Detailed Notes
Code reviews are starting to become more common in enterprise development. Dev Ops and related automation have helped shine the light on improving quality and reliability in our processes. This presentation looks at how we can set our teams up for success in code reviews through better and consistent processes. This episode focuses on tools and ways to help speed your review process through automation.
Code Reviews In Detail There is a time and place for code reviews. Likewise, there are ways to approach these complex tasks that can make the most of both our time and resources. Nevertheless, this process does not come without cost. Therefore, we need to be intentional in our approach and requirements to craft better code and provide a path for building better developers.
The Mentor-Mastermind Group This series comes from our mentoring/mastermind classes.  These classes are virtual meetings that focus on how to improve our technical skills and build our businesses.  The goals of each member vary.  However, this diversity makes for great discussions and a ton of educational value every time we meet.  We hope you enjoy viewing this series as much as we enjoy creating it. As always, this may not be all new to you, but we hope it helps you be a better developer. Drop us a line to find out when the next one is so you can join our group.
Transcript Text
[Music] of some some tools that are out there for analysis and i'm hoping i have those um so the first one i've got here is codec i've actually talked about it before this is a static analysis tool let me blow this up so it's a little easier to read and what it does is you can come in you've got um i think here if i can go back to oh there we go oh my session timed out of course it did here we go okay so each of these line items is a code repository uh almost all of the tools that i'm going to point to while you can do a specific analysis on a project uh almost all of them especially the cloud-based ones they're going to connect to like github or bitbucket or something like that or you're if you've got an internal git server that just tends to be everybody all the cool kids are doing git and it's just much easier to make static analysis part of your code commit process so you're going to see that in these one i'm not including here but i do want to mention is also amazon has got code insight pieces and if you are generating code through the we'll call it the amazon process where you're looking at their uh their pipelines and their code commit repository and things like that there are ways to attach static analysis into that and their tools are actually are are pretty impressive and are are going to look somewhat like this i just didn't want to get you know have too many things that we spend time on as part of this so for this example we can see um i have a grade for these these are four different repositories and i have a grade and we can see i've got uh issues and this these are percents i think based on in this case it's gonna be based on my last um my prior commit um and then you can see there's like here it's got a complexity score where do i have duplicate code uh if you have tests some of them will be able to check uh test coverage so if i look at one and open it up and you're gonna see this in a lot of these i can look at this i can see that hey he has this thing has this analysis has set uh has found 54 total issues i can see issues based on you know there's unused code compatibility performance error prod security coding style coding styles very useful because it gets into best practices for code and particularly uh for example if you look at things that are regularly moving forward uh react python java c-sharp languages that are still evolving on a fairly common basis one of the problems you run into is that you have code that works fine but there's a better way to do it and you're going to see that in some of the things that will come up as it'll be stuff like um you know sometimes it's simple things like hey i've got an unused import those are kinds of things that are easy to correct sometimes you'll have um [Music] things that may be a problem like a method has no argument oh here's like an example break statement may swallow an exception so this is a case where you know maybe there's a try catch and the way we're doing it it's never actually going to surface the exception i'm trying to see like here you'll see stuff that's like hey this method could be a function um and you're going to see stuff coding style like here redefining built in sum there are things that you can do that it's going to offer you a better way to do it i don't think i have a java one here to show that though but i may be able to get that let's see here uh yeah because these are all well this java this one may have some java in there somewhere yeah because this is old stuff so this is probably gonna have that so i'm gonna see and and security will do that as well and so some of it's things like hey strings must use a double quote um i'm trying to see if that's all javascript javascript javascript uh maybe i've got one with code patterns i don't know if i've got any oh so here's some code patterns thing uh oops that's not what i want sorry i clicked the wrong buttons oh here we go let's see if i can do uh code stop and um let's do like java coding styles so here's where so here like static method name doesn't match this regular expression so things like that that's basically going to say hey this and it sometimes it'll give you this it says hey configurable naming this is what our this is what it should be this is what you typically should see and so these are things that are not coding issues as much as they're going to be coding standards and most of these tools also have the ability for you to customize some of that so that you can actually introduce your own coding standards into your static analysis and so now you've got an automated code review that says hey if you look if you did this if you went through and coded it this way you need to change it in this other way so codices a good example that as you can see you know i've seen through this you go through you can get an overall grade those are your metrics and so you can see from any given one you can go take a look at it you can take a look at your errors your issues and these can be things that you can either say yep i need to fix it or no i don't um and this is a good example right here where you know error prone these are probably bugs coding style are things where hey this is going to help our maintainability security may be something that goes to your uh your organization your industry and your requirements there so codec good example uh let's go to uh this is sonar cloud which is very similar to codec and you're going to see this same kind of thing as i've got these repositories out there this one breaks it down a little differently is i've got an overall score on bugs but then also on vulnerabilities there may be some hot spots uh code smell which is basically it doesn't it's something where you're not following standards and then duplication of code so you see that it's a little different in how it breaks it down but at the end of the day you're seeing scores based on varying areas it's usually going to be things that are related to bugs versus scalability versus main teletainability versus stability but you get to see all that and then you can go let's see this one yeah so this one i've got these different repositories i'm looking at and i can go into a specific one and i can start clicking my way into what are the bugs that it sees and you're going to see all of these that's through all these tools that's a nice thing okay here's the bug and then they're usually going to have something like why is this an issue why does this matter and this is where you're going to be able to become a better developer because it's say hey these are things you should avoid so that's sonar cloud and each of these tools has some level of an introductory or free tier to it and then as you get further into it um there may be some costs if you're doing it for publicly available uh github repositories you're more likely to have a free it's a lot of times it's free as long as it's a public repo if it's not then the prices may be incurred and you're gonna have to take a look at them shift left is another in the same vein of what we've looked at so far so here you can see um i don't know if i've got oh so i've got like here i've got these different applications i can take a look into i can see overall here's some issues it has it's not so much a score kind of thing as it's just a total findings but that would be your metric because i want to be getting the point where i'm seeing less and less of these ideally get it to zero you know so i don't have any issues with it if you want to get a little different um you have pbs studio this one's not a cloud kind of thing you're gonna actually go in and you're gonna be able to do static analysis on your code it's a little different than what its focus is this one's you know c c plus plus c sharp and java whereas the other ones will actually the ones the ones i've looked at so far i've reviewed or talked about they will also do things like html css javascript uh you've seen python uh php perl shell scripts i mean it's amazing what is out there as far as what those things you know what kind of code that those things will uh assess for you pbs studios one if you want to have something that's just a static tool that you run potentially a lot of times these are these static tools are run as part of your commit process you have a little hook and you say okay when you commit code it's going to trigger a an assessment from the static analyzer and you're going to be able to see where the code changes are sometimes there are ways to put um sort of like barriers there that says if your code doesn't have a certain score or if it introduces more than x number of issues then it's going to block it and not allow you to commit the code and that could be the number could be zero i've worked with one customer where it was an old subversion repository that was linked to several static code analyzers and if you didn't pass 100 your code would not commit which can be a pain if you're trying to commit code you're trying to fix something and you've gotta you gotta go back and cross all your t's and doubt all your eyes but the flip side of that is that means that your code and your repository is as squeaky clean as you can do from an automated perspective doesn't mean bugs won't get through but it does minimize the chance for that and when you think of continuous integration continuous deployment that can be very valuable it can be very useful almost necessary to be really certain of your code before it flows into that process a tool that and we may have talked about way in the past there's a company called parasol that does a lot but some of their products include um let's see if we can get these to pop up again is that they do they have a lot of testing related tools unit related test tools to generate uh auto-generate unit tests and create code coverage uh test coverage over your code but as part of that there's a lot of static analysis that they have into it the pricing is usually going to be more it's more aimed at enterprise development so this is something that you're probably not going to get as a individual developer but it may be something your comp your organization would want to look into uh let me flip back over wherever i put it to the actual presentation so i wanted to show you those tools because one those are the kinds that almost every one of them there's ways that you can hook those into your process and so now when we go back to the code review costs some of that time spent is going to be reduced because you have these tools that say hey i can i can look at your code and i can already surface that without somebody else having to take time to look at your code and it reduces a human error yeah i can if i review your code i could easily overlook issues but if the system does it's going to highlight those and say hey you did this this matches this pattern that we've decided is not a good one so fix it you know or address it and that allows you to build a habit because that's just part of it you've now systematized and automated this process and so while there are some of those uh benefits you're not going to get a lot of cross-training by these static analysis tools but you are going to because developers going to have these things spit back issues they are going to learn how to do they're going to through habits and fixing those they're going to learn how to do the code right at least in line with your standards and maybe the language standards and so that can be maybe a piece of your code review process that you do the automation but you also have the team take a look at some of that and maybe even the team take a look at what is surfaced by the analysis tools and you may say hey we want to adjust some of those rules because the the tool is telling us stuff that we don't want to hear or that we've decided is a non-issue so what have we learned maybe and going through this and one code reviews can improve quality not only of your code but of your development team of your coders and your coding team and your coding environment there are definitely costs and challenges that are associated with starting into an environment where you produce where you include code reviews and make that a part of what you produce in day to day release to release the key to success is consistency and building habits if you do a code review once in a blue moon and just you know randomly code review your code it's just not going to be that effective you're not going to be able to build the exercise the muscles that are needed to become better at a code review it's like everything else the more you practice the better you get and this feedback environment that you have in a code review is perfect for that where you're doing this as a team you're getting feedback on it everybody's learning how to code better but also how to review code better and the other thing that final point is there are a lot of tools that can help us step into this we don't have to manually code review every line of code that we've generated we can put these tools in place and even if we don't have any person actually do a code review if we just leave the tools in place that is at least a step in the right direction [Music] you
Transcript Segments
[Music]
of some some tools that are out there
for analysis
and i'm hoping i have those
um
so the first one i've got here is codec
i've actually talked about it before
this is a static analysis tool let me
blow this up so it's a little easier to
read
and what it does is you can come in
you've got um
i think here if i can go back to
oh there we go
oh my session timed out
of course it did
here we go okay
so each of these
line items is a code repository uh
almost all of the tools that i'm going
to point to while you can do a specific
analysis on a project
uh almost all of them especially the
cloud-based ones they're going to
connect to like github or bitbucket or
something like that or you're
if you've got an internal git server
that just tends to be everybody all the
cool kids are doing git and it's just
much easier to make
static analysis part of your code commit
process so you're going to see that in
these
one i'm not
including here
but
i do want to mention is also amazon has
got
code insight pieces and if you are
generating code through the
we'll call it the amazon process where
you're looking at their uh their
pipelines and their code commit
repository and things like that
there are
ways to attach static analysis into that
and their tools are actually are are
pretty impressive and are are going to
look somewhat like this i just didn't
want to get you know have too many
things that we spend time on as part of
this
so for this example we can see
um
i have a grade for these these are four
different repositories and i have a
grade and we can see i've got uh issues
and this these are percents i think
based on in this case it's gonna be
based on my last
um my prior commit
um
and then you can see there's like here
it's got a complexity score where do i
have duplicate code
uh if you have tests some of them will
be able to check uh test coverage so if
i look at one and open it up
and you're gonna see this in a lot of
these
i can look at this i can see that hey he
has this thing has this analysis has set
uh has found 54 total issues
i can see issues based on you know
there's unused code compatibility
performance error prod security coding
style
coding styles
very useful
because it gets into
best practices for code and particularly
uh for example if you look at things
that are
regularly moving forward uh react python
java c-sharp
languages that are still evolving on a
fairly common basis
one of the problems you run into is that
you have code that works fine
but there's a better way to do it
and you're going to see that in some of
the things that will come up as it'll be
stuff like um you know sometimes it's
simple things like hey i've got an
unused import those are kinds of things
that are easy to correct
sometimes you'll have um
[Music]
things that may be a problem like a
method has no argument
oh here's like an example break
statement may swallow an exception so
this is a case where you know maybe
there's a try catch and the way we're
doing it it's never actually going to
surface the exception
i'm trying to see
like here
you'll see stuff that's like hey this
method could be a function
um
and you're going to see stuff coding
style
like here redefining built in sum there
are things that you can do
that
it's going to offer you a better
way to do it i don't think i have a java
one here
to show that though but i may be able to
get that
let's see here
uh yeah because these are all well this
java this one may have some java in
there somewhere
yeah because this is old stuff so this
is probably gonna have that so i'm gonna
see and and security will do that as
well
and so some of it's things like hey
strings must use a double quote
um
i'm trying to see if that's all
javascript javascript javascript
uh
maybe i've got one with code patterns i
don't know if i've got any oh so here's
some code patterns thing uh oops that's
not what i want
sorry i clicked the wrong buttons
oh here we go let's see if i can do uh
code stop
and
um
let's do like java coding styles so
here's where
so here like static method name doesn't
match
this regular expression so things like
that that's basically going to say hey
this and it sometimes it'll give you
this it says hey configurable naming
this is what our this is what it should
be
this is what you typically should see
and so these are things that are not
coding issues as much as they're going
to be coding standards and most of these
tools also have the ability for you to
customize
some of that so that you can actually
introduce your own coding standards into
your static analysis and so now you've
got an automated code review that says
hey if you look if you did this if you
went through and coded it this way you
need to change it
in this other way
so codices a good example that as you
can see you know i've seen through this
you go through you can get an overall
grade those are your metrics
and so you can see from any given one
you can go take a look at it you can
take a look at your errors your issues
and these can be things that you can
either say yep i need to fix it or no i
don't um and this is a good example
right here where
you know error prone these are probably
bugs coding style are things where hey
this is going to help our
maintainability security may be
something that goes to your uh your
organization your industry and your
requirements there
so codec good example
uh let's go to uh this is sonar cloud
which is very similar to codec and
you're going to see this same kind of
thing as i've got these repositories out
there this one breaks it down a little
differently is i've got an overall score
on bugs but then also on vulnerabilities
there may be some hot spots
uh code smell which is basically it
doesn't
it's something where you're not
following standards and then duplication
of code
so you see that it's a little different
in how it breaks it down but at the end
of the day
you're seeing scores based on
varying areas it's usually going to be
things that are related to
bugs versus scalability versus main
teletainability versus stability
but you get to see all that
and then you can go
let's see this one yeah so this one i've
got these different repositories i'm
looking at
and i can go into a specific one and i
can start clicking my way into what are
the bugs that it sees and you're going
to see all of these that's through all
these tools that's a nice thing
okay here's the bug and then they're
usually going to have something like why
is this an issue why does this matter
and this is where you're going to be
able to become a better developer
because it's say hey these are things
you should avoid
so that's sonar cloud and each of these
tools has
some level of an introductory or free
tier to it and then as you get further
into it um
there may be some costs
if you're doing it for publicly
available uh github repositories you're
more likely to have a free it's a lot of
times it's free as long as it's a public
repo
if it's not then the
prices may be incurred and you're gonna
have to take a look at them
shift left is another in the same vein
of what we've looked at so far so here
you can see um
i don't know if i've got oh so i've got
like here i've got these different
applications
i can take a look into i can see overall
here's some issues it has
it's not so much a score kind of thing
as it's just a total findings but that
would be your metric because i want to
be
getting the point where i'm seeing less
and less of these ideally get it to zero
you know so i don't have any issues with
it
if you want to get
a little different
um you have pbs studio this one's not a
cloud kind of thing you're gonna
actually go in and you're gonna be able
to do static analysis on your code
it's a little different than what its
focus is this one's you know c c plus
plus c sharp and java
whereas the other ones will actually the
ones the ones i've looked at so far i've
reviewed or talked about they will also
do things like html css javascript uh
you've seen python
uh php perl
shell scripts i mean it's amazing what
is out there as far as what those things
you know what kind of code that those
things will
uh assess for you
pbs studios one if you want to have
something that's just a static tool that
you run
potentially a lot of times these are
these static tools are run as part of
your commit process you have a little
hook and you say okay when you commit
code it's going to trigger a
an assessment from the static analyzer
and you're going to be able to see where
the code changes are sometimes there are
ways to put um
sort of like barriers there that says if
your code doesn't have a certain score
or if it introduces more than x number
of issues then it's going to block it
and not allow you to commit the code and
that could be the number could be zero
i've worked with one customer where it
was an old
subversion repository that was linked to
several
static code analyzers and if you didn't
pass 100 your code would not commit
which can be
a pain if you're trying to commit code
you're trying to fix something and
you've gotta you gotta go back and cross
all your t's and doubt all your eyes but
the flip side of that is that means that
your code and your repository is
as squeaky clean as you can do from an
automated perspective doesn't mean bugs
won't get through but it does minimize
the chance for that and when you think
of continuous integration continuous
deployment
that can be very valuable it can be very
useful almost necessary
to be really certain of your code before
it flows into that process
a tool that
and we may have talked about way in the
past there's a company called parasol
that does
a lot but some of their products include
um
let's see if we can get these to pop up
again is that they do they have a lot of
testing related tools unit related test
tools to generate
uh auto-generate unit tests and create
code coverage uh test coverage over your
code but as part of that there's a lot
of static analysis that they have into
it the pricing is
usually going to be more it's more aimed
at enterprise development so this is
something that you're probably not going
to get as a individual developer
but it may be something your comp your
organization would want to look into
uh let me flip back over wherever i put
it to the actual presentation
so i wanted to show you those tools
because one
those are the kinds that almost every
one of them there's ways that you can
hook those into your process
and so now when we go back to the
code review costs some of that time
spent is going to be reduced because you
have these tools that say hey i can
i can look at your code and i can
already surface that without somebody
else having to take time to look at your
code and it reduces a human error yeah i
can if i review your code i could easily
overlook issues but if the system does
it's going to highlight those and say
hey you did this this matches this
pattern that we've decided is not a good
one so fix it you know or address it
and that
allows you to build a habit because
that's just part of it you've now
systematized and automated this process
and so while there are some of those uh
benefits
you're not going to get a lot of
cross-training by these static analysis
tools but
you are going to because
developers going to have these things
spit back issues they are going to learn
how to do they're going to through
habits and fixing those they're going to
learn how to do the code right at least
in line with your standards and maybe
the language standards
and so that can be maybe a piece of your
code review process that you do the
automation
but you also have the team take a look
at some of that and maybe even the team
take a look at what
is surfaced by the analysis tools and
you may say hey we want to adjust some
of those rules because the the tool is
telling us stuff that we don't want to
hear or that we've decided is a
non-issue
so what have we learned maybe and going
through this and one
code reviews can improve quality not
only of your code but of your
development team of your coders and your
coding team and your coding environment
there are definitely costs and
challenges that are associated with
starting into an environment where you
produce where you include code reviews
and make that a part of what you produce
in day to day
release to release
the key to success
is consistency and building habits if
you do a code review once in a blue moon
and just you know randomly code review
your code it's just not going to be
that effective you're not going to be
able to
build
the
exercise the muscles that are needed to
become better at a code review it's like
everything else the more you practice
the better you get
and this feedback environment that you
have in a code review is perfect for
that where you're doing this as a team
you're getting feedback on it
everybody's learning how to code better
but also how to review code better
and the other thing that final point is
there are a lot of tools that can help
us step into this we don't have to
manually code review every line of code
that we've generated
we can put these tools in place and even
if we don't have any person
actually do a code review if we just
leave the tools in place that is at
least a step in the right direction
[Music]
you