Code review / audit checklist

Here's a handy checklist: https://github.com/mgreiler/code-review-checklist

When reviewing a code base, here’s what I search for:

(See my review docs, PRs, package.json’s)

## JavaScript
- setTimeout usage

## CI
See CI issue
[Preview deployments](https://twitter.com/housecor/status/1757033736355315975)

## Source control

What files are the longest?
What files are changed the most? (See Gary Burhardt's https://github.com/garybernhardt/dotfiles)
Which file do you like best?
Which is worst?

## Devops

https://dora.dev/research/

## Clean up
[Clean up first](https://twitter.com/housecor/status/1662422150588911618)
[Signs a team is out of control](https://twitter.com/housecor/status/1660657066531336195)

## Package manager
Consider [pnpm](https://pnpm.io/) or Bun.
Consider [Corepack](https://nodejs.org/api/corepack.html)

## Code reuse
https://github.com/kucherenko/jscpd - Find copy/pasted code
See #5 for more on reusable components

## Dependencies
depcheck or Knip (listed under TypeScript too) - And [be sure Knip ignores test folder so code only referenced by tests is found](https://x.com/housecor/status/1857452829939483135).
Check for updates
Suggest alternative packages

## Deploys
[Notifying stale SPA users](https://twitter.com/housecor/status/1669722918392156162)

## Formatting
Prettier, running via editor and enforced via CI

## Hooks
Using pre-push instead of pre-commit
Hook is fast
Hook should be redundant - CI = real safety
[Avoiding useEffect](https://twitter.com/housecor/status/1664982936381267971)

## APIs
Return camelCased JSON
[Handle saving stale records and protect from overrwrites](https://twitter.com/housecor/status/1667149221651177473)

## HTTP
Centralized URLs (for reuse in APIs and mocks)

## Env
Wrapped, strongly typed, Zod validated env vars

## Folders
Mirrors URL structure
Colocates related files
[No barrels](https://github.com/christianvuerings/eslint-plugin-no-re-export#references). [my tweet thread](https://twitter.com/housecor/status/1730993597862780976)

## File structure
Mirror URL structure
Consistently cased
Colocating related items
Using [Dependency Cruiser](https://github.com/sverweij/dependency-cruiser) to validate and enforce intra-project file dependencies.

## TypeScript
Use [knip](https://github.com/webpro/knip) or Ts-prune to find unused code and run via CI to protect (something similar for other types of code like CSS?
Eliminate `any` - Use [type-coverage](https://github.com/plantain-00/type-coverage) - to report type coverage
Avoid optional fields
Avoid type assertions via “as” (again, can find via type-coverage)
Use string literals instead of string
Replace string | number with number
Don't use 0 or "" for missing numbers
[Force TS Version](https://stackoverflow.com/questions/74642723/how-do-i-force-visual-studio-code-to-always-use-my-workspaces-version-of-typesc)
[Prefer Record over switch](https://twitter.com/housecor/status/1742531006744195329)
See TypeScript issue for more

## URL
Does the URL support deep links for sharing when relevant?
Is data from the URL copied into state?
[more here](https://twitter.com/housecor/status/1667206997513519112)

## HTML
disabled
main

## General
Cpell

## Accessibility

See a11y repo

## State
Caching fetch calls

## CI
Runs build, test, lint
At least one approval is required
PRs aren’t being rubber stamped
No Lint warnings are allowed
Use [Danger](https://danger.systems/js/) to enforce ad-hoc checks list a Changelog entry

## ESLint
eslint-disable
Unused imports and vars
No var
Prefer const
Running associated package for each tech

## React
index
Audit useEffect
No needless state

## Forms
Validation onBlur
Does it reflect latest data if user comes back? (easy mistake to make with react-query as mentioned [here](https://tkdodo.eu/blog/react-query-and-forms))
[What if you try saving stale data that someone else already changed](https://twitter.com/housecor/status/1667149221651177473)?
Dirty notifcation when leaving