3 Layers of Code Review on Next.js + TypeScript: I Cut Human Review Time From 4h to 25min per PR

A developer cut human code review time from four hours to 25 minutes per pull request by implementing a three-layer review system on a Next.js 15 + TypeScript + Prisma project. The layers use Biome and husky for mechanical checks, CodeRabbit and Copilot for pattern-level review, and the developer for design and business rule decisions. The developer found that 70% of their review comments could have been automated.

I was spending about four hours per pull request on review. Not on hard PRs — on all of them. Prisma model tweak? Half an hour of comments about naming. Server Action refactor? An hour of "hey, missing use client " back-and-forth. New Repository class? Ninety minutes because I was reading through 12 similar files to double-check the pattern. I ran a small audit on my own comments across a month. About 70% of what I wrote could have been said by a tool. Types, naming, format, "you forgot a test", "don't use any ". Only 30% touched actual design decisions. So I split review into three layers, wired them up on a Next.js 15 + TypeScript + Prisma project, and the human portion dropped to about 25 minutes per PR. Below are the actual configs. Layer 1: Biome + husky pre-commit, pre-push — mechanical Layer 2: CodeRabbit + Copilot on PR open — pattern-level Layer 3: Me — design + business rule Each layer has an explicit job. Layer 1 refuses to let mechanical noise reach Layer 2. Layer 2 refuses to let pattern-level noise reach Layer 3. Layer 3 only fires when the diff has already survived the first two. That's the whole idea. The rest is config files. Before any config: the file all three layers point to. AGENTS.md Project Next.js 15 + TypeScript + Prisma + PostgreSQL Architecture - App Router Server Component default - Repository Pattern data access via Prisma - Service layer business logic - Result<T, E for error handling — do not throw Code Direction Increase: - Repository Pattern → src/repositories/ -repository.ts - Result<T, E → src/types/result.ts - Data fetching inside Server Components - Prisma.select for narrow column lists Decrease: - any use unknown - Business logic in Route Handlers - throw for control flow - Client Component fetching unless SWR/React Query - Files over 300 lines Review Policy - Conventional Comments syntax - Approval bar: codebase health improves = approve - First-response SLA: 24h CodeRabbit reads this. Copilot reads this. I read this. All three layers converge on the same taste. // biome.json { "formatter": { "indentStyle": "space", "indentWidth": 2 }, "linter": { "rules": { "recommended": true, "suspicious": { "noExplicitAny": "error" }, "complexity": { "noForEach": "warn" } } }, "organizeImports": { "enabled": true } } // package.json excerpt { "scripts": { "check": "biome check .", "fix": "biome check --apply .", "test": "vitest run", "type-check": "tsc --noEmit" }, "lint-staged": { " .{ts,tsx,json}": "biome check --apply" } } npx husky init echo "npx lint-staged" .husky/pre-commit echo "npm run test && npm run type-check" .husky/pre-push What this catches before a PR is even opened: any any , unformatted code, broken imports, failing tests, TypeScript errors. If it fails, the commit doesn't land. Nothing about this reaches Layer 2 or Layer 3. Biome vs. Prettier + ESLint: Biome is one binary and roughly 10× faster on this project's lint step. The Next.js 15 flat-config transition made ESLint plugins painful enough to justify the move; your mileage may vary if you have deep custom ESLint rules. .coderabbit.yaml language: en reviews: profile: default auto review: enabled: true drafts: false path instructions: - path: "src/app/ " instructions: "Server Component is the default. Minimize 'use client'." - path: "src/repositories/ " instructions: "Repository Pattern via Prisma. No raw SQL." - path: "src/services/ " instructions: "Business logic. Return Result<T, E , do not throw." - path: " " instructions: | Follow AGENTS.md Code Direction. Use Conventional Comments — issue: for anti-patterns, praise: for pattern hits. path filters: - " / .lock" - " /node modules/ " - " /.next/ " request changes workflow: enabled: true chat: auto reply: true CodeRabbit reads AGENTS.md, catches the Next.js 15 specifics I forget — treating params as sync in a page component, non-serializable props crossing an RSC boundary, use client inside a component that could have stayed on the server. Copilot's PR review runs in parallel on architectural sanity and catches different classes of miss. Running both is not redundant. They disagree often enough that the disagreement itself is signal — when both flag the same line, it's usually real. When only one flags it, I look but don't automatically act. The path instructions block is what makes this layer stop being generic. Without those per-directory rules, CodeRabbit just gives you the same generic "consider adding tests" comment 40 times per PR. By the time a PR opens for my eyes, three things are already true: biome check , vitest , and tsc are green Layer 1 So the only things left are: That's it. That's what 25 minutes covers. | Before | After | | |---|---|---| | Layer 1 comments I wrote by hand | ~15/PR | 0 | | Layer 2 pattern comments I wrote | ~8/PR | 1–2 backing up the AI when it was right | | Layer 3 design/business comments | ~5/PR | 4–5 same as before — this is the work | Total time per PR | ~4h | ~25min | The Layer 3 number barely moved. That's the point. The work that requires me is unchanged. What disappeared is the work that never required me in the first place. Honest failure modes I've hit: merge without reading. That's the trap. If nothing else, read the diff shape and confirm the The whole system is only worth it if Layer 3 stays honest. Do not add all three layers on the same day. That was my first mistake — dropping Biome, husky, CodeRabbit, and new AGENTS.md rules into the repo in one PR broke everyone's workflow for a week. Order that worked: AGENTS.md only. No enforcement. Team reads it, comments on it. path instructions based on what CodeRabbit gets wrong.Same reason you don't put 100kg on the bar on day one: the layers work because the team adapts to each one before the next lands. One AI reviewer looking at your whole diff is doing every layer's job at once, which means it's doing none of them well. The trick is not a smarter model. The trick is that Layer 1 is deterministic, Layer 2 is opinionated, Layer 3 is judgment — and none of them are allowed to pretend to be the others. The full playbook — including CodeRabbit rule tuning, Copilot integration, when to escalate to Claude Code review, and the parts I got wrong twice — is here: Code Review Harness — the 3-layer setup, tuning guide, and the anti-patterns each layer misses https://kenimoto.dev/books/harness-code-review?utm source=devto&utm medium=article&utm campaign=nextjs-3-layer-review