Automated Code Review

What is the purpose of the Article?

You will understand how automatic code review takes place when creating a merge request
You will understand how to implement this in your repository.

Audience

Software Development Engineers

Introduction

Ensuring your project’s code stays simple, readable and easy to contribute to can be problematic. With the help of GitLab CI/CD, you can analyze your source code quality using GitLab Code Quality.

Code Quality Widget

Going a step further, GitLab can show the Code Quality report right in the merge request widget area if a report from the target branch is available to compare to:

See also the Code Climate list of Supported Languages for Maintainability.

Use cases

For instance, consider the following workflow:

Your backend team member starts a new implementation for making a certain feature in your app faster.
With Code Quality reports, they analyze how their implementation is impacting the code quality.
The metrics show that their code degrades the quality by 10 points.
You ask a co-worker to help them with this modification.
They both work on the changes until Code Quality report displays no degradations, only improvements.
You approve the merge request and authorize its deployment.
Once verified, their changes are deployed to production.

Example configuration

This example shows how to run Code Quality on your code by using GitLab CI/CD.

Include the Code Quality template in your CI configuration:

include:
  - template: Code-Quality.gitlab-ci.yml

The above example will create a code_quality job in your CI/CD pipeline which will scan your source code for code quality issues. The report will be saved as a Code Quality report artifact that you can later download and analyze.

By default, report artifacts are not downloadable. If you need them downloadable on the job details page, you can add gl-code-quality-report.json to the artifact paths like so:

include:
  - template: Code-Quality.gitlab-ci.yml

code_quality:
  artifacts:
    paths: [gl-code-quality-report.json]

The included code_quality job is running in the test stage, so it needs to be included in your CI configuration, like so:

stages:
  - test

Tip: This information will be automatically extracted and shown right in the merge request widget.

Disabling the code quality job

The code_quality job will not run if the $CODE_QUALITY_DISABLED environment variable is present.

To disable the code_quality job, add CODE_QUALITY_DISABLED as a custom environment variable. This can be done:

For the whole project, in the project settings or CI/CD configuration.
For a single pipeline run:
1. Go to CI/CD > Pipelines
2. Click Run Pipeline
3. Add CODE_QUALITY_DISABLED as the variable key, with any value.

Using with merge request pipelines

The configuration provided by the Code Quality template does not let the code_quality job run on pipelines for merge requests.

If pipelines for merge requests is enabled, the code_quality:rules must be redefined.

The template has these rules for the code quality job:

code_quality:
  rules:
    - if: '$CODE_QUALITY_DISABLED'
      when: never
    - if: '$CI_COMMIT_TAG || $CI_COMMIT_BRANCH'

If you are using merge request pipelines, your rules (or workflow: rules) might look like this example:

job1:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' # Run job1 in merge request pipelines
    - if: '$CI_COMMIT_BRANCH == "master"'                # Run job1 in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_TAG'                               # Run job1 in pipelines for tags

To make these work together, you will need to overwrite the code quality rules so that they match your current rules. From the example above, it could look like:

include:
  - template: Code-Quality.gitlab-ci.yml

code_quality:
  rules:
    - if: '$CODE_QUALITY_DISABLED'
      when: never
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"' # Run code quality job in merge request pipelines
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'      # Run code quality job in pipelines on the master branch (but not in other branch pipelines)
    - if: '$CI_COMMIT_TAG'                               # Run code quality job in pipelines for tags

Code Quality reports

Once the Code Quality job has been completed:

The full list of code quality violations generated by a pipeline is shown in the Code Quality tab of the Pipeline Details page.
Potential changes to code quality are shown directly in the merge request. The Code Quality widget in the merge request compares the reports from the base and head of the branch, then lists any violations that will be resolved or created when the branch is merged.
The full JSON report is available as a downloadable artifact for the code_quality job.

Extending functionality

Using Analysis Plugins

Should there be a need to extend the default functionality provided by Code Quality, as stated in Code Quality, Analysis Plugins are available.

For example, to use the SonarJava analyzer, add a file named .codeclimate.yml containing the enablement code for the plugin to the root of your repository:

version: "2"
plugins:
  sonar-java:
    enabled: true

This adds SonarJava to the plugins: section of the default .codeclimate.yml included in your project.

Changes to the plugins: section do not affect the exclude_patterns section of the defeault .codeclimate.yml. See the Code Climate documentation for excluding files and folders for more details.

Here’s an example project that uses Code Quality with a .codeclimate.yml file.