-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Updates to reflect best practices for PR review #220
Changes from 18 commits
1da15ef
f0a30b3
bfc1f00
276e501
6df2155
8deb2f9
3281269
6aeb877
2d22f5f
dbdc507
bb4f05d
5b1a34d
4929c05
53445fe
6b06140
38a5c86
c116672
0fa729a
440c84d
7d93823
522f424
b78e66a
3131dcf
760b5b8
97745a9
815208e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,5 @@ | ||
--- | ||
sidebar_position: 1 | ||
sidebar_custom_props: | ||
access: bitwarden | ||
--- | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,4 +1,5 @@ | ||
--- | ||
sidebar_position: 3 | ||
sidebar_custom_props: | ||
access: bitwarden | ||
--- | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,24 +1,28 @@ | ||
--- | ||
sidebar_position: 2 | ||
--- | ||
|
||
# Code Review Guidelines | ||
|
||
At Bitwarden, we encourage everyone to participate in code reviews. A team will focus primarily on | ||
their own code reviews, but if you see something interesting, feel free to jump in and discuss. | ||
|
||
To have efficient code reviews there are a few things to keep in mind (from | ||
[Best Practices for Code Review | SmartBear](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/)): | ||
A few general guidelines: | ||
|
||
- Pull requests should be manageable. If the PR is too large -- significantly above a few hundred | ||
lines -- ask the contributor if it can be split it up into multiple PRs before reviewing. | ||
- This can be tricky in our code base since many things are tightly coupled. | ||
- This can be tricky in our codebase since many things are tightly coupled. | ||
- Take your time when reviewing - expect a rate of less than 500 lines of code per hour. | ||
- Take breaks - don’t review for longer than 60 minutes. | ||
|
||
Don’t feel bad for taking your time when doing code reviews! They often take longer than you think, | ||
and we should be spending as much time as needed. | ||
and we should be spending as much time as needed. When you find a bug or defect during PR review, | ||
the cost of fixing it is much smaller than if it escapes further into the development lifecycle. | ||
|
||
:::tip | ||
:::tip Want to read more? | ||
|
||
Bugs or defects found early in the development cycle have a much smaller cost associated with fixing | ||
them. | ||
You can find more tips for PR review here: | ||
[Best Practices for Code Review | SmartBear](https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/) | ||
|
||
::: | ||
|
||
|
@@ -33,7 +37,16 @@ always welcome! For example, it’s okay to leave some general comments or feedb | |
that you don’t have enough knowledge to approve the changes. The author can ask for another review | ||
from someone else, and there’s nothing wrong in having two reviewers on a PR. | ||
|
||
:::info Note | ||
When undertaking a review, keep in mind that you are taking an ownership stake in the changes. You | ||
should always strive to provide actionable feedback to the author and to make yourself available for | ||
any clarifying questions or to pair on fixes suggested. | ||
|
||
While we mostly use an asynchronous review process, please don't hesitate to schedule a meeting with | ||
the author to discuss the changes. While asynchronous communication can be useful, it incurs a time | ||
penalty which can drag out the review process. Sometimes setting up a short call to discuss the | ||
changes can save a lot of time. | ||
|
||
:::info Assumptions | ||
|
||
<a id="assumptions-note"></a> When reviewing code, remember that all software is built to conform to | ||
a set of assumptions. Features, bug fixes, and other requirement changes represent a change in those | ||
|
@@ -44,22 +57,36 @@ requirements, which may not necessarily be in line with the previous solution. | |
|
||
### Review statuses | ||
|
||
Please use the review statuses appropriately. | ||
When completing a review, you can either add comments, request changes, or approve the PR. It is | ||
important that both the reviewer and the author understand the expectations around each type of | ||
review, so we use the guidelines below. | ||
|
||
:::tip Tip for effective feedback | ||
|
||
When providing comments or requesting changes, keep in mind the experience level of the author. | ||
|
||
If the engineer is new to the company and the codebase or less experienced overall, they would | ||
probably welcome more explicit background on your concerns and more concrete suggestions, whereas a | ||
more experienced engineer would prefer general guidance so that they can solve the problem | ||
themselves. | ||
|
||
::: | ||
|
||
#### Comment | ||
|
||
Comment is a great way to discuss things without explicitly approving or requesting changes. | ||
Using comments is a great way to discuss things without explicitly approving or requesting changes. | ||
|
||
#### Request changes | ||
|
||
Request changes should be used when you believe something **needs** to change prior to the PR | ||
getting merged, as it will prevent someone else from approving the PR before your concerns have been | ||
tackled. | ||
|
||
We shouldn’t hesitate to use this status, however we should give clear feedback on what needs to | ||
change for the PR to get approved. Likewise a PR author should not be discouraged by a _request for | ||
changes_, it's simply an indication that changes should be made prior to the PR being merged. This | ||
is common. | ||
We shouldn’t hesitate to use this status. However, it does come with obligations for the reviewer. | ||
By blocking the PR from progressing, you are taking on additional responsibility and should give | ||
clear feedback on what needs to change for the PR to get approved. Likewise, a PR author should not | ||
be discouraged by a request for changes, it's simply an indication that changes should be made prior | ||
to the PR being merged. This is common. | ||
|
||
:::warning Discarding reviews | ||
|
||
|
@@ -76,12 +103,14 @@ scenarios where discarding the reviews are generally seen as accepted. | |
|
||
#### Approve | ||
|
||
Approving a PR means that you have confidence in that the code works, and that it does what the PR | ||
Approving a PR means that you have confidence in that the code works and that it does what the PR | ||
claims. This can be based on testing the change or on previous domain knowledge. | ||
|
||
- The PR targets the [correct branch](branching/#which-branching-model-to-choose). | ||
- You have verified that the linked Jira issue description matches the changes made in the PR. | ||
- You have read and understood the full impact of the changes suggested by the PR. | ||
- You have verified that all possible changes have been | ||
[unit tested](./../testing/unit/naming-conventions.mdx). | ||
Comment on lines
+112
to
+113
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is a major change to our current practices, which are less strict about this. This is worth highlighting when this is shared more broadly. |
||
- You attest that the changes | ||
- Solve the intended problem, | ||
- [solve the requirements in the best way](#assumptions-note), | ||
|
@@ -113,6 +142,7 @@ a time. | |
- Does the PR change the areas you expect to be changed? | ||
- Are any missing? | ||
- Are any present you didn't expect? | ||
- Are unit tests present? | ||
- Micro View - Focus on individual files. | ||
- Is the code style adhered? | ||
- Is the code readable? | ||
|
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
|
@@ -97,33 +97,106 @@ changes” to a PR forcing the reviewer to start over again. | |||||
|
||||||
::: | ||||||
|
||||||
## Creating a Pull Request | ||||||
## Creating a pull request | ||||||
|
||||||
The Bitwarden repositories have a _Pull Request template_ which should be followed. This will ensure | ||||||
the PR review goes smoothly since it will provide context to the reviewer. <community> Once a | ||||||
community PRs has been created, they will be automatically be linked to an internal Jira ticket. The | ||||||
internal ticket is used for prioritization and tracking purposes.</community><bitwarden>Include a | ||||||
Jira ticket reference so the reviewer can gain all context on the work.</bitwarden> Tag | ||||||
`@dept-design` as a reviewer for any UI changes. | ||||||
the PR review goes smoothly since it will provide context to the reviewer.<community> Once a | ||||||
community PR has been created, it will be automatically be linked to an internal Jira ticket. The | ||||||
internal ticket is used for prioritization and tracking purposes.</community><bitwarden> When | ||||||
creating the PR include a Jira ticket reference so the reviewer can gain all context on the work as | ||||||
well as links to any associated PRs in other repositories.</bitwarden> | ||||||
|
||||||
## Review process | ||||||
<bitwarden> | ||||||
|
||||||
<community> | ||||||
### Tagging reviewers | ||||||
|
||||||
Once a Community PR has been created a Bitwarden developer will perform a code review, while we try | ||||||
to this in a reasonable time-frame, please understand that we have internal roadmaps and priorities | ||||||
that may delay this process. | ||||||
We use `CODEOWNERS` in each repository to assign the reviewing teams based on the files in the PR. | ||||||
These reviews are required for the changes to be merged to `master`. | ||||||
|
||||||
</community> | ||||||
You can tag additional teams or individuals for review as you see fit, including `@dept-design` for | ||||||
any design changes. | ||||||
|
||||||
### Opening the PR for review | ||||||
|
||||||
As its name implies, marking a PR as "Ready for Review" indicates that you are ready for all | ||||||
assigned teams to review it. If the changes are still in progress, leave the PR in `Draft` status. | ||||||
Doing this ensures that reviewers can act on the "Ready for Review" as their signal to begin the | ||||||
review process without further notification. | ||||||
|
||||||
### Addressing feedback | ||||||
|
||||||
It is likely that you will receive some feedback on your PR. You should see this as a positive thing | ||||||
-- it signifies a healthy and thorough review process and an organizational commitment to code | ||||||
quality. You may receive [comments](./code-review.md#comment) or a | ||||||
[request for changes](./code-review.md#request-changes). You are encouraged to engage in | ||||||
conversation on the PR to discuss a solution, but if any strong conflicting opinions arise it is | ||||||
often best to move the conversation to a synchronous format to avoid any misunderstanding. | ||||||
|
||||||
When any necessary changes have been made, you should address the comments or request for changes by | ||||||
responding in the PR conversation thread. You are not responsible for resolving the conversation -- | ||||||
that is the prerogative of the reviewer, to ensure that they agree that the question or concern has | ||||||
been addressed. | ||||||
Comment on lines
+136
to
+138
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is also a significant clarification (different people do different things at the moment) - would like this highlighted when these changes are shared |
||||||
|
||||||
**When you are ready for a reviewer to revisit your changes, you should request a re-review.** This | ||||||
will notify the reviewer and ensure a prompt response. | ||||||
|
||||||
</bitwarden> | ||||||
|
||||||
## Reviewing the pull request | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do we want to leave a note somewhere about re-requesting review once the feedback is resolved? I've noticed it's sometimes not done which delays new reviews. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Also support. This helps a lot, especially when many teams are involved in a review. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I created a section called "Addressing feedback" that includes this, as well as a recommendation to allow the commenter to "Resolve conversation" - if that's not our position I can remove that part. |
||||||
|
||||||
<bitwarden> | ||||||
|
||||||
While we mostly use an async review process, please don't hesitate to schedule a meeting with the | ||||||
reviewer/contributor to discuss the changes. While async communication can be useful it incurs a | ||||||
time penalty which can drag out the review process. And sometimes setting up a short call to discuss | ||||||
the changes can potentially save a lot of time. | ||||||
At Bitwarden, we believe that the act of reviewing PRs is a critically important part of each | ||||||
engineer's job. It is as important, if not more important, than the act of writing code. | ||||||
|
||||||
To ensure that teams within the organization operate on same set of assumptions for performing | ||||||
reviews, we have agreed to a baseline set of expectations. | ||||||
|
||||||
When a PR author opens a PR for review, they should have the expectation that: | ||||||
|
||||||
- The act of opening the PR for review is the **only** notification required. Teams are responsible | ||||||
for properly configuring notifications so that team members are aware of their obligations. | ||||||
Comment on lines
+157
to
+158
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I would want us to document some available integrations, and give teams a chance to start using them, before actively enforcing it. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Handy link on more info: https://docs.github.com/en/enterprise-cloud@latest/organizations/organizing-members-into-teams/managing-code-review-settings-for-your-team I don't know if we need anything more than what GitHub provides. Maybe Slack reminders? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I get 30+ notifications daily which makes GH notifications mostly unusable without spending a non trivial amount of time maintaining it. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I expect that removing tech-leads as the default reviewer should help with notification overload. |
||||||
- The reviewing team(s) will respond within **24 hours** to: | ||||||
- Provide a review, | ||||||
- Inform the author when a review will be provided, or | ||||||
- Ask the author to split the work into a smaller PR for review | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Has the team agreed to a 24 hour PR review deadline? I haven't seen any discussion about this, but I may have missed it. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Not to my knowledge. I'm not against this though but it should be communicated. I also think we need to spend further effort to clean up tech-leads codeowners since I haven't found a way to exclude them from review filters. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I agree. I wanted to discuss here and then communicate in a bulleted list to the teams in Slack. This felt like a good place to start the discussion. I’m not in any way pushing for 24 - if we want to have a longer timeframe that’s fine. My main concern is having everyone bought in on what the timeframe is so we don’t have to resort to pinging on Slack for every PR. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Maybe "business day"? I personally feel one day is actually pretty tough unless engineers can be in formal support rotations and have this as a priority. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm not sure what would be a reasonable deadline here, although I agree 1 business day is tight. 2 business days? This is not a very visible place for discussion and this would be a fairly major change to the current expectations, I suggest sharing in Slack. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. After discussion with Tech Leads and EMs, we settled on 48 hours. I've addressed that in 3131dcf There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. issue: This line needs to be expanded upon and supported by a section informing the author on how to create PRs for an intended change. This could be added to the branching document and linked here. I think this is the primary reason for our large PR backlog. My recommendation would be limiting PRs to 1000 loc and preferring config or software feature flagging to allow for incomplete features to be present in the codebase.
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. @MGibson1, I've addressed this by completely revamping the branching page, in 440c84d. As we are moving closer to a trunk-based branching scheme, with the preference toward merging to I also thought that something like this might be nice to have: https://github.com/marketplace/actions/pull-request-size-labeler There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think you nailed it, thank you. I'm not really that convinced that the labels would have value, but the concept certainly does. If you think that'll help encourage people to smaller bites let's do it! |
||||||
|
||||||
:::tip Notifications | ||||||
|
||||||
Our teams use GitHub notifications as the primary method of communication for PR review requests and | ||||||
scheduled reminders are highly encouraged to facilitate prompt responses to requests. | ||||||
|
||||||
- Individual engineers are encouraged to set up [scheduled reminders][user reminders] for | ||||||
themselves. | ||||||
- Each team has [scheduled reminders][team reminders] on a dedicated Slack channel (e.g. | ||||||
#team-eng-platform-notifications). | ||||||
|
||||||
::: | ||||||
|
||||||
### Follow-up notification | ||||||
|
||||||
If there is no response to a request for review in 24 hours, the author should reach out to the | ||||||
team(s) -- or to individual engineers if assigned -- via Slack to follow up. | ||||||
|
||||||
This should wait for 24 hours to allow the default process to take place and not overwhelm the team | ||||||
with notifications on multiple platforms. | ||||||
|
||||||
</bitwarden> | ||||||
|
||||||
<community> | ||||||
|
||||||
Once a Community PR has been created a Bitwarden developer will perform a code review. While we try | ||||||
to this in a reasonable time frame, please understand that we have internal roadmaps and priorities | ||||||
that may delay this process. | ||||||
|
||||||
</community> | ||||||
|
||||||
### How to perform a review | ||||||
|
||||||
We've written up some [guidelines](./code-review.md) for reviewing code, which we recommend reading | ||||||
before performing your first code review. | ||||||
|
||||||
[user reminders]: | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. ℹ️ I didn't know these links could have spaces in them and they're usually shorthand, but if it works ... |
||||||
https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-your-membership-in-organizations/managing-your-scheduled-reminders | ||||||
[team reminders]: | ||||||
https://docs.github.com/en/organizations/organizing-members-into-teams/managing-scheduled-reminders-for-your-team |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why are we setting sidebar positions on these? Do we dislike the alphabetical ordering?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It wasn't ordering alphabetically before - the positions are to order it alphabetically. I'll take them out and double-check that I'm correct in that statement.