Code Review Checklist Template

Standard Operating Procedure: Code Review Checklist Template

1. Document Control & Revision History

2. Executive Summary & Scope

This SOP establishes the mandatory audit requirements for all source code modifications within the enterprise environment. The scope covers all production-ready repositories, including microservices, infrastructure-as-code (IaC), and database migration scripts. Compliance with this checklist is a prerequisite for CI/CD pipeline promotion. Failure to adhere to these standards constitutes a breach of engineering governance and regulatory data integrity protocols (SOC2/ISO27001).

3. Prerequisites & Tool Requirements

• Access Requirements: GitHub Enterprise / GitLab Ultimate contributor status with MFA enabled.
• Software Requirements: IDE with mandated linting/formatting plugins (e.g., Prettier, ESLint, SonarLint), local Docker runtime for integration testing.
• Certifications: Completion of Secure Coding Practices Training (Level 2).
• Safety/PPE: N/A (Digital environment only).

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

Phase 1: Pre-Submission Audit

• Verify local execution of the complete unit test suite (minimum 85% coverage).
• Confirm all local linters pass with zero warnings or errors.
• Ensure sensitive data (API keys, PII) is absent from the commit history.
• Validate that the commit follows the Conventional Commits specification.

Phase 2: Peer Review Audit

• Functional Logic: Verify the code fulfills the documented JIRA/Ticket requirements.
• Security: Perform manual threat modeling on input validation and authentication endpoints.
• Performance: Review loops and database queries for N+1 issues or memory leakage.
• Maintainability: Ensure code readability, modularity, and adequate documentation (Docstrings/README updates).

Phase 3: Final Verification

• Confirm successful build status in the CI/CD environment.
• Verify that all required reviewers have submitted "Approved" status.
• Ensure all blocking comments have been addressed and validated by the author.

6. Quality Assurance & Verification Criteria

Acceptance requires full compliance across all metrics. Any deviation requires a formal "Waiver of Deviation" signed by the Lead Architect.

7. Practical Troubleshooting Scenarios

Scenario A: Build Failure due to Environment Drift

• Trigger: CI pipeline fails due to dependency version mismatch.
• Corrective Action: The Author must synchronize lock files with the target environment and rebase the feature branch against the main branch. Force-pushing without verification is strictly prohibited.

Scenario B: Security Vulnerability Detection

• Trigger: SAST tool flags a SQL Injection or Hardcoded Secret.
• Corrective Action: Immediate "Blocker" status assigned to PR. The Author must scrub commit history and rotate the exposed secret immediately via the secret management vault. Re-review is mandatory after remediation.

Scenario C: Review Deadlock

• Trigger: Reviewer and Author fail to reach consensus on implementation patterns after two cycles.
• Corrective Action: Escalate to the Lead Architect for a "Final Arbiter" determination. This decision must be documented as an Architectural Decision Record (ADR) to prevent recurring debate.