Landscape of code review in 2024: Challenges and innovations
Rapid advancements in AI, the increasing scale of codebases, and the growing complexity of distributed teams have made code review simultaneously more challenging and more important than ever. As the landscape of eng productivity evolves, IC developers, engineering managers, and executives alike are rethinking what a good review process looks like and adopting tools that help them ship higher-quality code faster.
While code review may look different today than it did just five years ago, it hasn’t outgrown its original purposes: fostering collaboration, reducing technical debt, and maintaining code quality standards. Achieving these outcomes in practice is more difficult than ever before though; today’s teams face challenges like the volume of AI-generated code, the shift towards monorepos, coordination across distributed teams, and an ever-increasing emphasis on security.
What’s getting in the way: Challenges in modern code review
Volume of AI-generated code
AI code generation tools like GitHub Copilot and Cursor are helping developers write more code than ever. While going from idea to code has never been faster, each AI-generated code change still needs to be reviewed and tested properly before it can be shipped. AI coding tools not only generate more PRs to review but also produce code that, while technically correct, may lack optimization for performance or maintainability. For this reason, as well as maintaining human visibility of the codebase, it’s still critical for developers to be involved in the code review process.
Shift to monorepos
Monorepos offer huge advantages to fast-moving companies in terms of visibility, dependency management, and codebase consistency. However, the sheer size and complexity of monorepos at large companies can strain traditional code review tools, making it challenging to efficiently review changes and ensure the right reviewers are assigned.
Scaling across distributed teams
With globally distributed teams, engineers are often left waiting overnight for feedback on their pull requests. GitHub and GitLab were both built with asynchronous workflows in mind, but teams still struggle with balancing notifications, keeping reviews relevant to the right people, and getting authors feedback as quickly as possible across time zones, particularly as they try to ship quickly.
Increasing emphasis on security
Today, code review is about more than just catching bugs. As attackers become increasingly sophisticated, code review is becoming an even more critical line of defense against vulnerabilities, leaked secrets, exposed resources, and more. This means even more cognitive load on reviewers as they try to be conscious of an ever-expanding list of attack vectors.
To address these challenges, many fast-moving eng teams are looking to an exciting wave of new devtools emerging across the pull request lifecycle.
Key trends in code review tooling
AI-powered contextual suggestions
To handle the ever-growing volume of AI-generated code, many teams are turning to AI-powered code review companions. Engineers no longer need to wait for a human reviewer to find minor issues in a PR—they spot them instantly, saving hours of back-and-forth review cycles and giving reviewers time back to focus on the bigger picture. AI code review tools like Graphite Reviewer and Ellipsis are great at catching issues like bugs, typos, and codebase style inconsistencies. Even established security scanning and static analysis tools like SonarQube and Snyk are quickly augmenting their offerings with AI comments and suggested remediations. As the base models improve in the coming years, we expect to see advanced AI review agents and self-healing CI quickly become industry-standard.
Monorepo-specific tooling
To unlock the benefits of monorepos, large enterprises are leveraging specialized tools and workflows. Modern code review tools like Reviewable, CodeApprove, and Graphite offer features designed to handle large-scale repositories, including powerful filtering and search capabilities. Reviewer assignment tools like GitHub's CODEOWNERS or Graphite Automations ensure that every change has the right eyes on it before release. Merge queues like Mergify and Graphite Merge Queue solve the nasty problem of merge conflicts as teams scale to hundreds or thousands of engineers landing changes concurrently. By adopting the right tools, teams can effectively manage code reviews in monorepos without getting bogged down by complexity.
Small, incremental PRs and stacking
Reviewing giant PRs with hundreds of lines is a known headache. Cisco research shows developers struggle to spot defects in reviews with over 400 lines of code. That's why many teams now prefer smaller, frequent pull requests—they're simpler to review, quicker to catch issues, and easier to merge and integrate. The stacked PRs workflow makes small code changes the norm by helping developers break up large changes into small, incremental pull requests. Creating and managing stacked PRs is easy with tools like ghstack, Git Tower, and the Graphite CLI and VS Code extension.
Data-driven insights and review metrics
Code review is finally becoming measurable. Software Engineering Insights (SEI) tools like Graphite Insights, DX, and Jellyfish show review patterns, approval rates, and PR open-to-merge times, which provides teams with a window into their review processes. Armed with this data, teams can identify specific stages where pull requests tend to stall or where reviews lag. By analyzing these trends, teams are better equipped to address and resolve bottlenecks, leading to faster and more effective review times.
What’s next for code review?
The way we build software has changed rapidly in the past five years, creating massive opportunities for new tools that make code review faster, more collaborative, and less stressful. Many of the world’s largest and fastest-moving engineering teams are already reaping major productivity benefits from this wave of new devtools, and it’s only going to get better from here. As LLMs continue to improve rapidly in the coming years, we’ll be able to automate away more and more of the tedium and frustration in the pull request lifecycle, giving developers time back to focus on creating great software.
