How to Automate Code Reviews and Save 20 Hours Per Week

const reviewCost = {
  prsPerWeek: 50,
  avgReviewTime: 30, // minutes
  hourlyRate: 100, // developer cost
 
  // Calculations
  weeklyReviewHours: (50 * 30) / 60, // 25 hours
  weeklyReviewCost: ((50 * 30) / 60) * 100, // $2,500
  annualReviewCost: ((50 * 30) / 60) * 100 * 52, // $130,000
};
 
// What you could save with 70% automation:
// Time saved: 17.5 hours/week
// Cost saved: $91,000/year

// Automated checks can enforce:
const badStyle = function (x, y) {
  return x + y;
}; // ❌
const goodStyle = function (x, y) {
  return x + y;
}; // ✅
 
// Indentation
function nested() {
  if (true) {
    // ❌ Wrong indentation
    console.log("test");
  }
}
 
function nested() {
  if (true) {
    // ✅ Correct indentation
    console.log("test");
  }
}

// SQL Injection
const query = `SELECT * FROM users WHERE id = ${userId}`; // ❌
 
// XSS
element.innerHTML = userInput; // ❌
 
// Hardcoded Secrets
const apiKey = "sk_live_abc123"; // ❌

// N+1 Queries
users.forEach((user) => {
  // ❌
  db.query(`SELECT * FROM posts WHERE user_id = ${user.id}`);
});
 
// Inefficient Loops
for (let i = 0; i < array.length; i++) {
  // ❌
  expensiveOperation(array[i]);
}

// Cyclomatic Complexity
function tooComplex(a, b, c, d, e) {
  // ❌ Complexity: 15
  if (a) {
    if (b) {
      if (c) {
        if (d) {
          if (e) {
            // Too many nested conditions
          }
        }
      }
    }
  }
}

# Install ESLint
npm install --save-dev eslint @eslint/js
 
# Configure
echo '{
  "extends": ["eslint:recommended"],
  "rules": {
    "no-unused-vars": "error",
    "no-console": "warn",
    "complexity": ["error", 10]
  }
}' > .eslintrc.json
 
# Run in CI
npm run lint

# Install pylint
pip install pylint
 
# Configure
echo '[MAIN]
max-line-length=100
max-args=5
max-complexity=10' > .pylintrc
 
# Run in CI
pylint src/

# golangci-lint covers multiple linters
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
 
# Run checks
golangci-lint run

# Install pre-commit
pip install pre-commit
 
# Create config
cat > .pre-commit-config.yaml << EOF
repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.5.0
    hooks:
      - id: trailing-whitespace
      - id: end-of-file-fixer
      - id: check-yaml
      - id: check-json
      - id: detect-private-key
 
  - repo: https://github.com/psf/black
    rev: 24.1.0
    hooks:
      - id: black
 
  - repo: https://github.com/PyCQA/flake8
    rev: 7.0.0
    hooks:
      - id: flake8
EOF
 
# Install hooks
pre-commit install

# .github/workflows/code-quality.yml
name: Code Quality Checks
 
on: [pull_request]
 
jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
 
      - name: Install dependencies
        run: npm install
 
      - name: Run ESLint
        run: npm run lint
 
      - name: Check formatting
        run: npm run format:check
 
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
 
      - name: Run security scan
        uses: github/codeql-action/analyze@v2
 
      - name: Check dependencies
        run: npm audit --audit-level=moderate
 
  test-coverage:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: actions/setup-node@v3
 
      - name: Install dependencies
        run: npm install
 
      - name: Run tests with coverage
        run: npm test -- --coverage
 
      - name: Check coverage threshold
        run: |
          coverage=$(npm test -- --coverage --coverageReporters=json-summary | jq .total.lines.pct)
          if (( $(echo "$coverage < 80" | bc -l) )); then
            echo "Coverage $coverage% is below 80%"
            exit 1
          fi

# .gitlab-ci.yml
stages:
  - lint
  - security
  - test
 
lint:
  stage: lint
  script:
    - npm install
    - npm run lint
    - npm run format:check
  only:
    - merge_requests
 
security:
  stage: security
  script:
    - npm audit --audit-level=moderate
    - npx snyk test
  only:
    - merge_requests
 
test:
  stage: test
  script:
    - npm install
    - npm test -- --coverage
  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
  only:
    - merge_requests

// Before automation
const before = {
  prsPerWeek: 50,
  avgManualReviewTime: 30, // minutes
  totalWeeklyHours: (50 * 30) / 60, // 25 hours
};
 
// After automation
const after = {
  prsPerWeek: 50,
  autoApproved: 35, // 70%
  humanReviewNeeded: 15, // 30%
  avgReviewTime: 20, // minutes (focused review)
  totalWeeklyHours: (15 * 20) / 60, // 5 hours
};
 
const savings = {
  hoursSaved: before.totalWeeklyHours - after.totalWeeklyHours, // 20 hours
  percentReduction: ((25 - 5) / 25) * 100, // 80%
  annualHoursSaved: (25 - 5) * 52, // 1,040 hours
};

const qualityMetrics = {
  before: {
    bugsInProduction: 45, // per quarter
    securityVulnerabilities: 12,
    performanceIssues: 23,
  },
 
  after: {
    bugsInProduction: 15, // 67% reduction
    securityVulnerabilities: 2, // 83% reduction
    performanceIssues: 7, // 70% reduction
  },
};

❌ Bad: Auto-approve all PRs with score > 80
✅ Good: Auto-approve simple PRs, require human for architecture changes
 
❌ Bad: Block PRs for minor style issues
✅ Good: Auto-fix style issues, block only for critical problems
 
❌ Bad: Ignore all false positives
✅ Good: Tune rules to reduce false positives

// Before: 50 warnings per PR
❌ "Unused variable"
❌ "Missing semicolon"
❌ "Line too long"
❌ "Prefer const over let"
... 46 more warnings
 
// After: Focus on important issues
✅ Critical: SQL injection vulnerability
✅ Important: N+1 query detected
✅ Warning: Function complexity high

automation:
  auto_approve: true
 
  # Allow manual review request
  allow_manual_review: true
 
  # Allow bypassing automation (with reason)
  allow_override: true
  required_reason: true