@@ ✦ · series @@
The Craft of Code Review
The hands-on series: how to review large pull requests without drowning, what to look for in migrations, APIs, frontend changes, tests and refactors, and how to write feedback that gets acted on instead of resented.
June 10, 2026Why are pull requests so hard to review?Pull request review is slow because reading code is harder than writing it, and the tools make it worse. The four real causes, and what actually helps.June 12, 2026How to review large pull requests without losing your mindA practical, step-by-step method for reviewing large pull requests: triage the files that matter, review in passes, and keep your place in a 40-file diff.June 14, 2026How big should a pull request be?The research-backed answer on pull request size: under ~400 changed lines, smaller is better. Where the number comes from, when to break it, how to split.June 28, 2026Author self-review: the cheapest code review you’re not doingSelf-review your pull request before requesting eyes: catch the cheap defects at the cheapest point and halve reviewer round-trips. A five-minute pass.June 30, 2026Nitpicks are killing your code reviewCode review nitpicking crowds out logic review, demoralizes authors, and slows merges. Automate the nits, label the rest, save attention for what matters.July 2, 2026Re-reviewing a PR after changes: the interdiff problemHow to review changes since your last review: the interdiff problem, force-push pain, git range-diff, and commit-scoped diffs that keep threads intact.July 6, 2026Atomic commits make reviewable PRsStructure a pull request as a sequence of atomic commits and reviewers can read it like chapters. The craft of commit-by-commit review, and the squash debate.July 22, 2026Risk based code review: tier your rigor by blast radiusRisk based code review tiers rigor by blast radius, longevity, and ownership. A concrete four tier model, how to encode it, and the everything is critical trap.August 5, 2026A code review checklist that fits in your head: three passes, seven questionsA code review checklist that fits in your head: three passes, seven questions worth asking every time, and when checklists turn into box-ticking.August 7, 2026A security code review checklist for auth, payments, and input handlingA security code review checklist for auth, payments, and input handling: trust boundaries, authz on new paths, secrets, and a two-reviewer rule.August 9, 2026How to review database migrationsHow to review database migrations: verify the down path, lock behavior on big tables, deploy order, and backfills before a one-line ALTER hurts you.August 11, 2026How to review API changes without breaking clientsHow to review API changes as contract changes: additive vs breaking, nullability and error-shape traps, versioning, deprecation, and generated clients.August 13, 2026How to review frontend pull requests beyond looks fineHow to review frontend pull requests beyond looks fine: the four UI states, race conditions, accessibility basics, bundle cost, and when to pull the branch.August 15, 2026How to review test code so that green means somethingHow to review test code so green means something: ask if the test can fail, assert requirements over implementation, and catch flakiness smells in the diff.August 17, 2026How to review a refactor when the claim is no behavior changeHow to review a refactor: treat no behavior change as a claim needing evidence, use commit structure and untouched tests, and catch sneaked-in edits.August 19, 2026How to review dependency updates without reflex-mergingHow to review dependency updates without reflex-merging: tier Renovate and Dependabot PRs by risk, read changelogs, and watch new transitive packages.