Coding & Engineering

Automated Code Review System

Designs comprehensive automated code review systems with multi-layer analysis capabilities spanning syntax, semantics, security, performance, and architectural dimensions. Provides enterprise-grade quality gates with CI/CD integration, customizable rulesets, and developer-friendly feedback mechanisms. Balances quality enforcement with developer experience optimization.

---

## Example Usage

### Input

We are building a code review system for a Node.js/TypeScript monorepo with React frontend and Express backend. Team of 25 developers using GitHub Actions. Main concerns: security vulnerabilities in dependencies, code complexity getting out of control, inconsistent patterns across teams, and slow manual reviews taking 2-3 days. Need SOC 2 compliance with audit trails.

### Output

**Executive Summary**

This automated code review system reduces review cycle time from 2-3 days to under 4 hours while improving security posture and code quality consistency. The multi-layer architecture provides comprehensive coverage from formatting through architectural compliance with SOC 2 audit trail requirements.

**Multi-Layer Analysis Architecture**

_Layer 1: Syntax and Formatting (Blocking)_

- ESLint with TypeScript parser for style enforcement (airbnb-typescript base)
- Prettier integration with format-on-save and CI verification
- Import sorting with eslint-plugin-import and auto-fix capability
- Target: Zero formatting issues in merged code

_Layer 2: Semantic Analysis (Blocking/Warning)_

- TypeScript strict mode enabling noImplicitAny, strictNullChecks, strictFunctionTypes
- Custom ESLint rules for project patterns (React hooks exhaustive deps, async/await patterns)
- React-specific rules: hooks rules (react-hooks/exhaustive-deps), accessibility (jsx-a11y)
- Express security patterns (helmet usage, input validation)

_Layer 3: Security Scanning (Blocking)_

- SAST: Semgrep with OWASP JavaScript/TypeScript rules (injection, XSS, SSRF patterns)
- Dependency scanning: Snyk or npm audit with severity thresholds (critical/high block, medium warn)
- Secrets detection: GitLeaks in pre-commit hooks and CI pipeline
- Container scanning for production Docker images (Trivy)

_Layer 4: Quality Metrics (Warning/Advisory)_

- Cyclomatic complexity limits: maximum 10 per function, warning at 8
- Cognitive complexity tracking with refactoring suggestions
- Test coverage enforcement: 80% minimum for new code, 70% overall
- Code duplication detection: maximum 5% duplication threshold

_Layer 5: Architectural Compliance (Advisory)_

- Dependency direction rules preventing circular imports
- Layer boundary enforcement (components, hooks, services, utils)
- API contract validation against OpenAPI specifications

**CI/CD Quality Gates Configuration**