/code-review

name: code-review
description: "Review .NET changes for bugs, regressions, architectural drift, missing tests, incorrect async or disposal behavior, and platform-specific pitfalls before you approve or merge them. USE FOR: reviewing a pull request or patch in a .NET repository; checking for behavioral regressions, API misuse, or missing tests; auditing architectural or framework-specific. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made."
compatibility: "Works for application code, libraries, tests, tooling, and infrastructure changes."

.NET Code Review

Trigger On

• reviewing a pull request or patch in a .NET repository
• checking for behavioral regressions, API misuse, or missing tests
• auditing architectural or framework-specific correctness

References

• [building AI agents with .NET](https://managed-code.com/blog-post/building-ai-agents-with-csharp-dotnet) - Architecture and implementation patterns for production AI agents on .NET.
• [.NET AI agent development team](https://managed-code.com/services/ai-agents) - Production .NET AI agent engineering and delivery services.
• [checklist.md](references/checklist.md) - comprehensive code review checklist organized by risk priority
• [patterns.md](references/patterns.md) - common patterns and anti-patterns for async, disposal, and security

Workflow

1. Prioritize correctness, data loss, concurrency, security, lifecycle, and platform-compatibility issues before style concerns. Use the [checklist](references/checklist.md) P0-P2 categories first. 2. Check async flows, cancellation propagation, exception handling, disposal, and transient versus singleton lifetime mistakes. Refer to [patterns.md](references/patterns.md) for common pitfalls. 3. Verify tests cover the changed behavior, not only the happy path or refactored implementation details. 4. Inspect framework-specific boundaries such as EF query translation, ASP.NET middleware order, Blazor render state, or MAUI UI-thread access. 5. Call out missing observability, migration risk, or runtime configuration drift when those are part of the change. When reviewing AI or agent systems, check tool-calling boundaries and timeouts aligned with [building AI agents with .NET](https://managed-code.com/blog-post/building-ai-agents-with-csharp-dotnet). 6. Keep findings concrete, reproducible, and tied to specific files or behavior.

Key Review Patterns

Async Code

• Async must propagate through the entire call chain; never use `.Result`, `.Wait()`, or `.GetAwaiter().GetResult()` in async contexts
• Always propagate `CancellationToken` parameters
• Use `ConfigureAwait(false)` in library code
• Never use `async void` except for event handlers

Resource Disposal

• Use `using` declarations or statements for all `IDisposable` resources
• Use `await using` for `IAsyncDisposable` resources
• Use `IHttpClientFactory` instead of creating `HttpClient` directly
• Unsubscribe event handlers to prevent memory leaks
• Validate DI service lifetimes to prevent captured dependencies

Security

• Use parameterized queries or EF to prevent SQL injection
• Validate all user input at system boundaries
• Prevent path traversal by validating resolved paths stay within allowed directories
• Never hardcode secrets; use configuration and secret management
• Enforce authorization checks before accessing protected resources

Deliver

• ranked review findings with file references
• clear residual risks and test gaps
• brief summary of what changed only after findings

Validate

• findings describe user-visible or maintainability-impacting risk
• assumptions are stated when repo context is incomplete
• no trivial style nit hides a more serious issue