How to complete a Power Automate code review with AutoReview

I wrote here why I think code reviews are so important for Power Automate, but how exactly do you do a code review. My original approach was to open the flow and look, though this can be a pain as you either have to have the flow shared with you, or all the connections (like SharePoint) shared and an export.

While developing in Blue Prism my company provide a great Code Review tool called RoboReview. It is an automated tool that checks for the basics, like naming conventions and possible infinite loops. So for code Power Automate I wanted something similar but couldn't find one, so I decided to make my own called AutoReview. Its a free Chrome Extension that extracts key data and makes a report to review.

So I now do all my code reviews with AutoReview, using 3 of its main functions.

Review

The Review page scores the flow, with either a Red, Amber or Green score. This gives you an instant view, as anything red needs some work. After the overall score I look at the following.

4 Score Cards

Complexity and Actions let me know the flow might be hard to read. If they are red then it tells me the flow is either built inefficiently, has to many connections or should be structured as multiple flows.

Built inefficiently

• Check Variables - you don't need variables very often, see here
• Check Composes - again should be used very rarely, see here

To many connections

• Check Connection references - having multiple connections can be security issues and high counts of them often shows poor flow planning

Should be structured as multiple flows

• Filter nested in actions to '|' - high levels are good indicator that should be split into childflows

• Review Diagram - high number of branches is another flag for child flows

The Exception card lets me know if any exception handling has taken place in the flow, if this is red then for me this is an instant fail. Also the exception tag lets me know if there is an over arching exception catch for the flow, another one of my key requirements.

Trigger

A quick look to see if there are lots of inputs for buttons and if triggers are broken with environment change (By selecting a folder as a trigger in Get Email the folder Id is selected, meaning it wont work with different account. The folder name should be shown, see here)

Variables

For variables I look at a few things, starting with the if they follow the naming convention to ensure readability. Next are they being used (if a lot filter by field). Finally are variables with a value constantans, I filter the Action Inputs table by the variable name to see if any action changes the variable.

Actions

For each action I check name explains what it does and the action it is, I also look at run after, any that are not just 'Success' I review in Diagram to make sure logic is right.

Actions Inputs

If solution aware flow I filter actions to see if environment variables are used, if not I would flag as this will impact ALM.

I also look over the inputs just to see nothing is hardcoded and the expressions make sense.

API Actions

Using the filter I find actions with no pagination and check if action returns array - see here why pagination is important.

I also Check retry, if left blank I check to see if action is in a loop, as this should be handled as exception - unless there's a good reason, which should be in the action note.

Exceptions

All exceptions should include fail and timeout, so I make sure that if its just fail there is a reason.
For consistency I check for Scope named Exception running after another scope named Main, as this will ensure all of the flow is covered by exception handling. Read here for exception handling.

Diagram

As you have seen I use both Review and Diagram at same time, but there are a few things I just look for in the diagram

• Check loops have required exception handling
• Check any loops within loops are necessary
• Exception catches handle exception with communication and terminate to show run failed

Solutions

If the export is a solution (and they really should be) I check
the contents of the solution making sure its named right and everything necessary.
I check the Connection references, does every connection use a reference, are there unnecessary duplicates.

Finally I look for any missing dependencies as these will stop he deployment.

And that's pretty much it, I obvious keep my eyes out for any obvious bugs but the above covers nearly everything.

To use it simply add the extension from the Chrome Store or Edge Store