ci: 共通アクションでコメント最小化を集約

[dyoshikawa-claw]

概要

• コメント最小化処理を reusable composite action に切り出し
• issue/PR コメント起点ジョブの両方で共通アクションを利用
• 既存のbotコメント最小化対象（opencode-agent, github-actions系）をデフォルトで維持

変更内容

• 追加: .github/actions/minimize-comments/action.yml
  • trigger_comment_node_id がある場合はトリガーコメントを最小化
  • owner/repo/pr_number 指定時はPRレビューコメントとIssueコメントの旧botコメントを最小化
  • bot_logins はカンマ区切りで上書き可能（デフォルトは現行互換）
• 更新: .github/workflows/comment-to-ai.yml
  • handle-issue / handle-pr-comment で新アクションを利用

動作確認

• ローカルでの yamllint は環境に存在せず未実施
• 既存処理の置き換えのみで、挙動は互換を維持

[github-actions]

PR #1282 Review Summary

Overall Mergeability Verdict: Mergeable (No Medium/High/Critical Blockers)

The PR successfully extracts reusable comment minimization logic into a composite action with good code quality and security practices.

---

Code Review Findings

1. Medium - Undocumented Behavior Change

   • Location: .github/actions/minimize-comments/action.yml:31-35
   • The new code catches minimization failures and continues with a warning, which is an improvement over the original (which would fail the entire step). However, this behavior change should be documented.

2. Low - Client-Side Filtering Performance

   • Location: .github/actions/minimize-comments/action.yml:87-93
   • Original filtered server-side via jq select(), new code fetches all comments and filters in bash. Minimal impact for typical PRs.

3. Low - Empty Login Edge Case

   • Location: .github/actions/minimize-comments/action.yml:73-74
   • Checks for empty node_id but not empty login. Could affect deleted accounts.

4. Low - Unrelated Config Change

   • Location: .serena/project.yml:117-120
   • Addition of read_only_memory_patterns: [] appears unrelated to this PR's purpose.

5. Low - Missing Usage Example

   • The action lacks a usage example in its description.

---

Security Review Findings

6. ✅ PASSING - Script Injection Prevention

   • All inputs passed through environment variables, not interpolated into shell commands.

7. ✅ PASSING - GraphQL Injection Prevention

   • Uses parameterized queries via -f id="${COMMENT_NODE_ID}".

8. ✅ PASSING - Secrets Handling

   • GITHUB_TOKEN correctly passed via environment variables.

9. ✅ PASSING - Input Validation

   • Proper validation added for empty inputs (lines 24, 38, 57-60).

10. ✅ PASSING - Error Handling

    • Graceful failure handling with warning messages - an improvement over the original.

11. Informational - Node ID Logged

    • node_id appears in warning logs on failure (not sensitive data).

12. Informational - Configurable Bot Logins

    • bot_logins input is properly sanitized and only used for string comparison, not execution.

---

Summary

Category	Status
Security	✅ Safe (follows best practices)
Code Quality	✅ Acceptable (1 medium documentation issue, several low)

Recommendation: The PR is mergeable. Consider documenting the behavior change (issue #1) either in the PR description or as a follow-up. The low-severity issues are optional improvements.

github run

github run