Merge-Ready Isn't Production-Ready
A pull request lands with 40 changed files. An AI agent produced it in ten minutes, the description is clear, the tests are green, the code is neatly formatted, and the summary ends with "Everything works as expected." It always does. Which of those 40 files should get a careful human read? That's the new review problem. AI lets developers build features, refactor and change large codebases…
An AI-generated pull request contains 40 changed files, reviewed in an instant with a clean description, passing tests, and perfect formatting. However, the code's quality is questionable, as the same issues persist in every PR. Developers now face a new challenge: determining which of those 40 files require a thorough human review, as the attention required doesn't scale with the increased code volume.
Skimming through everything is not the solution, nor is adding more reviewers to every PR. Instead, developers must be deliberate about what truly needs human attention. Reviewing code is about making a judgment call: does the change solve the right problem, what could it break, and do we have enough confidence to ship it? The following three practices can help:
1. Risk determines review depth. The number of changed lines is not a reliable measure of the review's required depth. A one-line edit to a shared API client can affect the entire application, while a much larger change to an isolated component might have very limited impact. Consider the blast radius: how much of the application could be impacted if the change fails?
Group changes into three levels: low blast radius (isolated code, small styling adjustments, self-contained features), medium blast radius (feature-specific hooks, form validation, API integration within a single feature), and high blast radius (global state, authentication, shared API clients, common hooks, routing, permissions, application-wide configuration, and core business logic).
High blast radius changes deserve a deeper review, stronger tests, and potentially a second reviewer.
2. Think about failure and recovery before approving. Reviewing a change means considering what must remain unchanged, the worst plausible outcome if the change fails, and how quickly and safely we can recover. These questions reveal cases that might be missed when evaluating the new code's successful execution. Consider potential failure scenarios, such as unexpected API responses, request failures during execution, data corruption, broken compatibility, or weakened authorization checks.
Implement feature flags, gradual rollouts, backward-compatible changes, and small, focused pull requests to facilitate easier recovery. Smaller changes are usually easier to understand, test, discuss, and revert.
3. Verify the outcome, not just the implementation. A convincing explanation does not prove that a change works. The change should have evidence demonstrating its expected behavior. The evidence depends on the type of change. For frontend updates, it may include screenshots, recordings, or walkthroughs of affected flows. For business logic, meaningful tests and their results are crucial.
For API integrations, verification of error handling, unexpected responses, and edge cases is important. Additionally, ensure the implementation meets the original acceptance criteria, covers expected user flows, and does not overlook important scenarios. Even well-structured code that passes tests may solve the wrong problem.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.