exp(checkrun): deliver Claude review as a Check Run

.github/workflows/claude-review.yml

@@ -1,39 +1,32 @@
 name: Claude PR Review
 on:
   pull_request:
-
-# Cancel in-progress reviews for the same PR when a new push arrives.
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
-
 jobs:
   claude-review:
     name: Claude PR Review
     runs-on: ubuntu-latest
-
-    # Prevent running on fork PRs where secrets are unavailable
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
-
     permissions:
       contents: read
       pull-requests: write
-      id-token: write # OIDC token for Claude GitHub App auth
-
+      issues: write
+      checks: write
     steps:
       - uses: actions/checkout@v4
-
       - uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: "/review"
-          # Pre-loads full PR context and shows a progress tracker.
-          track_progress: true
-          # Only include comments from trusted team members in Claude's context (prompt injection mitigation).
-          include_comments_by_actor: "mmiermans"
-          # Update the same comment on each push instead of creating new ones.
-          use_sticky_comment: true
-          # Inline code comments, PR comments, reading PR diffs, and git log for commit messages.
-          # gh pr view is excluded to prevent Claude from fetching PR comments (prompt injection risk).
+          github_token: ${{ github.token }}
+          prompt: |
+            You are an automated code reviewer for pull request #${{ github.event.pull_request.number }} in ${{ github.repository }}.
+            1. Read changes: gh pr diff ${{ github.event.pull_request.number }}
+            2. Get the head sha: gh pr view ${{ github.event.pull_request.number }} --json headRefOid -q .headRefOid
+            3. Deliver your review as a GitHub CHECK RUN (which appears in the Checks tab / Files-changed tab, NOT in the conversation timeline). Do NOT post any conversation comment. Write the review markdown to a file and create the check run with the GitHub REST API, e.g.:
+               gh api -X POST repos/${{ github.repository }}/check-runs -f name="Claude Review" -f head_sha=<sha> -f status=completed -f conclusion=neutral -f "output[title]=Claude review" -F "output[summary]=@<file>"
+               (Adjust flags as needed; -F reads the summary from a file.)
+            RULES: NO conversation comment at all. No approve/request-changes. No AI attribution. If the default github_token cannot create check runs, capture the exact error and report it (that is a valid finding).
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(git log:*)"
+            --allowedTools "Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api:*)"

webclient/resources/js/exp-checkrun.js

@@ -0,0 +1,7 @@
+// Helper added to exercise the Claude review action.
+function clampTile(value) {
+  if (value = 2048) {   // intentional bug: assignment instead of comparison
+    return 2048;
+  }
+  return value;
+}