Skip to content
learning
Menu

Code review and static analysis

How human and AI code review work, what reading a diff can and cannot catch, static analysis, and how to review code written by agents.

Start here

What is code review?

Code review is the practice of reading a proposed code change before it merges, to catch defects, share knowledge, and keep the codebase consistent.

11 min read

Concepts

  • What is AI code review?

    AI code review is the use of a language model to read a pull request and comment on bugs, style, and risks, usually before or alongside a human reviewer.

  • What is the code review bottleneck?

    The code review bottleneck is the queue that forms when agents open pull requests faster than people can review them, so reviews slow down or get skimmed.

  • What are precision and recall in AI code review?

    Precision is the share of a reviewer's flags that are real problems, and recall is the share of real problems it flags, so each number needs the other.

  • What does "runtime" mean in AI code review?

    Runtime-aware AI code review can mean production telemetry, an analysis sandbox, a sandbox that tests fixes, or an app run, and only some run the change.

  • What is a pull request?

    A pull request is a proposal to merge a set of changes from one branch into another, where the team reviews, discusses, and checks the change first.

  • What is code refactoring?

    Code refactoring is changing the structure of existing code, not its behavior, in small steps that tests check, so the code is easier to read and change.

  • What is comprehension debt?

    Comprehension debt is the share of a codebase that nobody on the team understands, often because coding agents changed it faster than people could read it.

  • What is cyclomatic complexity?

    Cyclomatic complexity counts the independent paths through a piece of code, so a higher number means more branches to understand and more cases to test.

  • What is linting?

    Linting is running a linter, a tool that checks source code against rules for likely bugs and style problems without running it, usually before review.

  • What is static code analysis?

    Static code analysis is checking source code for bugs and security flaws without running it, usually with linters, type checkers, and security scanners.

  • What is technical debt, and do coding agents add to it?

    Technical debt is the future cost of shortcuts in code or design, paid as slower changes and more bugs until someone cleans the shortcuts up.

How-to guides

Comparisons

Common questions

  • Why are AI code reviews noisy?

    AI code reviews get noisy when a reviewer posts many false positives and minor comments, so developers learn to skim them and miss the few real problems.

  • Why does pull request size matter?

    Pull request size affects review quality, because reviewers catch less as diffs grow, so large changes get skimmed and more defects reach the main branch.

Failures and bugs

Terms in this topic

AI code review
AI code review is a review practice that uses a language model to read a pull request or diff and comment on possible bugs, style problems, and risks.
Code review
Code review is a practice that has people or tools read a proposed code change before it merges, to catch defects, share knowledge, and keep the codebase consistent.
Comprehension debt
Comprehension debt is the growing share of a codebase that no one on the team understands, because the code changed faster than people could read and learn it.
Cyclomatic complexity
Cyclomatic complexity is a count of the independent paths through a piece of code, so a higher number means more branches to understand and more cases to test.
Dynamic analysis
Dynamic analysis is a method that observes a program while it runs, e.g. through tests, to find bugs that only appear at runtime.
False positive
A false positive is a check result that reports a problem that does not exist, which wastes time and teaches people to ignore real findings.
Linting
Linting is a static check that compares source code against style and correctness rules with a tool called a linter, without running the code.
Precision and recall
Precision and recall are two measures of a detector, where precision is the share of its flags that are real problems and recall is the share of real problems that it flags.
Pull request
A pull request is a request that asks to merge a set of commits into another branch, where people and tools review and check the change first.
Refactoring
Refactoring is a practice that changes the structure of existing code without changing its behavior, e.g. to remove duplication, so the code is easier to read and change.
Review bottleneck
The review bottleneck is the queue that forms when code is produced faster than people can review it, so pull requests wait or get approved with less scrutiny.
Runtime context
Runtime context is information about how code behaves when it runs, e.g. production telemetry or an execution trace, that a review tool reads without running the changed code itself.
Static analysis
Static analysis is a method that examines source code without running it, using rules and type information to flag likely bugs and security flaws.
Technical debt
Technical debt is the future cost of shortcuts in code or design, which a team pays as slower changes and more bugs until someone cleans the shortcuts up.

14 terms from the Learning Center glossary.