Code Review Checklist for Python

Standard Operating Procedure: Code Review Checklist for Python

Document ID: ENG-OPS-PY-001
Classification: Internal Technical Standard

1. Document Control & Revision History

---

2. Executive Summary & Scope

This SOP defines the standardized protocol for conducting rigorous peer code reviews on Python-based repositories. The objective is to ensure high code quality, maintainability, security compliance, and performance scalability. This policy applies to all engineering personnel submitting Pull Requests (PRs) for production-bound software. Adherence to this checklist is mandatory for all commits merging into the main or release branches.

---

3. Prerequisites & Tool Requirements

• Environment: Verified local development environment running Python 3.10+.
• Software: Git CLI, access to the organization's VCS (e.g., GitHub Enterprise, GitLab), and IDE with configured linters.
• Mandatory Toolchain:
  • black (Code formatting)
  • flake8 or ruff (Static analysis/Linting)
  • mypy (Type checking)
  • pytest (Unit testing framework)
• Certification: Reviewer must have "Senior" or "Lead" status in the internal Engineering competency matrix to approve production-critical merges.

---

4. Roles & Responsibilities (RACI Matrix)

---

5. Step-by-Step Operational Procedure

Phase I: Pre-Submission Readiness

• Ensure all code is formatted using black with standard line lengths.
• Confirm all docstrings comply with the Google Python Style Guide.
• Verify that no PII, API keys, or sensitive credentials are committed (scan with gitleaks).
• Ensure the commit message follows the Conventional Commits specification.

Phase II: Automated Logic & Integrity Review

• Confirm 100% pass rate on existing CI pipeline triggers.
• Validate that all new features include unit tests covering edge cases and exceptions.
• Check mypy output to ensure zero type-hint violations.
• Confirm that third-party dependencies are pinned to specific versions in requirements.txt or pyproject.toml.

Phase III: Architecture & Security Audit

• Review for "Pythonic" idioms (list comprehensions vs. loops, context managers for I/O).
• Verify that non-blocking I/O is utilized for network-bound tasks.
• Ensure no heavy computational processes are blocking the main event loop.
• Confirm that input sanitization is implemented for all external API endpoints.

---

6. Quality Assurance & Verification Criteria

Acceptance Benchmark: A PR is eligible for merge only if all automated checks pass and at least one Senior Engineer has provided an explicit "LGTM" (Looks Good To Me) post-manual-audit.

---

7. Practical Troubleshooting Scenarios

Scenario A: Pipeline Failure due to Memory Leaks

• Issue: Unit tests pass locally but fail in CI due to OOMKilled (Out of Memory) status.
• Action:
  1. Check for circular references or large objects held in global scope.
  2. Utilize tracemalloc to identify the peak memory consumption point.
  3. Refactor code to use generators (yield) instead of list instantiation for large data sets.

Scenario B: Blocking Main Thread during API Requests

• Issue: Application latency exceeds threshold under load.
• Action:
  1. Identify synchronous network calls within the request lifecycle.
  2. Migrate identified methods to asyncio or offload to a Celery background task queue.
  3. Re-audit for connection pool exhaustion.

Scenario C: Uncontrolled Dependency Growth

• Issue: Build times exceed 10 minutes due to excessive sub-dependencies.
• Action:
  1. Audit requirements.txt using pipdeptree.
  2. Remove redundant dependencies.
  3. Implement a "vendor" or "minimal footprint" policy for new library additions.