Appearance
SOP-005: Pull Request Review & Merge
Version: 1.0 · Owner: Developer (reviewer) · Gate: G2
Purpose & scope
Merge code only when automated guardrails pass and a qualified human approves. AI review is advisory unless configured as blocking for specific rules.
Roles
| Role | RACI |
|---|---|
| DEV (author) | R |
| DEV (reviewer) | A — merge decision |
| ARCH | C — when ADR/spec touched |
| CI system | A — objective gates |
Prerequisites
- PR from SOP-004 with template complete
- CI pipeline configured per tier (qa-guardrails.md)
- Linters, formatters, and static analyzers defined per Linters & static analysis
Procedure
Author
- Push branch; ensure all CI checks triggered.
- Request reviewer (not self for T1/T2).
- Address AI review comments: fix or document dismiss reason in PR thread.
Reviewer
- Verify traceability — Spec link, ADR IDs, ticket ID present.
- AI review — Read Bugbot/CodeGuru summary; validate high-severity findings.
- Human spot-check — Focus: error handling, auth, idempotency, test quality (not manual test execution).
- Contract alignment — Spot-check that tests reference OpenAPI operation IDs.
- Approve — Only when all required CI checks green (see checklist below).
Merge
- Squash or merge per team convention; delete branch.
- Release pipeline triggered → SOP-006.
Required CI checks (minimum)
See Linters & static analysis for tool options. Checklist:
| Check | T1 | T2 | T3 |
|---|---|---|---|
| Format + lint + types | ✓ | ✓ | ✓ |
| Unit tests | ✓ | ✓ | ✓ |
| Contract tests | ✓ | ✓ | ✓ |
| Integration | ✓ | ✓ | optional |
| E2E | ✓ | ✓ | optional |
| SAST + SCA | ✓ | ✓ | ✓ |
| Secret scan | ✓ | ✓ | ✓ |
| OPA policy | ✓ | ✓ | ✓ |
| AI diff review | ✓ | ✓ | advisory |
| 1 human approval | ✓ | ✓ | ✓ |
| ARCH approval (ADR/spec change) | ✓ | if touched | if touched |
Definition of Done
- [ ] All required checks green
- [ ] ≥ 1 human approval
- [ ] No unresolved Critical/High security findings
- [ ] Merged to
main
SLA & escalation
| Milestone | SLA |
|---|---|
| First review | ≤ 1 business day |
| Author response to feedback | ≤ 1 business day |
Escalation: review stale > 2 days → EM assigns reviewer.