┌─────────────────────────────────────────────────────────────────┐
│  Code Reviewer Workflow                                          │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  Phase 1: Code Discovery     → 发现待审查的代码文件              │
│           & Scoping              - 根据语言/框架识别文件          │
│           ↓                      - 设置审查范围和优先级           │
│                                                                  │
│  Phase 2: Security           → 安全漏洞扫描                      │
│           Analysis               - OWASP Top 10 检查             │
│           ↓                      - 常见漏洞模式识别               │
│                                  - 敏感数据泄露检查               │
│                                                                  │
│  Phase 3: Best Practices     → 最佳实践审查                      │
│           Review                 - 代码质量检查                  │
│           ↓                      - 性能优化建议                   │
│                                  - 可维护性评估                  │
│                                                                  │
│  Phase 4: Report             → 生成审查报告                      │
│           Generation             - 按严重程度分类问题             │
│                                  - 提供修复建议和示例             │
│                                  - 生成可追踪的修复清单           │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘

# Review entire codebase
/code-reviewer

# Review specific directory
/code-reviewer --scope src/auth

# Focus on security only
/code-reviewer --focus security

# Focus on best practices only
/code-reviewer --focus best-practices

# Review with custom severity threshold
/code-reviewer --severity critical,high

# Review specific file types
/code-reviewer --languages typescript,python

# Generate detailed report with code snippets
/code-reviewer --report-level detailed

# Resume from previous session
/code-reviewer --resume

{
  "scope": {
    "include": ["src/**/*", "lib/**/*"],
    "exclude": ["**/*.test.ts", "**/*.spec.ts", "**/node_modules/**"]
  },
  "security": {
    "enabled": true,
    "checks": ["owasp-top-10", "cwe-top-25"],
    "severity_threshold": "medium"
  },
  "best_practices": {
    "enabled": true,
    "code_quality": true,
    "performance": true,
    "maintainability": true
  },
  "reporting": {
    "format": "markdown",
    "output_path": ".code-review/",
    "include_snippets": true,
    "include_fixes": true
  }
}

# Code Review Report

## Executive Summary
- Total Issues: 42
- Critical: 3
- High: 8
- Medium: 15
- Low: 16

## Security Findings

### [CRITICAL] SQL Injection in User Query
**File**: src/auth/user-service.ts:145
**Issue**: Unsanitized user input in SQL query
**Fix**: Use parameterized queries

Code Snippet:
\`\`\`typescript
// ❌ Vulnerable
const query = `SELECT * FROM users WHERE username = '${username}'`;

// ✅ Fixed
const query = 'SELECT * FROM users WHERE username = ?';
db.execute(query, [username]);
\`\`\`

## Best Practices Findings

### [MEDIUM] High Cyclomatic Complexity
**File**: src/utils/validator.ts:78
**Issue**: Function has complexity score of 15 (threshold: 10)
**Fix**: Break into smaller functions

...

#!/bin/bash
# .git/hooks/pre-commit

# Run code review on staged files
staged_files=$(git diff --cached --name-only --diff-filter=ACMR)
ccw run code-reviewer --scope "$staged_files" --severity critical,high

if [ $? -ne 0 ]; then
  echo "❌ Code review found critical/high issues. Commit aborted."
  exit 1
fi

# .github/workflows/code-review.yml
name: Code Review
on: [pull_request]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Code Review
        run: |
          ccw run code-reviewer --report-level detailed
          ccw report upload .code-review/report.md

# Review authentication module for security issues
/code-reviewer --scope src/auth --focus security --severity critical,high

# Review API endpoints for performance issues
/code-reviewer --scope src/api --focus best-practices --check performance

# Comprehensive review of entire codebase
/code-reviewer --report-level detailed --output .code-review/audit-2024-01.md

# Review in batches
/code-reviewer --scope src/module-1
/code-reviewer --scope src/module-2 --resume

# Or use parallel execution
/code-reviewer --parallel 4

{
  "suppressions": {
    "security": {
      "sql-injection": {
        "paths": ["src/legacy/**/*"],
        "reason": "Legacy code, scheduled for refactor"
      }
    }
  }
}