united-tattoo/.opencode/context/core/workflows/review.md

Code Review Guidelines

Quick Reference

Golden Rule: Review code as you'd want yours reviewed - thoroughly but kindly

Checklist: Functionality, Code Quality, Security, Testing, Performance, Maintainability

Report Format: Summary, Assessment, Issues (🔴🟡🔵), Positive Observations, Recommendations

Principles: Constructive, Thorough, Timely

---

Principles

Constructive: Focus on code not person, explain WHY, suggest improvements, acknowledge good practices Thorough: Check functionality not just style, consider edge cases, think maintainability, look for security Timely: Review promptly, don't block unnecessarily, prioritize critical issues

Review Checklist

Functionality

• Does what it's supposed to do
• Edge cases handled
• Error cases handled
• No obvious bugs

Code Quality

• Clear, descriptive naming
• Functions small and focused
• No unnecessary complexity
• Follows coding standards
• DRY - no duplication

Security

• Input validation present
• No SQL injection vulnerabilities
• No XSS vulnerabilities
• No hardcoded secrets
• Sensitive data handled properly
• Auth/authorization appropriate

Testing

• Tests present
• Happy path covered
• Edge cases covered
• Error cases covered
• All tests pass

Performance

• No obvious performance issues
• Efficient algorithms
• No unnecessary operations
• Resources properly managed

Maintainability

• Easy to understand
• Complex logic documented
• Follows project conventions
• Easy to modify/extend

Review Report Format

## Code Review: {Feature/PR Name}

**Summary:** {Brief overview}
**Assessment:** Approve / Needs Work / Requires Changes

---

### Issues Found

#### 🔴 Critical (Must Fix)
- **File:** `src/auth.js:42`
  **Issue:** Password stored in plain text
  **Fix:** Hash password before storing

#### 🟡 Warnings (Should Fix)
- **File:** `src/user.js:15`
  **Issue:** No input validation
  **Fix:** Validate email format

#### 🔵 Suggestions (Nice to Have)
- **File:** `src/utils.js:28`
  **Issue:** Could be more concise
  **Fix:** Use array methods instead of loop

---

### Positive Observations
- ✅ Good test coverage (95%)
- ✅ Clear function names
- ✅ Proper error handling

---

### Recommendations
{Next steps, improvements, follow-up items}

Common Issues

Security

🔴 Hardcoded credentials 🔴 SQL injection vulnerabilities 🔴 Missing input validation 🔴 Exposed sensitive data

Code Quality

🟡 Large functions (>50 lines) 🟡 Deep nesting (>3 levels) 🟡 Code duplication 🟡 Unclear naming

Testing

🟡 Missing tests 🟡 Low coverage (<80%) 🟡 Flaky tests 🟡 Tests testing implementation

Best Practices

✅ Review within 24 hours ✅ Provide specific, actionable feedback ✅ Explain WHY, not just WHAT ✅ Suggest alternatives ✅ Acknowledge good work ✅ Use severity levels (Critical/Warning/Suggestion) ✅ Test the code if possible ✅ Check for security issues first

Golden Rule: Review code as you'd want yours reviewed - thoroughly but kindly.