fix(pr-feed): wire feed_group_id as required input, remove hardcoded group ID

[lml2468]

Summary

Phase 1 of the pr-feed security & maintainability improvement series.

Changes

.github/workflows/octo-pr-feed.yml

• New required input feed_group_id — callers must now pass the feed channel group ID explicitly; the hardcoded value has been removed (intentional breaking change, callers will be updated in Phase 2)
• FEED_GROUP_ID env var wired into the notify step
• Python script: replace send('1c303c14...', feed_msg) with send(feed_gid, feed_msg) where feed_gid = require_env('FEED_GROUP_ID')

Why

The feed group ID (1c303c142e9840f2a9b46c10b0972e8d) was hardcoded in the reusable workflow, making it impossible for callers to override and coupling the central workflow to a specific runtime configuration.

Breaking Change

All caller workflows must add feed_group_id: '1c303c142e9840f2a9b46c10b0972e8d' to their with: block. Phase 2 PR will handle all 8 caller repos simultaneously.

Checklist

• YAML indentation consistent (2-space)
• Python indentation consistent (10-space inline)
• No other files modified
• Diff reviewed and verified

[yujiawei]

Code Review — PR #18 (.github)

Summary

Clean, well-scoped change that externalizes a hardcoded feed group ID into a required workflow input. The approach is consistent with how project_group_id is already handled and improves maintainability.

Findings

✅ Correctness

• Input declaration (feed_group_id, type string, required) is correct YAML.
• Env var wiring (FEED_GROUP_ID: ${{ inputs.feed_group_id }}) follows the established pattern.
• Python side: feed_gid = require_env('FEED_GROUP_ID') + send(feed_gid, feed_msg) correctly replaces the hardcoded call.
• Fail-fast behavior preserved via require_env — callers that forget the input get a clear error at runtime.

✅ Improved ordering

The new code resolves both feed_gid and proj_gid via require_env before any send() call. This is better than the original (which called send with the hardcoded value before resolving proj_gid) — now all validation happens upfront before side effects.

⚠️ Deployment coordination (low risk, informational)

The v1 tag is currently a floating lightweight tag that tracks main (both at 6db6243). All 8 caller repos reference @v1:

uses: Mininglamp-OSS/.github/.github/workflows/octo-pr-feed.yml@v1

If this PR is merged to main and v1 is moved forward before Phase 2 caller updates land, all PR feed notifications will fail with:

ERROR: required environment variable FEED_GROUP_ID is missing or empty

Recommendation: Either (a) hold the v1 tag move until Phase 2 callers are merged, or (b) merge Phase 1 and Phase 2 in a coordinated window. The PR body acknowledges this as intentional — just flagging the operational risk explicitly.

✅ Style / hygiene

• YAML 2-space indentation: consistent.
• Python 10-space inline indentation: consistent.
• Input placed logically after api_base_url (last optional → first new required).
• Env var placed in sensible position within the env block.

Verdict

Approve. The change is correct, minimal, and well-documented. The breaking-change strategy is explicitly acknowledged in the PR body with a clear Phase 2 plan. No code issues found.