title: Everyone on my team mutes the AI code review within two weeks
- 发布
- 09/05 12:01
- 收录
- 09/05 15:00
- 来源类型
- 开发者社区
- 档位
- 社区
- 信源状态
- 同步延迟
讨论趋势
百分比基于采集到的讨论信号，不代表新增评论数或独立参与人数。曲线仅用于同一话题在不同时段的比较。
一位开发者讲述了他们的团队如何在两周内就将AI代码审查工具coderabbit静音。一位新团队成员对一个40行拉取请求上的大量评论表示疑问，并被告知只需解决它们即可。这种做法导致了一个严重的安全漏洞——一个没有身份验证检查的端点——在生产环境中存在了六天，尽管该机器人已在15条评论中的第9条中标记了它。最终，客户在团队之前发现了这个漏洞。
We got a new guy in July. His second week he messages me, why does my 40 line PR have 15 comments from coderabbit, do I have to do all of these. And I told him what everyone tells the new guy, just click resolve, nobody reads that thing.
Last Thursday one of the ones he resolved was real. New endpoint, no auth check, the bot said so in comment 9 of 15, and it sat in prod for six days until a customer found it. The postmortem has a line that says "the review tool flagged it" and that line is going to follow me around for a while.
I'm not even mad at the bot. It was right and we trained the whole team to ignore it, me included, because the other 14 comments were rename this and consider a docstring.
So now I have a team that doesn't read the bot, a bot that was right once, and a customer who found it before we did.