From 369edb2afbb70c226da80a762a739e6fe018093a Mon Sep 17 00:00:00 2001
From: Julio Quinteros Pro <jquinter@gmail.com>
Date: Sun, 1 Mar 2026 16:34:10 -0300
Subject: [PATCH] Move all secrets to env blocks instead of direct
 interpolation

Pass AZURE_API_KEY, AZURE_API_BASE, OBSERVATORY_URL,
OBSERVATORY_API_KEY, and REQUEST_ID through step-level env
blocks so they are never interpolated directly into shell scripts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/run_observatory_tests.yml | 28 +++++++++++++--------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/run_observatory_tests.yml b/.github/workflows/run_observatory_tests.yml
index d74a7f1356..25645242fd 100644
--- a/.github/workflows/run_observatory_tests.yml
+++ b/.github/workflows/run_observatory_tests.yml
@@ -49,14 +49,16 @@ jobs:
       - name: Start LiteLLM container
         env:
           TAG: ${{ inputs.tag }}
+          AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
+          AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
         run: |
           docker run -d \
             --name litellm-rc \
             -p 4000:4000 \
-            -v ${{ github.workspace }}/.github/observatory/litellm_config.yaml:/app/config.yaml \
-            -e LITELLM_MASTER_KEY="${{ env.LITELLM_MASTER_KEY }}" \
-            -e AZURE_API_KEY="${{ secrets.AZURE_API_KEY }}" \
-            -e AZURE_API_BASE="${{ secrets.AZURE_API_BASE }}" \
+            -v "${{ github.workspace }}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
+            -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \
+            -e AZURE_API_KEY="${AZURE_API_KEY}" \
+            -e AZURE_API_BASE="${AZURE_API_BASE}" \
             "litellm/litellm:${TAG}" \
             --config /app/config.yaml --port 4000
 
@@ -109,11 +111,13 @@ jobs:
 
       - name: Trigger observatory test run
         id: trigger
+        env:
+          OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }}
+          OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }}
         run: |
-          OBSERVATORY_URL="${{ secrets.OBSERVATORY_URL }}"
           PAYLOAD=$(jq -n \
-            --arg url "${{ env.TUNNEL_URL }}" \
-            --arg key "${{ env.LITELLM_MASTER_KEY }}" \
+            --arg url "${TUNNEL_URL}" \
+            --arg key "${LITELLM_MASTER_KEY}" \
             '{
               deployment_url: $url,
               api_key: $key,
@@ -122,7 +126,7 @@ jobs:
             }')
           RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${OBSERVATORY_URL}/run-test" \
             -H "Content-Type: application/json" \
-            -H "X-LiteLLM-Observatory-API-Key: ${{ secrets.OBSERVATORY_API_KEY }}" \
+            -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}" \
             -d "$PAYLOAD")
           HTTP_CODE=$(echo "$RESPONSE" | tail -1)
           BODY=$(echo "$RESPONSE" | head -n -1)
@@ -143,15 +147,17 @@ jobs:
 
       - name: Poll for test completion
         id: poll
+        env:
+          OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }}
+          OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }}
+          REQUEST_ID: ${{ steps.trigger.outputs.request_id }}
         run: |
-          OBSERVATORY_URL="${{ secrets.OBSERVATORY_URL }}"
-          REQUEST_ID="${{ steps.trigger.outputs.request_id }}"
           TIMEOUT=900  # 15 minutes
           INTERVAL=30
           ELAPSED=0
           while [ $ELAPSED -lt $TIMEOUT ]; do
             STATUS=$(curl -s "${OBSERVATORY_URL}/run-status/${REQUEST_ID}" \
-              -H "X-LiteLLM-Observatory-API-Key: ${{ secrets.OBSERVATORY_API_KEY }}")
+              -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}")
             RUN_STATUS=$(echo "$STATUS" | jq -r '.status')
             echo "Run status (${ELAPSED}s elapsed): $RUN_STATUS"