exp(stick-structured)

[mmiermans]

Sticky-review strategy test. Do not merge.

[github-actions]

🤖 Claude has reviewed this PR — expand after forming your own opinion

Summary

Reworks the Claude PR-review workflow to produce a single structured comment_body and post/update one sticky comment via a manual shell step, and adds a small JS helper (exp-stick-structured.js).

Findings

Workflow (.github/workflows/claude-review.yml)

• Comment lookup is unpaginated (likely duplicate comments). The sticky-comment search

  gh api repos/$REPO/issues/$PR/comments --jq '...'

  fetches only the first page (default 30 comments). On a PR with more than 30 comments, the existing <!-- claude-review --> comment won't be found, so a new comment is created on every push instead of updating in place — defeating the "single sticky comment" goal. Add --paginate to the gh api call.

• Prompt-injection surface changed. The previous config used include_comments_by_actor: "mmiermans" to keep untrusted comments out of context. The new prompt feeds the raw PR diff (gh pr diff) — author-controlled, untrusted content — to the model. Blast radius is limited (only Bash(gh pr diff:*) is allowed and output is constrained to comment_body), so worst case is manipulated review text rather than code execution. Worth a comment noting this is an accepted, bounded risk.

• issues: write looks redundant. pull-requests: write already covers creating/editing issue comments on a PR. Harmless, but minor over-grant — consider dropping it.

• Good: passing structured_output through an env var (SO) rather than inline ${{ }} interpolation into the shell avoids shell-injection from the model output; the structured_output != '' guard and --json-schema constraint are nice.

JS helper (webclient/resources/js/exp-stick-structured.js)

• Division-by-zero / dead code. pct(part, total) returns Infinity/NaN when total === 0 — the inline comment even flags the missing guard. The function is also unused, declared as a global (no module export), and named like an experiment (exp-stick-...). This looks like debugging/experiment leftover that probably shouldn't be merged. If it's intentional, add the guard (return total === 0 ? 0 : (part / total) * 100;) and wire it in / export it.

Style (non-blocking)

• The workflow's explanatory comments were stripped (e.g. the notes on cancel-in-progress, fork-PR guard, and tool allowlist rationale). They were useful context for future maintainers; consider keeping a few.

Verdict

No critical bugs, but two things to address before merge: the unpaginated comment lookup (functional regression risk) and the exp-stick-structured.js experiment file (dead code + div-by-zero). The injection-surface change is acceptable given the tool/output constraints but worth acknowledging.