Peer code review process

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Who should review a code change in a peer code review?

A The developer who wrote the change, checking their own work

B Another developer, not the author of the change

2. When does a peer code review happen in a pull request workflow?

A After the change has been merged and released to users

B Before the change is merged into the main branch

3. Which item belongs on a security checklist used in a peer code review?

A Is user input validated before it is used in a query?

B Does the code use the author's favourite variable names?

4. A reviewer finds a hard-coded API key in the pull request. What should they do?

A Request changes so the key is removed and stored outside the source code

B Approve the pull request and mention the key in a chat later

5. What does approval before merge mean?

A The reviewer signs off that the change passed the checklist, and only then can it be merged

B The author merges first and the reviewer signs off whenever they have time

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1git push origin feature/login		A[x] Input is validated before use in queries
2Status: Approved by reviewer		BReviewer: Sam \| Decision: Changes requested
3A security checklist item the reviewer ticks off during a peer review		CA peer has finished the review, the checklist is satisfied, and the change is allowed to be merged
4The review decision is recorded on the pull request so there is an audit trail		DThe author approved their own change, so no independent peer checked it against the security checklist.
5git merge feature/login (no review done)		ESends your branch to the shared repository so a pull request can be opened for a peer to review before merging
6Reviewer: the author approves own pull request		FThe change was merged without a peer reviewing it or approving it, so no security checks were applied.

Definitions

peer code review

Fill in the Blanks

Complete each line of code by filling in the missing parts.

git ____ origin feature-login

IF reviewer __ author THEN startReview

IF checklistPassed ___ approved THEN merge

pullRequest.________ = "approved"

IF checksOk THEN approve ____ reject

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A reviewer = author

B checklist = load_checklist()

C review(pr, checklist)

Question 2

A pr = open_pr(branch)

B reviewer.read(pr.changes)

C reviewer.tick(checklist)

D if checklist.any_passed():

E pr.approve()

F merge(pr)

Question 3

A for item in checklist:

B ok = reviewer.check(item)

C if not ok:

D pr.approve()

Question 4

A pr = get_pull_request(42)

B if not pr.approved:

C merge(pr)

D else:

E notify(pr.author)

Question 5

A decision = 'approved'

B print(decision)

C pr.add_comment(notes)

D merge(pr)

Answer Key

Peer code review process

Section A: Quick Questions

B — Another developer, not the author of the change

B — Before the change is merged into the main branch

A — Is user input validated before it is used in a query?

A — Request changes so the key is removed and stored outside the source code

A — The reviewer signs off that the change passed the checklist, and only then can it be merged

Section B: Match the Pairs

git push origin feature/login → Sends your branch to the shared repository so a pull request can be opened for a peer to review before merging

Status: Approved by reviewer → A peer has finished the review, the checklist is satisfied, and the change is allowed to be merged

A security checklist item the reviewer ticks off during a peer review → [x] Input is validated before use in queries

The review decision is recorded on the pull request so there is an audit trail → Reviewer: Sam | Decision: Changes requested

git merge feature/login (no review done) → The change was merged without a peer reviewing it or approving it, so no security checks were applied.

Reviewer: the author approves own pull request → The author approved their own change, so no independent peer checked it against the security checklist.

Section C: Definitions

peer code review — Another developer checks a change before it is merged, using a checklist that includes security checks, and approves it. The decision is recorded on the pull request.

Section D: Fill in the Blanks

git push origin feature-login

IF reviewer != author THEN startReview

IF checklistPassed AND approved THEN merge

pullRequest.decision = "approved"

IF checksOk THEN approve ELSE reject

Section E: Spot the Error

A — A peer code review needs another developer. The author cannot review their own change. It should be reviewer = other_dev(author).

D — The reviewer should only approve when every checklist item passes, including the security checks. It should be checklist.all_passed(), not any_passed().

D — When a checklist item fails, the reviewer must request changes. Approving the pull request would let an unsafe change through. It should be pr.request_changes().

B — A change is merged only after it has been approved. With 'not', unapproved changes would be merged. It should be if pr.approved:.

B — The review decision must be recorded on the pull request so there is a record of who decided what. Printing it leaves no record. It should be pr.record(decision, reviewer).