In general, to fix this class of problem you add an explicit permissions: block either at the workflow root (applies to all jobs) or under the specific job, granting only the scopes actually required. For a pure linting workflow that just checks out the repository and runs local commands, contents: read is typically sufficient, since no job step needs to modify repository contents, issues, PRs, or other resources via the GITHUB_TOKEN.

For this specific file, the minimal, non-disruptive fix is to add a permissions: block at the top level of the workflow (right after name: and before on:) and set contents: read. This will apply to the run-linters job (and any future jobs that don’t override permissions) and document that the workflow only needs read access to repository contents. No other code changes, imports, or new methods are required.

Concretely:

• Edit .github/workflows/linting.yml.
• Insert:

permissions:
  contents: read

after line 1 (name: Lint) and before the on: block.
No additional YAML keys or dependencies are needed.

In general, the fix is to declare an explicit permissions block that grants only the minimal required permissions to the GITHUB_TOKEN. This can be defined at the workflow root (applies to all jobs) or within the specific job. Since CodeQL flags the job, adding permissions under jobs.sentry-release is clear and minimally invasive.

The single best fix here is to add a permissions section under the sentry-release job with contents: read, which is the minimal starting point suggested by CodeQL and is sufficient for typical use of actions/checkout and external actions that don’t need to push back to the repo or modify GitHub resources. No imports or other definitions are needed; we only modify the YAML in .github/workflows/sentry.yml by inserting the permissions block directly under the job definition, keeping indentation consistent:

• In .github/workflows/sentry.yml, under:
  • jobs:
  • sentry-release:
    • name: Create Sentry Release
    • runs-on: ubuntu-latest
• Insert:
  • permissions:
    • contents: read

This will constrain the GITHUB_TOKEN for that job to read-only repository contents.

In general, to fix log injection issues, sanitize any user-controlled data before including it in log messages. For plain-text logs, a minimal, safe approach is to strip carriage-return and newline characters from user input before logging. You can also clearly delimit or label user input in the log entry. This prevents an attacker from injecting extra log lines while preserving the information value of the logs.

For this specific case, the best minimal fix without changing functionality is to sanitize event.body just for logging, leaving the actual event.body unchanged for parsing with JSON.parse. We will introduce a local variable safeBodyForLog that is derived from event.body with \r and \n removed (using String.prototype.replace and a regular expression). The console.log call will then log safeBodyForLog instead of the raw event.body. No changes are made to how the search works or how the body is parsed.

Concretely in hub-search-proxy/handler.js:

• Around line 53, replace console.log(\Received query: ${event.body}`);` with:
  • A new constant safeBodyForLog defined as (event.body || '').toString().replace(/[\r\n]/g, '').
  • A console.log that uses safeBodyForLog.
• No new imports or external libraries are required; we rely only on built-in string methods and regex.