Harden project GraphQL lookups by replacing interpolated owner inputs with variableized requests

[Copilot]

Code scanning flagged pkg/cli/project_command.go for GraphQL injection risk: owner-scoped queries were assembled through CLI field interpolation, relying on manual escaping. This change moves those paths to parameterized GraphQL variables carried in JSON request bodies.

• Owner lookup/query execution path

  • Added a shared helper to execute GraphQL with JSON {query, variables} via gh api graphql --input -.
  • Switched validateOwner, getOwnerNodeId, and getStatusField to use variableized payloads for user-controlled values (login, number) instead of inline/interpolated arguments.

• Security posture improvement

  • Removed reliance on argument-level interpolation for these lookup queries.
  • Ensures user input is data-bound in variables, not embedded into GraphQL text.

• Focused test updates

  • Updated project command tests to assert:
    • query strings use $login / $number
    • user-controlled values are present only under variables
    • calls route through --input - with expected --jq behavior.

requestBody := map[string]any{
  "query": `query($login: String!) { organization(login: $login) { id } }`,
  "variables": map[string]any{
    "login": owner,
  },
}

• Fixes [uk-ai-resilience] [gov-scan] GraphQL injection risk via fmt.Sprintf in project_command.go (alerts #651, #652) #51126

---

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⊞ 8.4K · ◷
_{Comment /souschef to run again}

---

Run context: https://github.com/github/gh-aw/actions/runs/31206913072> Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⊞ 8.4K · ◷

_{Comment /souschef to run again}

[github-actions]

Hey @Copilot 👋 — thanks for the security fix! This PR addresses the GraphQL injection risk in pkg/cli/project_command.go by replacing fmt.Sprintf with parameterized GraphQL variables, exactly as recommended in issue #51126.

What looks great:

• ✓ Single, focused security fix — replacing manual string escaping with safe GraphQL variables
• ✓ Test coverage included — 60 lines of test additions for the changed query path
• ✓ Clear description with checklist tracking progress
• ✓ References the underlying issue ([uk-ai-resilience] [gov-scan] GraphQL injection risk via fmt.Sprintf in project_command.go (alerts #651, #652) #51126) for full context

The fix is aligned with the contributing guidelines for agentic development and follows the project's security-first approach. The changes are minimal and targeted — exactly what a security remediation should look like.

Once you're ready to exit draft status and complete the final validation steps (make agent-report-progress, code review, CodeQL), this should be good to merge. Well done! 🎯

Generated by ✅ Contribution Check · auto · 84.8 AIC · ⊞ 8.7K · ◷

[Copilot]

Pull request overview

Hardens project GraphQL lookups by sending user-controlled values as JSON variables instead of CLI field arguments.

Changes:

• Adds a shared variableized GraphQL request helper.
• Migrates owner and status-field lookups.
• Updates tests to verify query separation, variable types, and CLI arguments.

Show a summary per file

File	Description
pkg/cli/project_command.go	Uses JSON GraphQL variables for project lookups.
pkg/cli/project_command_test.go	Validates request bodies and invocation arguments.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if possible, and run the pr-finisher skill before handing back to maintainers.

Failed checks to inspect:

• impacted-go-tests: https://github.com/github/gh-aw/actions/runs/31202459752/job/92946080405
• Unit tests (D-L): https://github.com/github/gh-aw/actions/runs/31202459752/job/92946537349

Run context: https://github.com/github/gh-aw/actions/runs/31204567664

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 10.2 AIC · ⊞ 8.4K · ◷
_{Comment /souschef to run again}

[github-actions]

Triage Result

Category: bug (security hardening) · Risk: medium · Priority: high (score 74/100 — impact 30, urgency 26, quality 18)
Recommended action: fast_track

Notes: Addresses a code-scanning GraphQL injection finding by parameterizing queries — security-relevant, prioritize review. CI: Unit tests (D-L) is currently failing; other jobs pass. AI reviewer left comments. Needs the D-L failure resolved (see #51151) before merge.

Generated by 🔧 PR Triage Agent · auto · 31.2 AIC · ⌖ 2.44 AIC · ⊞ 7.9K · ◷

[gh-aw-bot]

@copilot Please triage this PR, refresh the branch if GitHub can update it cleanly, inspect the failing checks below, and run the pr-finisher skill before handing back to maintainers.

Failed checks to inspect:

• impacted-go-tests: https://github.com/github/gh-aw/actions/runs/31205118296/job/92956797548
• Unit tests (D-L): https://github.com/github/gh-aw/actions/runs/31205118296/job/92957200545

This security hardening change appears blocked by the same D-L failure tracked by #51151. Please confirm whether this branch only needs a refresh/retest after that fix lands, or whether additional branch-local changes are needed.

Run context: https://github.com/github/gh-aw/actions/runs/31206913072

Generated by 👨‍🍳 PR Sous Chef · gpt54 · 13 AIC · ⊞ 8.4K · ◷
_{Comment /souschef to run again}

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.86.1