Add delete-existing-comments option

[bertonjulian]

Problem

When using run-every-commit: true, the security review runs on every commit pushed to a PR. However, the comment posting logic skips ALL new comments if any existing security comments are found on the PR:

Found 8 existing security comments, skipping to avoid duplicates

This means:

1. First commit: 8 security findings posted as comments ✓
2. Second commit introduces 2 NEW vulnerabilities: 0 comments posted ✗

The action detects the new issues but refuses to post them because existing comments are present. New vulnerabilities introduced in subsequent commits are silently ignored.

Solution

Adds a new delete-existing-comments input option that deletes existing security comments before posting new ones. This ensures all current findings are posted fresh on each run.

New Input

Input	Description	Default
delete-existing-comments	Delete existing security comments before posting new ones. Ensures no duplicate or stale comments.	false

Usage

- uses: anthropics/claude-code-security-review@main
  with:
    claude-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
    run-every-commit: true
    delete-existing-comments: true  # Recommended when using run-every-commit

Why Optional?

• Default behavior remains unchanged (no breaking change)
• Users can opt-in when using run-every-commit
• Same approach used by reviewdog

What It Does

When enabled:

• Fetches existing PR comments
• Deletes comments matching 🤖 **Security Issue: from bot users
• Posts all new findings fresh

Only security comments from bots are deleted - regular review comments are preserved.

Test plan

• Added unit tests for delete behavior when flag is enabled
• Added unit test to verify no deletion when flag is not set
• Added unit test to verify non-security comments are preserved
• Updated README documentation

🤖 Generated with Claude Code