Claude AI workflows overwrite each other's PR comments (rollback-safety clobbers the code review)

[sfreudenthaler]

Problem

On a PR that triggers more than one Claude workflow, the later workflow overwrites the earlier one's comment. Example: PR #36759 comment — the Rollback-Safety verdict replaced the AI code review in the same comment.

Edit history of that single comment proves it:

time	run	content
20:10:08	Claude AI Orchestrator (30301039985)	"Claude Code is working…" (creates comment)
20:11:23	same	Code Review: PR #36759
20:12:17	Claude AI Rollback Safety Check (30301040015)	reset to "Claude Code is working…" — code review gone
20:13:50	same	Rollback-Safety Analysis

Root cause

anthropics/claude-code-action@v1 with use_sticky_comment: true looks up the comment to reuse with no per-workflow marker — src/github/operations/comments/create-initial.ts matches any comment whose author is the Claude app bot (user.id === 209825114, or any Bot login containing "claude") and takes the first one:

const existingComment = comments.data.find((comment) => {
  const idMatch = comment.user?.id === CLAUDE_APP_BOT_ID;
  const botNameMatch = comment.user?.type === "Bot" && comment.user?.login.toLowerCase().includes("claude");
  ...
});

So every workflow on the Anthropic path shares one "sticky" comment per PR. dotCMS/core runs three Claude commenters on pull_request: ai_claude-orchestrator.yml (code review, sticky by design), ai_claude-rollback-safety.yml, and ai_claude-backend-reviewer.yml. The Bedrock/Codex paths in ai-workflows already namespace their markers (sticky_namespace → <!-- dotcms-ai-review:v3:<ns> -->); the Anthropic path has no equivalent.

Fix

Only one workflow per PR should own an action-managed comment.

1. dotCMS/ai-workflows: plumb track_progress through claude-orchestrator.yml → claude-executor.yml (currently hardcoded "true").
2. dotCMS/core: set track_progress: false on rollback-safety and backend-reviewer. Neither needs the progress comment — rollback-safety posts its own comment only when a change is unsafe (plus a label), and the backend reviewer upserts its own <!-- dotcms-backend-review --> marker comment. The code-review orchestrator keeps the sticky comment.

[github-actions]

PRs linked to this issue

• fix(ci): stop Claude AI workflows overwriting each other's PR comment by @sfreudenthaler