If the answer were as simple as “finding defects,” then a fully automated review starts to sound inevitable (and appealing).
But if code review was also how teams shared knowledge, built collective ownership, spread architectural understanding, and taught junior engineers how experienced developers think, then the answer becomes much less obvious.
That’s the mistake I think many organizations are about to make, and the reason we need to rethink what code review is actually for.
A large part of code review has been preventing people from doing stupid shit. AI is making stupid shit worse. It’s not defects, it’s “adding a whole micro service to get the user name from the ID, when the name is already in the metadata” or whatever that recent meme was.
Or that time a guy wrote a whole DSL instead of using the existing framework. Technically impressive, but adds a huge burden.
Thank you for sharing this, OP. This paragraph here is solid gold:
But if code review was also how teams shared knowledge, built collective ownership, spread architectural understanding, and taught junior engineers how experienced developers think, then the answer becomes much less obvious.
Education and understanding. It’s naive to think it solves bugs. You might catch and avoid some but static code analysis does that well too.
I think part of it is what you listed but I also think part of it is to review your update for its architecture or your decision making. For example we had a system which read serial numbers with a barcode scanner. For some reason the original designers decided the user had to scan the sn off the paperwork then off the device then the system does another automated scan off the device. The software verified the first two were identical but accepted anything for the third. After launch we discovered a bug where sometimes the third scan would report the scanners status instead of the serial number. Another developer was assigned to fix the bug. His solution was to filter out anything from the scanner that starts off “status:” this would pass all tests but it’s poor design. In the review it was brought up that it should be verified against the first two, not just that it’s not a status message.
That’s the real value of code review. Not “defects” but inefficient solutions which technically work for the tests.
Why can’t it be for finding defects AND the rest of the shit you listed?
It doesn’t seem like anyone anywhere needs to rethink what they are for. They’ve proven themselves over and over to be useful for all the reasons you listed.
When interviewing and companies wave away code reviews i consider it a sign of a less mature org (or maybe very small, or maybe a more R&D place).
built collective ownership
I don’t know about this one. people at companies are pretty quick to talk about code ownership when it comes to on call schedules, but i’ve never seen them give you the code when you leave.
spread architectural understanding
I also think this is not really true unless the codebase is really small. In bigger code bases broad overviews really help.
