Checklist Code Review Claude Code untuk Tim

Mulai dari risiko, bukan “review this”

Jika Anda hanya meminta Claude Code “review this PR”, biasanya hasilnya berguna, tetapi terlalu umum.

Untuk tim, review harus menjawab hal yang lebih konkret: apa yang bisa rusak, data apa yang tersentuh, bukti test apa yang ada, dan risiko mana yang harus memblok merge.

Artikel ini memberi checklist yang bisa disalin, prompt review untuk Claude Code, template pull request GitHub, dan CI guard dengan GitHub Actions.

Claude Code bukan pengganti tanggung jawab reviewer manusia. Ia membantu mengurangi kelalaian dan membuat standar review lebih konsisten. Untuk referensi resmi, baca panduan Claude Code tentangcode review setup, dokumentasiClaude Code GitHub Actions, dokumentasi GitHub untukPR templates, protected branches, danActions workflows. Untuk keamanan, gunakanOWASP Secure Code Review Cheat Sheet.

Apa itu review berbasis risiko

Review berbasis risiko berarti tidak semua PR memakai bobot yang sama. Perubahan copy, spacing CSS, webhook pembayaran, dan database migration destruktif punya dampak berbeda. Jika semua berat, perubahan kecil menjadi lambat. Jika semua ringan, perubahan berbahaya dapat lolos.

Mulai dengan tiga level:

Risiko	Contoh	Review wajib
Low	Copy, CSS sederhana, docs, teks log	Satu reviewer, summary jelas, screenshot atau penjelasan diff
Medium	Form, UI state, search, bentuk response API, akses data read-only	Satu reviewer, bukti test, review Claude Code
High	Auth, authorization, billing, data pribadi, migration, delete, webhook	Dua reviewer, rollback plan, CI wajib, review security/privacy

Migration adalah perubahan pada struktur database atau bentuk data. Code sering bisa di-revert. Column yang dihapus, record yang ditulis ulang, atau backfill yang gagal jauh lebih sulit dipulihkan. Karena itu review migration harus bertanya “bagaimana rollback?” sebelum membahas gaya code.

Saat memakai Claude Code, nyatakan risk level. Prompt yang kabur akan menghasilkan komentar style. Prompt seperti “High risk: billing webhook and customer email changed” mengarahkan review ke signature validation, idempotency, retry, privacy logs, dan bukti test.

Catatan praktik Masa menunjukkan kegagalan yang sering terjadi: hanya memakai kata abstrak seperti quality, security, maintainability. Kata itu bagus sebagai judul, tetapi lemah sebagai pertanyaan review. Template PR yang baik meminta files touched, data type, risk reason, test evidence, dan rollback step.

Checklist review yang bisa disalin

Simpan ini di .github/review-checklist.md, wiki tim, atau bagian review di CLAUDE.md. Item dibuat konkret agar manusia dan Claude Code mengecek fakta, bukan niat.

# Code Review Checklist

## 0. PR scope
- [ ] This PR has one clear purpose.
- [ ] Changed files match the stated purpose.
- [ ] Generated or AI-written files are marked in the PR description.
- [ ] No unrelated formatting, dependency, or config changes are mixed in.

## 1. Risk level
- [ ] Risk level is marked as low, medium, or high.
- [ ] High-risk PRs have two human reviewers.
- [ ] High-risk PRs include rollback or recovery steps.

## 2. Security and privacy
- [ ] User input is validated on the server side.
- [ ] Authorization is checked near the data access point.
- [ ] Secrets are not printed, committed, or sent to Claude prompts.
- [ ] Logs do not include email, tokens, addresses, payment IDs, or private content.
- [ ] OWASP-relevant risks such as injection, XSS, broken access control, and SSRF were considered.

## 3. Tests
- [ ] Unit or integration tests cover the changed behavior.
- [ ] Regression tests cover the bug that motivated the PR.
- [ ] Manual verification steps are written with actual result, not "works locally".
- [ ] Snapshot changes are explained.

## 4. Performance
- [ ] New loops, queries, and network calls are bounded.
- [ ] N+1 queries were checked.
- [ ] Large lists, images, and bundles have a budget.
- [ ] Metrics or before/after evidence are attached for performance-sensitive changes.

## 5. Accessibility
- [ ] Keyboard operation works for interactive UI.
- [ ] Focus order and visible focus state are preserved.
- [ ] Form fields have labels and errors that screen readers can understand.
- [ ] Color contrast and reduced-motion behavior are checked where relevant.

## 6. Migration and data risk
- [ ] Migration is backward compatible during rollout.
- [ ] Destructive changes have backup or recovery steps.
- [ ] Old and new app versions can run during deployment.
- [ ] Data cleanup jobs are idempotent.

## 7. AI-generated diff hygiene
- [ ] AI-generated code was read by a human before approval.
- [ ] The diff does not remove tests, monitoring, analytics, or CTA links by accident.
- [ ] New dependencies are justified.
- [ ] Comments do not claim verification that was not actually done.

Kuncinya adalah setiap item bisa diverifikasi. “Security sudah dipertimbangkan” terlalu lemah. “Log tidak berisi email, token, alamat, payment ID, atau konten privat” bisa dicek. “Accessibility aman” juga lemah; “keyboard berfungsi, focus terlihat, label dan error terbaca” jauh lebih berguna.

Prompt review untuk Claude Code

Prompt perlu memberi role, context, risk, dan batasan: findings dulu, jangan rewrite code. Jika review dan implementasi bercampur, diff membesar dan tim sulit tahu mana perbaikan yang benar-benar disetujui.

You are reviewing a pull request for a production team.

Goal:
- Find concrete risks before merge.
- Prioritize correctness, security/privacy, tests, performance, accessibility, migration/data risk, and AI-generated diff hygiene.
- Do not rewrite code yet. Produce review findings first.

Context:
- Risk level: <low | medium | high>
- Business area: <auth | billing | content | search | admin | analytics | other>
- Sensitive data touched: <none | email | payment | address | health | private content | other>
- Rollout plan: <flag | migration | immediate deploy | other>

Review method:
1. Read the PR summary and changed files.
2. List the top risks by severity.
3. For each finding, include file, line or function, why it matters, and a minimal fix.
4. Separate "must fix before merge" from "follow-up".
5. Check whether tests prove the changed behavior.
6. Check whether any AI-generated code, dependency, config, or formatting change is unrelated to the PR goal.

Output format:
- Findings first, ordered by severity.
- Then missing evidence.
- Then questions for the author.
- Then a short merge recommendation: block, approve with fixes, or approve.

Prompt ini cocok dengancodebase navigation dantesting strategy. Sebelum review, minta Claude Code menjelaskan domain yang disentuh PR. Ini mencegah review berhenti pada naming dan formatting saja.

Template pull request GitHub

Dengan .github/pull_request_template.md, GitHub mengisi body PR secara otomatis. Tujuannya bukan birokrasi, melainkan mengumpulkan bukti review yang dibutuhkan reviewer, Claude Code, dan branch protection.

## Summary
- TODO

## Risk
Risk level: low | medium | high

Risk reasons:
- Data touched:
- Users affected:
- Rollout:

## Review focus
- [ ] Correctness
- [ ] Security/privacy
- [ ] Tests
- [ ] Performance
- [ ] Accessibility
- [ ] Migration/data risk
- [ ] AI-generated diff hygiene

## Test evidence
- Automated:
- Manual:
- Not tested because:

## Security and privacy notes
- Secrets changed: no | yes
- Personal data in logs: no | yes
- Authorization boundary changed: no | yes

## Migration / rollback
- Migration included: no | yes
- Backward compatible: no | yes | not applicable
- Rollback plan:

## Claude Code review prompt
Paste this into Claude Code after the PR is ready:

Review this PR as risk level "<low|medium|high>".
Focus on correctness, security/privacy, tests, performance, accessibility, migration/data risk, and AI-generated diff hygiene.
Return findings first with file/function references and minimal fixes.

Hindari template yang hanya berisi checkbox panjang. Orang akan mencentangnya secara mekanis. Field seperti Risk reasons, Test evidence, dan Rollback plan memaksa bukti dan mudah dicek oleh CI.

CI guard dengan GitHub Actions

Workflow dan script Node berikut mengecek body PR dan file yang berubah. Ini tidak membuktikan code benar, tetapi mencegah PR tanpa context dasar masuk ke reviewer.

name: PR review guard

on:
  pull_request:
    types: [opened, edited, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: read

jobs:
  review-guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Check PR review evidence
        run: node scripts/pr-review-guard.mjs
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

import { execSync } from "node:child_process";
import { readFileSync } from "node:fs";

const eventPath = process.env.GITHUB_EVENT_PATH;
if (!eventPath) throw new Error("GITHUB_EVENT_PATH is missing.");

const event = JSON.parse(readFileSync(eventPath, "utf8"));
const pr = event.pull_request;
const body = pr?.body ?? "";
const base = process.env.BASE_SHA ?? pr?.base?.sha;
const head = process.env.HEAD_SHA ?? pr?.head?.sha;

function safeRef(value, name) {
  if (!value || !/^[a-f0-9]{40}$/i.test(value)) throw new Error(`${name} must be a full git SHA.`);
  return value;
}

const changedFiles = execSync(`git diff --name-only ${safeRef(base, "BASE_SHA")} ${safeRef(head, "HEAD_SHA")}`, {
  encoding: "utf8",
}).split(/\r?\n/).filter(Boolean);

const hasRisk = /Risk level:\s*(low|medium|high)/i.test(body);
const hasTests = /## Test evidence[\s\S]*(Automated|Manual):\s*\S/i.test(body);
const hasRollback = /Rollback plan:\s*\S/i.test(body);
const highRisk = /Risk level:\s*high/i.test(body);
const migrationChanged = changedFiles.some((file) => /migrations?|schema|prisma|drizzle/i.test(file));
const sensitiveChanged = changedFiles.some((file) => /auth|session|permission|billing|payment|webhook/i.test(file));
const failures = [];

if (!hasRisk) failures.push("Add Risk level.");
if (!hasTests) failures.push("Add automated or manual test evidence.");
if ((highRisk || migrationChanged) && !hasRollback) failures.push("Add rollback plan.");
if (sensitiveChanged && !/Security and privacy notes/i.test(body)) failures.push("Add security/privacy notes.");

if (failures.length) {
  console.error("PR review guard failed:");
  for (const failure of failures) console.error(`- ${failure}`);
  process.exit(1);
}

console.log("PR review guard passed.");

Mulai sebagai advisory check. Setelah tim terbiasa, jadikan required check untuk high-risk changes dan migrations di protected branches. PR low-risk tetap harus cepat agar proses tidak dianggap beban.

Security, privacy, tests, performance, accessibility

Untuk security, pecah review menjadi input, authorization, output, logs, dan external calls. Apakah validasi ada di server? Apakah authorization dekat dengan data access, bukan hanya UI? Apakah output bisa XSS? Apakah log membawa private data? Apakah webhook atau external URL bisa menjadi SSRF atau signature bypass?

Privacy lebih luas dari secrets. Email, payment ID, alamat, pesan kontak, analytics ID, dan private content juga penting. Jangan paste API key asli, email pelanggan, kontrak, atau payment ID ke prompt. Masking value dan beri Claude Code struktur datanya.

Untuk tests, minta bukti. “Works locally” bukan bukti. PR yang baik menjelaskan automated test yang dijalankan, manual flow yang dicek, dan hasil aktualnya. Jika tidak ada test, alasannya harus tertulis.

Untuk performance, cari unbounded loop, N+1 query, repeated network calls, bundle growth, gambar berat, dan client rendering mahal. Angka before/after sederhana sudah membantu review.

Untuk accessibility, jangan berhenti di screenshot. Cek keyboard, focus order, visible focus, label, pesan error, modal focus trap, dan reduced motion. UI buatan Claude Code bisa terlihat rapi tetapi melupakan detail ini.

Use case praktis

Use case pertama adalah auth dan admin screen. Daftar user, perubahan role, dan audit log harus dilindungi di API atau data layer. Review authorization, personal data di logs, audit trail, dan test akses tidak sah.

Use case kedua adalah billing dan webhook. Payment webhook butuh signature validation, idempotency, retry handling, duplicate event safety, cancellation handling, dan log yang menjaga privacy.

Use case ketiga adalah database migration. Kolom baru bisa merusak production jika versi app lama dan baru berjalan bersamaan saat deploy. Cek default, not null, index, backfill, rollback, dan urutan expand-contract.

Use case keempat adalah diff UI besar yang dibuat AI. Saat Claude Code membuat page, form, modal, atau table, cek CTA terhapus, analytics event berubah, accessibility gap, snapshot tanpa penjelasan, dan dependency baru.

Use case kelima adalah content site dengan revenue path. Review halaman artikel, produk, atau lead form juga harus melindungi conversion. Jika link keproduk, form PDF gratis, atau consultation tracking rusak, itu bug bisnis meskipun halaman masih render.

Pitfall, CTA, dan hasil

Pitfall pertama adalah menerima findings Claude Code tanpa verifikasi. AI bisa terdengar meyakinkan. Cocokkan setiap finding dengan diff, tests, official docs, atau reproduction.

Pitfall kedua adalah mencampur review dan implementation. Minta findings dulu, putuskan must-fix, lalu ubah code. PR tetap mudah dibaca.

Pitfall ketiga adalah unrelated AI cleanup. Formatting, dependency, config, dan deleted tests bisa tersembunyi di diff besar. Minta Claude Code menulis unrelated changes secara eksplisit.

Pitfall keempat adalah menganggap rollback data sama dengan revert code. Revert tidak mengembalikan data yang sudah dihapus. High-risk migration perlu backup, recovery SQL, feature flag, atau staged plan.

Review juga melindungi revenue: billing, product pages, free PDF, Gumroad, analytics, dan consultation CTA adalah bagian dari sistem. Untuk latihan, mulai darifree checklist. Untuk prompts, templates, CLAUDE.md, dan CI guard yang reusable, lihatproducts. Untuk rollout di repo nyata, gunakantraining and consultation.

Saya mencoba format ini pada tiga skenario kecil: perubahan UI Next.js, database migration, dan UI diff buatan Claude Code. Dampak terbesar datang dari memaksa Risk level dan Rollback plan di body PR. Menambah checkbox saja tidak seefektif evidence yang pendek dan konkret.

Ringkasan

Checklist code review Claude Code bukan sekadar prompt. Ini workflow tim yang menghubungkan risk classification, PR evidence, human review, CI, dan protected branches.

Mulai kecil: tambah PR template, jalankan guard sebagai advisory, lalu wajibkan untuk high-risk changes. Gabungkan denganAI pair programming danCLAUDE.md best practices agar standar review hidup di repository.