Anatomy of a Review
The findings, severities, comments and checks that make up every review.
Every review is made of findings with severities, a summary, and checks that report the outcome on your code host.
What a review covers#
| Area | What it looks at |
|---|---|
| Code review | Bugs, logic errors, and problems against your team's conventions. |
| Security | Vulnerabilities and unsafe patterns. See Security Review. |
| Acceptance | Only when Jira is connected: whether the change does what its linked ticket asks. See Jira. |
Solemly double-checks its findings before posting them, so what reaches your pull request is the issues it's confident about.
Severities#
Each finding has one of these severities:
| Severity | Meaning |
|---|---|
CRITICAL | Must be fixed: a serious bug, data loss or an exploitable security issue. |
HIGH | Should be fixed before merging. |
MEDIUM | Worth fixing. |
LOW | Minor. |
NIT | Style nitpicks. Dropped by default, so they don't reach your pull request. |
CRITICAL and HIGH are the high-severity findings that can block a merge. See Merge Gates.
What's posted#
On GitHub#
One native pull request review:
- The review body is the summary: what the change does and the overall verdict, or No issues found.
- Inline comments on the changed lines, one per finding, each with its severity. Where a fix is short and clear, the comment includes a suggested change you can apply in one click.
- Findings that aren't on a changed line are listed in the summary under Not on a changed line.
On GitLab and Bitbucket#
One note (GitLab) or comment (Bitbucket) per review, with the summary followed by every finding and its file, line and severity. Inline comments aren't available on these hosts yet.
The footer#
Every review ends with a line like Solemly AI review · commit abc1234, showing which commit was reviewed. It also says deep review when agentic review was used, and context truncated when the change was very large.
The checks#
Solemly reports each part of the review as its own check run (GitHub), commit status (GitLab) or build status (Bitbucket):
| Check | Reports |
|---|---|
Solemly / Review | The review: complete, or blocking when high-severity findings are found and the repository blocks on them. |
Solemly / Security | The security review. |
Solemly / Acceptance | The Jira acceptance check, when Jira is connected. |
Solemly / Summary | Whether a PR summary was written. |
Make Solemly / Review a required check to use it as a merge gate. See Merge Gates.
Something missing or unclear? Tell us.