From a2946e2cc80373a20fcfbc0f6caf3cd999a24bb1 Mon Sep 17 00:00:00 2001
From: Julio Quinteros Pro <jquinter@gmail.com>
Date: Sun, 1 Mar 2026 15:20:01 -0300
Subject: [PATCH] Add job timeout and use jq for safe JSON construction

- Add timeout-minutes: 30 to prevent runaway jobs
- Build /run-test payload with jq --arg to safely escape
  TUNNEL_URL and LITELLM_MASTER_KEY values

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/run_observatory_tests.yml | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/run_observatory_tests.yml b/.github/workflows/run_observatory_tests.yml
index b6f6e9f19d..f11e46665a 100644
--- a/.github/workflows/run_observatory_tests.yml
+++ b/.github/workflows/run_observatory_tests.yml
@@ -30,6 +30,7 @@ env:
 jobs:
   observatory-tests:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -99,15 +100,19 @@ jobs:
         id: trigger
         run: |
           OBSERVATORY_URL="${{ secrets.OBSERVATORY_URL }}"
+          PAYLOAD=$(jq -n \
+            --arg url "${{ env.TUNNEL_URL }}" \
+            --arg key "${{ env.LITELLM_MASTER_KEY }}" \
+            '{
+              deployment_url: $url,
+              api_key: $key,
+              test_suite: "TestOAIAzureRelease",
+              models: ["gpt-4o-mini", "gpt-4o"]
+            }')
           RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${OBSERVATORY_URL}/run-test" \
             -H "Content-Type: application/json" \
             -H "X-LiteLLM-Observatory-API-Key: ${{ secrets.OBSERVATORY_API_KEY }}" \
-            -d '{
-              "deployment_url": "${{ env.TUNNEL_URL }}",
-              "api_key": "${{ env.LITELLM_MASTER_KEY }}",
-              "test_suite": "TestOAIAzureRelease",
-              "models": ["gpt-4o-mini", "gpt-4o"]
-            }')
+            -d "$PAYLOAD")
           HTTP_CODE=$(echo "$RESPONSE" | tail -1)
           BODY=$(echo "$RESPONSE" | head -n -1)
           echo "Response ($HTTP_CODE): $BODY"