CodeGraph combines quality and security findings for an explicit Git diff, staged changes, or a file list. A professional reviewer uses the findings to make the decision, while repository protection rules enforce the merge policy.
Choose one review scope
Compare the working tree with a base ref:
python -m src.cli review --base-ref origin/main --format markdown
Review staged changes:
python -m src.cli review --staged --format json --output-file <report.json>
Review named files:
python -m src.cli review --files <file-one> <file-two> --format sarif --sarif-file <report.sarif>
The current choices are --format {markdown,json,sarif}. Use python -m src.cli review --help
to verify flags for the installed release.
Read the result
- Confirm the base/target revision and actual changed files.
- Check each finding’s source location, category, severity, and rationale.
- Separate a candidate from a verified defect; reproduce high-impact findings.
- Record false positives and unresolved evidence gaps.
- Run the repository’s own tests and policy checks before deciding.
--no-security deliberately removes a review dimension and must be visible in evidence. Command
success proves that the operational review ran, not that the change satisfies product acceptance.
Recovery
- Empty diff: verify the base ref, staged state, and file selectors.
- Stale project evidence: refresh the project before accepting graph-backed findings.
- Unsupported output: check live
--helpand use an available format. - Timeout or partial result: preserve warnings and rerun only after correcting the cause or narrowing the scope.
Contract sources
src/cli/analysis_commands/review_command.py— parser and review options;src/review/pipeline.py— unified review orchestration;src/review/models.py— result contract;docs/guides/en/CODE_REVIEW_HOOKS.md— hook automation boundaries.