fix: validate runDuration timestamps and truncate attached binary error fields (IN-1170)

Addresses PR review: guard computeRunDuration against missing or
unparseable timestamps so NaN/negative durations don't reach the DB,
and attach truncated stdout/stderr on rejected binary errors so
Temporal payloads stay within serialization limits.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Joana Maia <jmaia@contractor.linuxfoundation.org>

Author: joanagmaia

services/apps/security_best_practices_worker/src/activities/index.ts

@@ -150,9 +150,7 @@ export async function saveOSPSBaselineInsightsToDB(
       )
     }
     for (const assessment of evaluation['assessment-logs']) {
-      const runDuration = assessment.end
-        ? `${new Date(assessment.end).getTime() - new Date(assessment.start).getTime()}ms`
-        : ''
+      const runDuration = computeRunDuration(assessment.start, assessment.end)
       await addControlEvaluationAssessment(qx, {
         applicability: assessment.applicability,
         description: assessment.description,
@@ -193,6 +191,14 @@ export async function saveOSPSBaselineInsightsToRedis(
   await redisCache.set(key, JSON.stringify(insights), 60 * 60 * 24) // 1 day
 }
 
+function computeRunDuration(start: string | undefined, end: string | undefined): string {
+  if (!start || !end) return ''
+  const startMs = new Date(start).getTime()
+  const endMs = new Date(end).getTime()
+  if (isNaN(startMs) || isNaN(endMs) || endMs < startMs) return ''
+  return `${endMs - startMs}ms`
+}
+
 async function cleanupFiles(repoName: string): Promise<void> {
   // Delete the file
   try {
@@ -247,11 +253,13 @@ async function runBinary(
         resolve({ stdout, stderr })
       } else {
         const truncated = (s: string) => (s.length > 500 ? s.slice(0, 500) + '…' : s)
+        const truncStdout = truncated(stdout)
+        const truncStderr = truncated(stderr)
         const err = Object.assign(
           new Error(
-            `Binary exited with code ${code}\nStderr:\n${truncated(stderr)}\nStdout:\n${truncated(stdout)}`,
+            `Binary exited with code ${code}\nStderr:\n${truncStderr}\nStdout:\n${truncStdout}`,
           ),
-          { stdout, stderr },
+          { stdout: truncStdout, stderr: truncStderr },
         )
         reject(err)
       }