Engineering Blog
Code review craft, static analysis trade-offs, and what we have learned building PRCheck since 2023. Written by the team that ships the tool.
PR checklist fatigue: why checklists fail and what replaces them
Teams add checklists after incidents. Six months later nobody reads them. Here is why that pattern is inevitable and what static analysis at the PR layer changes.
Async code review vs real-time PR checks: they are not the same job
Async review is a human judgment conversation. Real-time PR checks are a machine consistency pass. Conflating the two makes both worse.
How do you measure code review quality? A practical framework
Time-to-review and comment count are the wrong metrics. Here is what actually correlates with catching bugs before production.
How PR review debt accumulates and why it compounds
Every skipped or rubber-stamp review is a small debt. The debt does not add linearly: it compounds through the codebase over time.
GitHub Actions for review vs native PR checks: trade-offs
Running a review bot as a GitHub Action has real trade-offs versus a native GitHub App: trigger latency, permission scope, and what happens when the Action runner queue is backed up.
Detecting logic bugs vs syntax errors: why they need different approaches
Linters catch syntax and formatting violations. Logic bugs, null dereferences, and race conditions require a tool that understands execution paths, not just line patterns.
Building PR check rules: regex vs AST, when each one wins
Regex rules are fast to write and good for text patterns. AST matchers are slower to author but catch structural issues that regex cannot see, like a missing try-catch around every await expression.
Why style guides fail without enforcement at the PR level
Style guides start as PDFs and end up as ignored wikis. The only enforcement that works is automated enforcement at the exact moment code is submitted for review.
Security belongs in the PR, not the weekly scan
Weekly SAST scans find vulnerabilities days after the vulnerable code shipped. Catching OWASP patterns at PR time costs nothing to fix. Catching them post-deploy is expensive and sometimes public.
PR review latency is the silent velocity killer
A 24-hour PR wait does not just delay one feature. It blocks the dependent work, forces context switches, and is the single most common cause of PR merge conflicts on active branches.
What AI gets wrong in code review (and what we did about it)
Most automated review tools pattern-match on diff lines. We traced the failure modes, including false positives on valid async patterns, and rebuilt around AST-level analysis instead.
Why we built PRCheck
Rachel Morrison explains the moment at her previous job when she realized code review was the bottleneck nobody was talking about.