How to Set Up a Code Review Workflow in GitHub
Code review is the single highest-leverage quality practice a team can adopt, but a poorly configured workflow turns it into a bottleneck that slows delivery and frustrates engineers. The goal is not to review every line — it is to catch architectural mistakes, logic errors, and knowledge gaps while keeping cycle time under 24 hours from PR open to merge.
GitHub provides the infrastructure for effective code reviews — branch protection, required reviewers, CODEOWNERS, review templates, and status checks — but most teams only use half of it. This guide covers the full setup: from branch protection rules through CODEOWNERS routing to review conventions that make feedback actionable and keep PRs moving.
Step-by-step guide
Configure branch protection rules for the main branch
Navigate to Settings > Branches > Branch protection rules and create a rule for your main branch. Enable 'Require pull request reviews before merging' and set the required approvals to one (for teams under ten) or two (for larger teams). Enable 'Dismiss stale reviews when new commits are pushed' so approved PRs require re-review after changes.
- Go to Settings > Branches > Add rule, pattern: 'main'
- Check 'Require a pull request before merging' with required approvals set to 1 or 2
- Enable 'Dismiss stale pull request approvals when new commits are pushed'
Create a CODEOWNERS file for automatic reviewer assignment
Add a CODEOWNERS file in the root or .github/ directory that maps file paths to responsible teams or individuals. When a PR modifies files matching a pattern, GitHub automatically requests reviews from the listed owners. This ensures domain experts review changes to their area without the PR author needing to manually tag people.
- Create .github/CODEOWNERS with path-to-team mappings (e.g., '/src/billing/ @billing-team')
- Use team handles rather than individual usernames for resilience against attrition
- Add a catch-all rule at the top: '* @your-org/engineering' as a fallback
Set up a pull request template
Create a .github/pull_request_template.md file that prompts the PR author to fill in: Summary (what changed and why), Test Plan (how it was verified), Screenshots (for UI changes), and Breaking Changes. A good template reduces reviewer questions by 50% because the context is right there in the PR description.
- Create .github/pull_request_template.md with markdown sections
- Include a checkbox checklist for common requirements (tests added, docs updated, migration needed)
- Keep the template under 20 lines — long templates get deleted, not filled in
Establish review response time expectations
Document a team agreement: initial review response within 4 business hours, full review within 24 hours. Track this by looking at the time between PR opened and first review comment in your GitHub metrics. Without an explicit SLA, PRs sit for days and developers context-switch to other work, increasing rework when review comments finally arrive.
- Add the response time expectation to your team's CONTRIBUTING.md
- Set up a Slack reminder or GitHub Action that pings reviewers after 4 hours of inactivity
- Track the 'time to first review' metric monthly and discuss trends in retrospectives
Define review comment conventions
Establish a comment prefix system: 'nit:' for non-blocking style suggestions, 'question:' for requests for clarification, 'issue:' for blocking concerns that must be addressed, and 'suggestion:' for optional improvements. This lets the PR author triage comments and focus on blocking issues first. Without prefixes, every comment feels equally urgent.
- Document the prefix conventions in CONTRIBUTING.md with examples
- Agree that 'nit:' comments never block merge approval
- Encourage using GitHub's 'suggestion' feature for single-line changes so authors can commit with one click
Configure required status checks to pair with reviews
In your branch protection settings, require CI status checks (tests, lint) to pass before merge. This means reviewers can focus on logic and architecture rather than catching syntax errors and test failures that automation handles better. The combination of human review and automated checks covers both the subjective and objective quality dimensions.
- In branch protection, enable 'Require status checks to pass before merging'
- Select your CI workflow jobs (lint, test, build) as required checks
- Enable 'Require branches to be up to date' so the PR is tested against the latest main
Common mistakes
Requiring too many approvals and creating a bottleneck
Three required approvals on a team of six means half the team must review every PR. This creates queues, increases cycle time, and frustrates everyone. One approval is sufficient for most teams — two for critical paths (infra, security, billing). Use CODEOWNERS for domain routing instead of blanket approval counts.
Not dismissing stale reviews after new commits
If a reviewer approves a PR and the author then pushes significant changes, the approval is stale — it covers code the reviewer never saw. Always enable 'Dismiss stale reviews' in branch protection. It adds a small overhead of re-approval but catches the case where approved PRs are modified before merge.
Treating code review as a gate rather than a conversation
Review is not a pass/fail exam. If a reviewer leaves ten blocking comments and walks away, the PR author is stuck doing rework in isolation. Reviews should be conversations — leave a comment, get a response, discuss alternatives in a thread. The fastest reviews involve the reviewer and author talking in real time.
Reviewing huge PRs that should have been split
A 2,000-line PR cannot be reviewed effectively — research shows review quality drops sharply above 400 lines changed. Encourage small, focused PRs. If a large PR lands, the reviewer should request it be split rather than attempting a superficial review that misses real issues.
Tips
Use GitHub's 'Suggested Changes' feature to propose exact code edits — the author can accept them with a single click, which is faster than describing the change in prose.
Create a 'Review Roulette' GitHub Action that randomly assigns reviewers from the CODEOWNERS pool, distributing the review load evenly.
Enable 'Auto-merge' for PRs that have passed all checks and received required approvals — it eliminates the 'merge when green' wait.
Run a monthly review health check: look at average time-to-first-review, PR size distribution, and comment-to-approval ratio to spot process issues early.
How Vantage helps
Vantage's GitHub integration reads your CODEOWNERS file and PR history to understand team ownership boundaries. When generating tickets from a PRD, it automatically tags the relevant code owners and structures tasks to align with your repository's ownership model, reducing PR routing friction.