Claude Code से टीम Code Review Workflow बनाएं

Claude Code को code review में इस्तेमाल करने का मतलब human reviewer को हटाना नहीं है। सही उपयोग यह है कि Claude Code PR का risk पहले साफ करे, missing tests और risky files दिखाए, और reviewer को architecture, product intent और ownership decision पर ध्यान देने दे।

Team workflow के लिए सिर्फ “इस PR को review करो” कहना काफी नहीं है। PR template, CLAUDE.md rules, diff size gate, GitHub Actions, CODEOWNERS और fixed review prompt को साथ जोड़ना बेहतर है। Official references के लिए Claude Code common workflows, GitHub pull request docs, CODEOWNERS, GitHub Actions workflow syntax और OWASP Code Review Guide देखें।

Review System

Risk-based review का मतलब है हर line को समान priority से नहीं देखना। Authentication, authorization, billing, data migration, performance और missing tests ज्यादा महत्वपूर्ण होते हैं। Diff scope यानी इस PR में बदला हुआ actual area। CI gate यानी automatic check जो warn या block कर सकता है। Hallucinated finding यानी ऐसा AI comment जो सही लगता है, लेकिन diff में evidence नहीं है।

flowchart LR
  A["PR template"] --> B["Diff size gate"]
  B --> C["Claude Code review"]
  C --> D["Code owner review"]
  D --> E["CI tests and merge"]
  C --> F["Questions before fixes"]

Main rule: review के दौरान Claude Code को silently code rewrite नहीं करना चाहिए। अगर business intent, data contract या permission rule unclear है, तो bug claim करने से पहले question पूछना चाहिए।

Real Use Cases

पहला use case authentication और authorization है। Login, session, role, admin screen और API key वाले PR में Claude Code से missing authorization, privilege escalation, secret leak और audit log gap check कराएं। Business rule सही है या नहीं, यह human reviewer तय करेगा। Security flow के लिए security audit automation भी देखें।

दूसरा use case performance-sensitive PR है। Search, list, cache, image processing और batch jobs में N+1 queries, repeated rendering, wrong cache keys और large payload छिपे हो सकते हैं। अच्छा review comment यह बताएगा कि किस input size पर problem आएगी और उसे measure कैसे करेंगे।

तीसरा use case tests और data migration है। Schema, migration, seed, validation और backfill में rollback, existing data, nullable fields, unique constraints और retry behavior देखना जरूरी है। Claude Code missing tests और edge cases की list बना सकता है।

चौथा use case बहुत बड़ा PR है। 800 से 1000 changed lines के बाद review quality गिरती है। CI size warn कर सकता है, और Claude Code behavior, migration, UI और tests के हिसाब से split plan दे सकता है।

PR Template

.github/pull_request_template.md बनाएं।

## Change summary
- What changed:
- Why it changed:
- User-visible impact:

## Risk review
- [ ] Security impact checked
- [ ] Performance impact checked
- [ ] Test coverage added or explained
- [ ] Data migration or rollback plan checked
- [ ] No secrets, tokens, or personal data included

## Claude Code review request
Please review this PR by diff scope only.

Focus on:
- Security: auth, authorization, injection, secret leakage
- Performance: N+1 queries, cache keys, unnecessary work
- Tests: missing unit, integration, and migration tests
- Data: schema changes, rollback, backfill safety

For each finding, include:
- file and line
- why it matters
- evidence from the diff
- suggested fix or question for the author

diff scope only जरूरी है। इससे Claude Code पूरे repository की generic सलाह देने के बजाय इसी PR के evidence पर रहेगा।

CLAUDE.md Rules

Repository के CLAUDE.md में team review rules रखें। यह Claude Code के लिए project memory की तरह काम करता है। More detail के लिए CLAUDE.md best practices पढ़ें।

## Code review rules

Review only the current diff unless the user asks for wider context.

Severity:
- Must fix: security bug, data loss, broken build, failed test, migration risk
- Should fix: likely production bug, missing important test, measurable performance issue
- Nice to have: naming, small cleanup, optional refactor

Evidence rule:
- Every finding must cite a file and line.
- If the evidence is uncertain, ask a question instead of asserting a bug.
- Do not invent dependencies, routes, database columns, or team policies.

Security checks:
- Authentication and authorization
- SQL or command injection
- XSS and unsafe HTML
- Secret leakage
- Missing audit log for privileged actions

Data checks:
- Migration rollback path
- Backfill failure behavior
- Existing nullable and unique constraints
- PII handling and retention

Evidence rule false positives कम करती है। File, line और reason नहीं है तो finding को question मानें।

Diff Gate Script

इसे scripts/review-diff-gate.mjs में save करें।

#!/usr/bin/env node
import { execSync } from "node:child_process";

const baseRef = process.env.BASE_REF || "origin/main";
const maxFiles = Number(process.env.MAX_REVIEW_FILES || 25);
const maxLines = Number(process.env.MAX_REVIEW_LINES || 800);

function git(command) {
  return execSync(command, { encoding: "utf8" }).trim();
}

const files = git(`git diff --name-only ${baseRef}...HEAD`)
  .split(/\r?\n/)
  .filter(Boolean);

const numstat = git(`git diff --numstat ${baseRef}...HEAD`);
const changedLines = numstat
  .split(/\r?\n/)
  .filter(Boolean)
  .reduce((total, line) => {
    const [added, deleted] = line.split(/\s+/);
    return total + (Number(added) || 0) + (Number(deleted) || 0);
  }, 0);

const riskyPatterns = [
  /^src\/auth\//,
  /^src\/billing\//,
  /^db\/migrations\//,
  /^infra\//,
  /^\.github\/workflows\//,
];

const riskyFiles = files.filter((file) =>
  riskyPatterns.some((pattern) => pattern.test(file))
);

let failed = false;

if (files.length > maxFiles) {
  console.error(`Too many files changed: ${files.length} > ${maxFiles}`);
  failed = true;
}

if (changedLines > maxLines) {
  console.error(`Too many changed lines: ${changedLines} > ${maxLines}`);
  failed = true;
}

if (riskyFiles.length > 0) {
  console.log("Risk-sensitive files changed:");
  for (const file of riskyFiles) console.log(`- ${file}`);
}

if (failed) {
  console.error("Split the PR or add a reviewer-approved exception.");
  process.exit(1);
}

console.log(`Review gate passed: ${files.length} files, ${changedLines} lines.`);

Local run:

BASE_REF=origin/main MAX_REVIEW_FILES=25 MAX_REVIEW_LINES=800 node scripts/review-diff-gate.mjs

GitHub Actions और CODEOWNERS

.github/workflows/review-gate.yml जोड़ें।

name: review-gate

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  diff-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: "22"

      - name: Run diff size gate
        env:
          BASE_REF: origin/${{ github.base_ref }}
          MAX_REVIEW_FILES: "25"
          MAX_REVIEW_LINES: "800"
        run: node scripts/review-diff-gate.mjs

Risky files को सही reviewer तक भेजने के लिए CODEOWNERS रखें।

# .github/CODEOWNERS
/src/auth/ @example-org/security
/src/billing/ @example-org/payments
/db/migrations/ @example-org/backend-leads
/.github/workflows/ @example-org/platform
/infra/ @example-org/platform

CI design के लिए CI/CD setup guide और PR discipline के लिए pull request quality guide पढ़ें।

Review Prompt

Review the current PR diff against main.

Rules:
1. Stay inside the diff scope unless a referenced file is required.
2. Do not rewrite code silently.
3. For each finding, include file, line, severity, evidence, and suggested action.
4. If business intent or data contract is unclear, ask a question instead of guessing.
5. Ignore style-only preferences unless they break CLAUDE.md or project conventions.

Focus areas:
- Security: auth, authorization, injection, XSS, secrets, audit logs
- Performance: N+1 queries, cache invalidation, repeated rendering, large payloads
- Tests: missing coverage for changed behavior, migrations, and edge cases
- Data migration: rollback, backfill, nullable fields, unique constraints
- CI and ownership: required checks, CODEOWNERS, risky paths

Output:
## Must fix
## Should fix
## Questions
## No issue found in

Pitfalls और verification note

पहली गलती है Claude Code से review और fix एक साथ करवाना। इससे findings validate होने से पहले diff बड़ा हो जाता है। पहले review, फिर human decision, फिर tests।

दूसरी गलती है evidence के बिना finding मान लेना। File, line और changed behavior नहीं है तो उसे question में रखें।

तीसरी गलती है migration को हल्का समझना। Green tests production data safety prove नहीं करते। Existing NULL, duplicates, locks, rollback limits और backfill retry जरूर देखें।

मैंने examples को minimal repository workflow की तरह verify किया: script को Git और Node 22 चाहिए, Action वही script चलाती है, और templates Claude Code को diff evidence तक सीमित रखते हैं। Team rollout में पहले one week warning mode रखें, thresholds adjust करें, फिर reliable gates required बनाएं। Next step के लिए review gate before commit checklist पढ़ें।