exp(stick-minimize)

[mmiermans]

Sticky-review strategy test. Do not merge.

[github-actions]

🤖 Claude has reviewed this PR — expand after forming your own opinion

Summary

Reworks the Claude PR-review workflow and adds a small experimental JS helper. The new "minimize superseded reviews" step is logically sound (keeps the newest marked comment, minimizes the rest). A few things worth a look:

.github/workflows/claude-review.yml

• Prompt-injection posture weakened. The previous config documented two mitigations that are now gone: include_comments_by_actor: "mmiermans" and the deliberate exclusion of gh pr view. The replacement prompt still feeds untrusted gh pr diff output (attacker-controllable in any PR) to the model while granting Bash(gh pr comment:*) write access. The diff is a valid injection vector on its own, so dropping the inline note doesn't remove the risk — consider keeping a comment explaining the residual exposure, or sandboxing accordingly.
• id-token: write removed, issues: write added. Consistent with the switch from OIDC App auth to anthropic_api_key + github.token, and issues: write is what gh pr comment / minimizeComment need. Looks correct.
• Minimize step bash is safe at the edges. for ((i=0; i<n-1; i++)) is a no-op for n = 0 or 1 (no underflow), so empty/single-comment cases are handled.
• if: always() on the minimize step. Because of cancel-in-progress, a cancelled run can still execute this step and minimize comments concurrently with a newer run. Low impact, but a minor race.

webclient/resources/js/exp-stick-minimize.js

• pct(part, total) has no guard for total === 0 (returns Infinity/NaN) — the inline comment already flags this. Also, the file appears unused/experimental; confirm it's intended to be committed rather than left as scratch.