PR.
These reviews are required for the changes to be merged to `master`.

</community>
You can tag additional teams or individuals for review as you see fit, including `@dept-design` for
any design changes.

### Opening the PR for review

As its name implies, marking a PR as "Ready for Review" indicates that you are ready for all
assigned teams to review it. If the changes are still in progress, leave the PR in `Draft` status.
Doing this ensures that reviewers can act on the "Ready for Review" as their signal to begin the
review process without further notification.

### Addressing feedback

It is likely that you will receive some feedback on your PR. You should see this as a positive thing
-- it signifies a healthy and thorough review process and an organizational commitment to code
quality. You may receive [comments](./code-review.md#comment) or a
[request for changes](./code-review.md#request-changes). You are encouraged to engage in
conversation on the PR to discuss a solution, but if any strong conflicting opinions arise it is
often best to move the conversation to a synchronous format to avoid any misunderstanding.

When any necessary changes have been made, you should address the comments or request for changes by
responding in the PR conversation thread. You are not responsible for resolving the conversation --
that is the prerogative of the reviewer, to ensure that they agree that the question or concern has
been addressed.
Comment on lines +136 to +138
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a significant clarification (different people do different things at the moment) - would like this highlighted when these changes are shared


**When you are ready for a reviewer to revisit your changes, you should request a re-review.** This
will notify the reviewer and ensure a prompt response.

</bitwarden>

## Reviewing the pull request
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to leave a note somewhere about re-requesting review once the feedback is resolved? I've noticed it's sometimes not done which delays new reviews.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also support. This helps a lot, especially when many teams are involved in a review.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created a section called "Addressing feedback" that includes this, as well as a recommendation to allow the commenter to "Resolve conversation" - if that's not our position I can remove that part.


<bitwarden>

While we mostly use an async review process, please don't hesitate to schedule a meeting with the
reviewer/contributor to discuss the changes. While async communication can be useful it incurs a
time penalty which can drag out the review process. And sometimes setting up a short call to discuss
the changes can potentially save a lot of time.
At Bitwarden, we believe that the act of reviewing PRs is a critically important part of each
engineer's job. It is as important, if not more important, than the act of writing code.

To ensure that teams within the organization operate on same set of assumptions for performing
reviews, we have agreed to a baseline set of expectations.

When a PR author opens a PR for review, they should have the expectation that:

- The act of opening the PR for review is the **only** notification required. Teams are responsible
for properly configuring notifications so that team members are aware of their obligations.
Comment on lines +157 to +158
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would want us to document some available integrations, and give teams a chance to start using them, before actively enforcing it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Handy link on more info: https://docs.github.com/en/enterprise-cloud@latest/organizations/organizing-members-into-teams/managing-code-review-settings-for-your-team

I don't know if we need anything more than what GitHub provides. Maybe Slack reminders?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I get 30+ notifications daily which makes GH notifications mostly unusable without spending a non trivial amount of time maintaining it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've added a section for this:
image.

My assumption was that the build-in reminder integration with Slack was sufficient and we didn't need to customize anything, but that may not be the case.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I expect that removing tech-leads as the default reviewer should help with notification overload.

- The reviewing team(s) will respond within **24 hours** to:
- Provide a review,
- Inform the author when a review will be provided, or
- Ask the author to split the work into a smaller PR for review
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Has the team agreed to a 24 hour PR review deadline? I haven't seen any discussion about this, but I may have missed it.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not to my knowledge. I'm not against this though but it should be communicated.

I also think we need to spend further effort to clean up tech-leads codeowners since I haven't found a way to exclude them from review filters.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree. I wanted to discuss here and then communicate in a bulleted list to the teams in Slack. This felt like a good place to start the discussion. I’m not in any way pushing for 24 - if we want to have a longer timeframe that’s fine. My main concern is having everyone bought in on what the timeframe is so we don’t have to resort to pinging on Slack for every PR.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe "business day"? I personally feel one day is actually pretty tough unless engineers can be in formal support rotations and have this as a priority.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what would be a reasonable deadline here, although I agree 1 business day is tight. 2 business days?

This is not a very visible place for discussion and this would be a fairly major change to the current expectations, I suggest sharing in Slack.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After discussion with Tech Leads and EMs, we settled on 48 hours. I've addressed that in 3131dcf

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: This line needs to be expanded upon and supported by a section informing the author on how to create PRs for an intended change. This could be added to the branching document and linked here.

I think this is the primary reason for our large PR backlog. My recommendation would be limiting PRs to 1000 loc and preferring config or software feature flagging to allow for incomplete features to be present in the codebase.

Suggested change
- Ask the author to split the work into a smaller PR for review
- Ask the author to split the work into a smaller PR for review. Suggest reasonable axes to on which to divide the work (see [branching for large features](#link-to-new-section)

Copy link
Member Author

@trmartin4 trmartin4 Nov 8, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@MGibson1, I've addressed this by completely revamping the branching page, in 440c84d. As we are moving closer to a trunk-based branching scheme, with the preference toward merging to master, I felt that it was better to focus on how to build small, incremental changes and not detail the complex branching scenarios we had to handle previously around Short-Lived Feature Branches and Long-Lived Feature Branches. I'd welcome any feedback on it, especially on ways to think about breaking up work - that was very much my attempt at condensing feedback and adding intuition to it to come up with some ideas.

I also thought that something like this might be nice to have: https://github.com/marketplace/actions/pull-request-size-labeler

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you nailed it, thank you.

I'm not really that convinced that the labels would have value, but the concept certainly does. If you think that'll help encourage people to smaller bites let's do it!


:::tip Notifications

Our teams use GitHub notifications as the primary method of communication for PR review requests and
scheduled reminders are highly encouraged to facilitate prompt responses to requests.

- Individual engineers are encouraged to set up [scheduled reminders][user reminders] for
themselves.
- Each team has [scheduled reminders][team reminders] on a dedicated Slack channel (e.g.
#team-eng-platform-notifications).

:::

### Follow-up notification

If there is no response to a request for review in 24 hours, the author should reach out to the
team(s) -- or to individual engineers if assigned -- via Slack to follow up.

This should wait for 24 hours to allow the default process to take place and not overwhelm the team
with notifications on multiple platforms.

</bitwarden>

<community>

Once a Community PR has been created a Bitwarden developer will perform a code review. While we try
to this in a reasonable time frame, please understand that we have internal roadmaps and priorities
that may delay this process.

</community>

### How to perform a review

We've written up some [guidelines](./code-review.md) for reviewing code, which we recommend reading
before performing your first code review.

[user reminders]:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ℹ️ I didn't know these links could have spaces in them and they're usually shorthand, but if it works ...

https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-membership-in-organizations/managing-your-scheduled-reminders
[team reminders]:
https://docs.github.com/en/organizations/organizing-members-into-teams/managing-scheduled-reminders-for-your-team