Code review
Every change to code, infrastructure or configuration at Northwind is reviewed by someone other than its author before it is merged. Review catches defects, shares knowledge and keeps the code base consistent with our Coding standards.
Rules
| Rule | Standard |
|---|---|
| Reviewers | At least one approval from a code owner |
| Production-critical code | Two approvals, one of them from a Lead Consultant (L4) or above |
| Response time | First review within 1 business day |
| Size | Keep pull requests under about 400 changed lines |
| Self-merge | Not allowed, even for small fixes |
For authors
- Create the branch following the Branching strategy.
- Run tests and linters locally. The definition of done must be met before you ask for review.
- Open a pull request with a clear title, a description of what and why, and a link to the ticket.
- Add screenshots for UI changes and migration notes for data changes.
- Respond to every comment, either by changing the code or by explaining your reasoning.
- Merge only after approval and a green build.
For reviewers
Look for, in this order: correctness, security, tests, readability and design. Do not argue about style that a formatter can fix.
- Be kind and specific. Use "Consider..." rather than "This is wrong".
- Mark optional comments with
nit:. - Approve when remaining comments are optional.
- Check that no secrets or customer data are in the diff. Customer data must never appear in a repository; see POL-IT-003.
Example pull request template
## What
Short description of the change.
## Why
Ticket link and context.
## How tested
- [ ] Unit tests
- [ ] Manual test steps
## Risks and rollback
How to undo this change if needed.
Security-sensitive changes
Changes touching authentication, access control or encryption need review from the security team. Contact Erin Oduya (IT Security Manager). Daniel Okafor (CTO) owns the engineering practices on this wiki.
Customer-specific rules
Some customers require extra review steps. For example, Stellar Health work involves health data and follows the protections described on the Stellar Health page.
Metrics
We track review turnaround time and the share of pull requests that need rework. They are discussed in retrospectives, see How we run projects.
Owner: Daniel Okafor - Last updated: 2026-04-14