Also known as: pull request review · peer review · PR review
Code review is the practice of having changes examined by other engineers before they are merged, catching defects, spreading knowledge, and maintaining consistency across a codebase.
Empirically, review effectiveness drops sharply with change size: reviewers reliably catch problems in small focused changes and largely rubber-stamp large ones. Keeping changes small is the highest-leverage improvement most teams can make.
Review is also a supply chain control. In open-source projects and internal repositories alike, it is the checkpoint at which a malicious or compromised contribution can be caught before it reaches a build.
CI/CD
CI/CD (continuous integration and continuous delivery) is the practice of automatically building, testing, and deploying code changes, so that every commit is verified and releases become routine rather than exceptional events.
Static Analysis
Static analysis examines source code without executing it, detecting bugs, security vulnerabilities, and style violations by reasoning about possible program behaviours.
Technical Debt
Technical debt is the accumulated future cost of choosing an expedient implementation over a better one, analogous to financial debt in that it carries ongoing interest in the form of slower development and higher defect rates.
Software Supply Chain Security
Software supply chain security is the practice of verifying the integrity and provenance of every component, tool, and process that contributes to a piece of software, from source dependencies through the build system to distribution.