Code Review Workflow

8/3/2026

This post details the integration of Anthropic's Claude AI security guidance plugin with GitLab to enhance the security of the commit-to-production workflow. It introduces a five-step workflow that leverages Claude for in-session code authoring and vulnerability flagging, and GitLab for enforcing controls, providing audit evidence, managing sensitive data, and ensuring comprehensive scanning coverage across the development lifecycle. Key GitLab features highlighted include Security Configuration Profiles, Merge Request Approval Policies, Vulnerability Reports, Security Dashboards, Compliance Controls, Pipeline Logs, Audit Events, Context Exclusions for AI data, Prompt Guardrails, and various security scanning tools (Dependency, Container, IaC, Secret, DAST). The post emphasizes that GitLab provides the guardrails for both human developers and AI agents to ensure secure code delivery.

5/21/2026

Introduces significant enhancements to GitLab's Developer Flow, extending its automation capabilities across the entire MR lifecycle. Key new features include an AI agent that can address reviewer feedback, resolve merge conflicts autonomously ('Resolve with Duo'), research codebases, split large MRs, and implement features. It also adds a one-click rebase and merge functionality. The underlying architecture is now a single agentic loop with a full developer toolset, leveraging project setup files for context.

3/19/2026

Introduces 'Code Review Flow', an agentic AI capability within the GitLab Duo Agent Platform, offering automated code reviews for a flat rate of $0.25 per review. This feature scans changes, explores repository context, checks against pipelines, security findings, and compliance requirements, generating structured inline feedback. It aims to unblock review queues and provide consistent standards at scale by enabling automatic triggering on every merge request and allowing custom instructions per project. The post also details the consumption of GitLab Credits for this feature and provides instructions on how to get started.

6/2/2025

Introduces GitLab Duo with Amazon Q, an agentic AI offering for AWS customers that automates code reviews via a '/q review' command within merge requests. The AI analyzes code changes for bugs, readability, syntax errors, and coding standards, providing actionable feedback and suggestions.

12/13/2024

This post details how GitLab Premium features like Multiple Approvers for Merge Requests, Code Quality checks, Protected Branches, and CI/CD security testing contribute to higher code quality and compliance. It emphasizes the benefits of automation in code review processes, citing an example of Airbus Intelligence reducing release time from 24 hours to 10 minutes. It also highlights advanced compliance controls such as access controls and audit logs for increased accountability.

9/21/2023

Introduced Suggested Reviewers, a feature leveraging machine learning to analyze MR changes and contribution graphs to suggest up to five reviewers with contextual knowledge. Suggestions are updated automatically with new commits and indicate if a reviewer is a code owner or can merge changes. Key benefits include time savings, enhanced collaboration, improved code quality, reduced bottlenecks, and personalized suggestions.

9/9/2021

This post details five new features aimed at improving the code review process within GitLab's DevOps Platform. These include: 1) Integration with IDEs like VS Code and cloud-based environments like Gitpod, allowing users to view, comment on, and checkout branches directly from their development environment. 2) Displaying code quality, security, performance, and other metrics directly within the merge request diff view. 3) Enhancements to the merge request diff view to allow for file-by-file reviews. 4) The ability to mark files as reviewed within the merge request interface. 5) The introduction of 'reviewers' as a distinct role from 'assignee' in merge requests to clarify responsibilities and ensure all necessary parties are informed.

9/3/2021

This post discusses the challenges and importance of code reviews, citing survey data on release delays and developer pain points. It highlights that despite these challenges, code reviews are considered valuable for code quality and security. The post also mentions GitLab's internal efforts to improve code reviews, such as using smaller merge requests and evaluating efficiency. It concludes by stating that a future post will outline how GitLab's DevOps Platform makes code reviews easier.

8/13/2021

This post details how Phabricator's "diff tasks" inspired GitLab's Merge Requests (MRs), particularly the concept of a "Draft" state (now "Draft MRs") and the practice of linking commits to MRs for improved debugging history. It also highlights the evolution of code coverage reporting in MRs, from parsing job output to inline remarks, and draws parallels between Phabricator's Herald and Harbormaster with GitLab CI/CD and webhooks. Finally, it notes the inspiration Phabricator's work boards provided for GitLab's issue and epic boards.

3/18/2021

This post introduces and advocates for the practice of creating small merge requests (MRs) as a key to improving the code review process. It explains that iteration, defined as doing the smallest thing possible, is a core GitLab value that applies to MRs. The post details the technical and practical benefits of small MRs, such as reduced complexity for reviewers, fewer merge conflicts, and easier identification of bugs. It also mentions the existence of DangerBot, a tool that enforces MR size limits, and discusses best practices for follow-up reviews.

3/15/2021

This post introduces and details the use of patch files in code reviews as a method for reviewers to provide actionable, testable code suggestions. It explains how patch files contain commit metadata, how to create them using `git format-patch` and apply them using `git am`, and contrasts this with GitLab's suggestion feature and raw Markdown comments. The post also mentions GitLab's evaluation of integrating patch files into the code review and merge request workflow.

3/9/2021

This post introduces communication strategies for code reviews, focusing on author responsibilities (checklists, clear descriptions, screenshots) and reviewer best practices. It highlights the 'conventional comments' system as a method to frame feedback with clear intent (e.g., 'suggestion (non-blocking)') to improve understanding and reduce friction. It also discusses the importance of 'fairness' in code reviews, providing guidelines for both authors and reviewers to avoid bias and promote collaboration.

10/13/2020

Introduced the 'reviewers' feature in merge requests, allowing explicit assignment of reviewers separate from assignees. This provides notifications to reviewers, clarifies roles within a merge request, and displays review progress status. Also mentioned 'suggest changes' functionality and the ability to delete source branches upon merge.

9/8/2020

This post details four key tips for effective code reviews: 1. Time management by dedicating specific blocks of time (e.g., mornings) for reviews and aiming to unblock others in different time zones. 2. Prioritizing unblocking others by responding to merge requests quickly, aiming to beat the 2-day SLO. 3. Focusing on the code rather than the feature, especially when unfamiliar with the feature's domain, deferring feature-specific reviews to UX/PM, but also leveraging code familiarity to identify bugs. 4. Seeking to understand by asking questions to foster discussion and arrive at the best solution, potentially identifying technical debt. It emphasizes that efficient code review is a learned skill.

7/3/2020

This post highlights the challenges and importance of code reviews based on survey data, noting that code reviews are often stressful, time-consuming, and can be disorganized. It emphasizes that despite these challenges, code reviews are valuable for bug identification, knowledge sharing, mentoring, and collaboration. The post also points to existing GitLab resources for improving code review processes.

6/8/2020

This post introduces and advocates for self-reviews with a detailed checklist for merge request authors to improve the quality of submitted code. It also highlights the 'conventional comments' system as a method to improve communication and intent in code reviews by using bolded keywords to denote the tone and blocking nature of feedback. Additionally, it explains how to create and apply Git patch files as a way for reviewers to demonstrate significant effort and collaboration.

3/18/2020

Introduced Code Review Analytics, a new feature to help teams identify and debug delays in the code review process. The analytics dashboard displays open merge requests with non-author comments, measuring review time from the first non-author comment. It provides details on changes, comments, commits, and approvers, and allows filtering by search. The post also explains how to use the dashboard to debug issues like code complexity, author training needs, or understaffing.

12/19/2019

Introduces real-time collaboration features for merge requests, including presence indicators for users viewing the same MR, and a shared session capability that allows multiple users to co-author comments and follow each other's activity within the MR interface. This aims to improve collaboration efficiency and reduce cycle time.

10/23/2019

This post details the evolution of GitLab's 'Reviewer Roulette' tool. Initially a Slack-based application, it faced workflow integration issues and deployment problems. The solution involved integrating reviewer suggestion logic into the CI pipeline using Danger bot, triggered directly within merge requests. This change removed barriers to usage, ensured availability, and simplified contribution. The post also highlights limitations of the Danger bot integration, particularly for community contributors and satellite projects, and outlines future plans to make this a core GitLab feature, potentially leveraging the CODEOWNERS file.

1/31/2019

This post argues that pre-commit and post-deploy code reviews are outdated and less efficient than using Git branches for pre-deployment reviews. It highlights the advantages of reviewing code on a branch before deployment, citing improved tracking and a clearer SHA for referencing specific versions. The post also touches on the concept of technical debt and suggests focusing review efforts on active code.

8/16/2018

The Drupal project is migrating to GitLab, adopting a merge request workflow to modernize its contribution practices and developer tooling, moving away from a patch-based workflow.

2/13/2018

This post details the integration of eslint-plugin-vue into the GitLab codebase to enforce consistent Vue code style. It describes the initial lack of linting tools when Vue was first added, the development of an internal style guide, and the subsequent adoption of the official eslint-plugin-vue once it reached version 4.0.0. The post highlights the effort involved in fixing linting conflicts and the resulting improvement in code review speed and consistency.

7/25/2017

This post identifies common reasons for code review process failures, including features shipped with defects due to rushed deadlines or internal team dynamics, and features shipped with poor usability or that don't solve business problems due to a lack of business-engineering alignment. It also discusses how accumulated tech debt can hinder future development. The post references external resources and internal discussions to highlight these issues and suggests potential solutions such as cross-functional teams, improved communication channels, and involving developers in business discussions.

6/12/2017

This post details how GitLab fosters collaboration through its development workflow. It emphasizes making code suggestions less intimidating via merge requests, promoting inner sourcing by opening the development platform for cross-team discovery and contribution, and making code reviews impersonal by focusing on constructive feedback and encouraging input from all team members, regardless of experience level. This contributes to the evolution of the code review workflow by highlighting the cultural and process aspects that enhance its effectiveness.

6/5/2017

This post introduces the concept of making smaller changes and committing often to improve the efficiency of code reviews and security checks. It also highlights the importance of involving security experts and reviewers early in the development process and integrating code into staging or test environments sooner. Additionally, it suggests leveraging the community through bug bounty programs to identify and prioritize security issues and bugs.

5/2/2017

This post details GitLab's internal code review process, emphasizing its integration into the broader product development lifecycle rather than being a separate, end-of-process step. It highlights the collaborative nature involving product managers, designers, and engineers, the use of "WIP" merge requests for early collaboration, and the "Conversational Development" methodology. The post also touches on the benefits of code reviews for knowledge sharing, consistency, and accelerating the education of new team members.

3/17/2017

This post details GitLab's typical code review workflow, outlining the steps from a developer making a change in a feature branch, creating a merge request, assigning it to a reviewer, addressing comments, and finally merging after a final review and successful build. It emphasizes the importance of rigorous review for code quality and efficient feature shipping.

8/5/2015

This post argues for pre-production code reviews over post-production reviews, highlighting six key benefits: code freshness, reduced resistance to change, higher focus on quality, catching mistakes before production, enforced review processes (e.g., via Merge Request Approvals), and the observation that smaller reviews are more thorough. It also solicits feedback on improving GitLab's code review capabilities.

6/16/2015

Introduced Merge Request Approvals in GitLab Enterprise Edition 7.12. This feature allows administrators to configure a required number of approvals from different users for a merge request before it can be merged via the UI. This enforces a multi-reviewer workflow.