[Octo-Q · automated review]

Verdict: Request changes — blocking findings below (data-flow traced).

octo-version-sync PR#29 Review Report

Reviewer: Octo-Q (automated review)
Head SHA: c9c86e4
PR: #29
State: MERGED (admin-merged, 2026-06-27T07:47:57Z)

1. Summary

This PR adds enable_im_notify: false to the reusable workflow call in .github/workflows/octo-issue-feed.yml, intending to opt out of IM push notifications while keeping the triage webhook active. It is backed by Mininglamp-OSS/.github#80, which adds the enable_im_notify input to the reusable workflow octo-issue-notify.yml.

2. Findings

F1 — P1: enable_im_notify input not defined at @v1 tag (workflow will fail or silently ignore the opt-out)

Diff-scope: new (introduced by this PR — the input line is the only substantive addition).

Evidence:

The caller references Mininglamp-OSS/.github/.github/workflows/octo-issue-notify.yml@v1 (line 11 of the file). The v1 tag points to commit 135e280f842d85a7da56dd226189843fb115cb33 (June 9, 2026):

v1  → 135e280f (2026-06-09)
v1.1.2 → 135e280f (same)

PR .github#80, which adds the enable_im_notify input, was merged to main on June 27 at commit 8ade879f9480347f6719b132a87f27bde71b6a9b. The v1 tag was never bumped to include this commit.

I verified the full contents of octo-issue-notify.yml at the v1 ref. The workflow_call.inputs block declares: repo_name, issue_number, issue_title, issue_url, issue_author, event_action, api_base_url, feed_group_id. enable_im_notify is absent.

Impact: The caller passes enable_im_notify: false to a reusable workflow that does not declare this input. Per GitHub Actions behavior, passing an undeclared input to a workflow_call workflow causes a validation error. The Octo Issue Feed workflow will fail to run on every issues: opened/reopened event in this repo, meaning:

• No IM notification is sent (but for the wrong reason — workflow crash, not intentional opt-out)
• No triage webhook fires either (the entire job is blocked)

This is a production-visible regression: new issues in octo-version-sync will no longer trigger any notification or triage.

Fix: The v1 tag in Mininglamp-OSS/.github must be fast-forwarded to 8ade879f (or later) before this caller PR takes effect. Alternatively, the caller should reference @main or a specific SHA until the tag is bumped.

F2 — P2: Missing newline at end of file

Diff-scope: new (this PR removes the trailing newline).

The diff removes the final \n from .github/workflows/octo-issue-feed.yml. POSIX text files should end with a newline. Minor style issue, easily fixed.

3. Data Flow Trace

Caller (octo-issue-feed.yml)
  │
  ├─ passes enable_im_notify: false
  │    └─→ reusable workflow @v1 does NOT declare this input
  │         └─→ GitHub Actions: undefined input → validation error / ignored
  │
  ├─ passes TRIAGE_WEBHOOK_URL (secret)
  │    └─→ reusable workflow @v1 declares this ✓
  │
  └─ passes other inputs (repo_name, issue_number, etc.)
       └─→ all declared at v1 ✓

The enable_im_notify data never reaches the reusable workflow's input validation because it is not declared there.

4. Blind Spot Checklist (R5)

• C1 — Double-path parity: N/A (no symmetric add/remove paths touched).
• C2 — Control-flow ordering / reuse: N/A (single workflow invocation, no nested control flow).
• C3 — Authorization boundary: N/A (no permission/capability changes).
• C4 — Authorization lifecycle: N/A.
• C5 — Build ≠ runtime: HIT. The YAML is syntactically valid and would pass any static lint check, but at GitHub Actions runtime the undeclared input causes a functional failure. This is the classic "build green, runtime broken" pattern — the workflow file validates as YAML but fails at the GitHub Actions input-validation step.
• C6 — Governance/policy doc consistency: N/A.

5. Suggested Fixes

1. Blocker: Bump the v1 tag in Mininglamp-OSS/.github to commit 8ade879f (the merge commit of PR #80) or later. This is a cross-repo dependency that must be resolved before this PR's change takes effect.
2. Add trailing newline to octo-issue-feed.yml.
3. Consider adding a CI check or documentation that enforces tag-bump discipline when reusable workflow inputs change — this class of bug (caller uses new input before callee tag is bumped) is recurrent in multi-repo workflow setups.

6. Additional Observations

The PR body says "Admin-merged" and "Backed by Mininglamp-OSS/.github#80" — the backing change was indeed merged first (07:23:41Z vs 07:47:57Z), but the tag bump was missed. This suggests the merge process for reusable workflow changes needs a tag-bump step in the release checklist.

[Octo-Q] verdict: REQUEST_CHANGES — P1 (F1): enable_im_notify input is not defined at the referenced @v1 tag, causing the Octo Issue Feed workflow to fail on every issue event. The v1 tag must be bumped to include .github#80 before this caller change can function.

The PR is relevant to this repository’s issue triage workflow, but the new reusable-workflow input appears incompatible with the pinned workflow version.

🔴 Blocking

• 🔴 Critical — .github/workflows/octo-issue-feed.yml:19 passes enable_im_notify: false to Mininglamp-OSS/.github/.github/workflows/octo-issue-notify.yml@v1, but the currently referenced @v1 reusable workflow contract does not define an enable_im_notify input. GitHub rejects unknown inputs for workflow_call, so this workflow can fail before triage runs. Either update/retag the v1 reusable workflow to include that boolean input, or pin this caller to a ref that already contains the new input.

💬 Non-blocking

• 🔵 Suggestion — .github/workflows/octo-issue-feed.yml:22 has no trailing newline after the edit. Add the newline to avoid avoidable style noise.

✅ Highlights

• The change is correctly scoped to repository automation and matches the stated goal of webhook-only issue triage once the reusable workflow contract is available at the pinned ref.

Code Review — PR #29 (octo-version-sync)

Summary

This PR opts the octo-issue-feed workflow into webhook-only triage by passing enable_im_notify: false to the shared reusable workflow Mininglamp-OSS/.github/.github/workflows/octo-issue-notify.yml@v1. The intent is correct and desirable, but as written the change will not work and will break the notify workflow at runtime.

Spec / Intent compliance — ❌

The stated goal ("opt into webhook-only triage") is not actually achieved by this diff at the pinned ref.

• The PR body states the change is "Backed by Mininglamp-OSS/.github#80. Admin-merged." PR #80 did merge — but to main (commit 8ade879), and the major tag this caller pins, @v1, still points to 135e280, which is 3 commits behind main.
• The enable_im_notify input is therefore not present at @v1, nor at any released tag:
  • @v1 (135e280) — input absent
  • v1.1.2, v1.1.1, v1.1.0, v1.0.0 — input absent
  • only main (8ade879, the #80 merge) declares it.

Blocking finding — P0 (runtime break)

File: .github/workflows/octo-issue-feed.yml line 19

uses: Mininglamp-OSS/.github/.github/workflows/octo-issue-notify.yml@v1
with:
  ...
  enable_im_notify: false   # <-- not a declared input at @v1

A reusable workflow only accepts inputs declared under its workflow_call.inputs. Passing an input that the referenced ref does not declare is a hard validation error ("Invalid input, enable_im_notify is not defined in the referenced workflow"), and the calling job fails.

Because @v1 does not (yet) declare enable_im_notify, the next issues: opened/reopened event will fail the notify job instead of skipping the IM push. So this PR does not merely fail to disable IM — it breaks the feed entirely until the ref dependency is resolved.

How to fix (any one)

1. Move the v1 major tag to include PR #80 (i.e. re-point v1 to 8ade879 / cut a new v1.x.y that contains the input and have v1 track it), so @v1 resolves to code that declares enable_im_notify. This is the cleanest fix if v1 is a maintained moving major tag — and is required regardless, since other callers on @v1 expect the documented input surface.
2. Or pin this caller to a ref that actually contains the input (e.g. a freshly cut @v1.2.0, or a commit SHA @8ade879...). Pinning to a SHA is the most reproducible option.

Until the pinned ref contains the input, this change should not ship. Recommend verifying with one real (or workflow_dispatch-equivalent) run after re-pinning.

Minor (P2 / nit)

• The file now ends without a trailing newline (\ No newline at end of file on the last TRIAGE_WEBHOOK_URL line). Re-add the trailing newline to keep POSIX-clean YAML and avoid a spurious one-line churn on the next edit.

Coverage note

• Verified the reusable workflow input surface at @v1 and at tags v1.0.0–v1.1.2 and main via the GitHub contents API; confirmed enable_im_notify exists only on main.
• Confirmed v1 (135e280) is 3 commits behind main (compare v1...main → ahead 3, behind 0).
• The composite-action contract referenced by #80 (empty im-message ⇒ skip IM push) was not independently re-validated here; it is internal to the reusable workflow and out of this caller's scope, but it only matters once the input is reachable.

Verdict

CHANGES_REQUESTED — the feature does not work at the pinned @v1 ref and breaks the notify job on the next issue event. Re-point/re-pin to a ref that declares enable_im_notify, then this is a clean one-line opt-in.