Github Webhook to AWS API Gateway integrated with SQS Bug? - aws-api-gateway

Question

I have this mostly working. All events sent by Github end up on my SQS Queue. The webhook is sending application/json with "Send me everthing" at the org-level. I'm using the following template mapping in my API Gateway:
Action=SendMessage&MessageBody={
"bodyJson":"$util.base64Encode($util.json('$'))",
"requestId":"$context.requestId",
"resourcePath":"$context.resourcePath",
"apiId":"$context.apiId",
"stage":"$context.stage",
"resourceId":"$context.resourceId",
"path":"$context.path",
"protocol":"$context.protocol",
"requestTimeEpoch":"$context.requestTimeEpoch",
"X-GitHub-Event":"$method.request.header.X-GitHub-Event",
"X-GitHub-Delivery":"$method.request.header.X-GitHub-Delivery",
"X-Hub-Signature":"$method.request.header.X-Hub-Signature"
}
(I've also tried '"bodyJson":"$util.base64Encode($util.body)",')
About 5% of event notifications (of various event types, e.g.: status, push) from Github fail to transform properly. When I go to base64 decode messages from the queue, I get part message/part random junk. Have noticed that resending the same event fails on every retry. (The event looks like well-formed json in the Github UI though.) I'm logging to cloudwatch, but the logs are truncated. So I can't tell how much of the original message gets through. I've also tried setting application/json as a binary media type. That just caused all events to fail on transform and return 500 to Github. Anyone know what I'm doing wrong or if this is a bug?
Update
Need to test a bit more, but think I've figured it out. We need to urlEncode the base64Encoded bodyJson because base64 encoding output includes characters (+ and /) that are not application/x-www-form-urlencoded compatible without being url encoded:
Action=SendMessage&MessageBody={
"bodyJson":"$util.urlEncode($util.base64Encode($input.body))",
"requestId":"$context.requestId",
"resourcePath":"$context.resourcePath",
"apiId":"$context.apiId",
"stage":"$context.stage",
"resourceId":"$context.resourceId",
"path":"$context.path",
"protocol":"$context.protocol",
"requestTimeEpoch":"$context.requestTimeEpoch",
"X-GitHub-Event":"$method.request.header.X-GitHub-Event",
"X-GitHub-Delivery":"$method.request.header.X-GitHub-Delivery",
"X-Hub-Signature":"$method.request.header.X-Hub-Signature"
}