From 174f7a1ab730a68d1fe3c0c75ce86d47a99fb519 Mon Sep 17 00:00:00 2001
From: joereyna <joseph.reyna@gmail.com>
Date: Wed, 1 Apr 2026 14:13:37 -0700
Subject: [PATCH] Fix coverage artifact naming, job mismatch, and OIDC
 permissions in base workflows

---
 .github/workflows/_test-unit-base.yml                   | 8 ++++++--
 .github/workflows/_test-unit-services-base.yml          | 2 +-
 .github/workflows/test-unit-caching-redis.yml           | 2 ++
 .github/workflows/test-unit-core-utils.yml              | 3 +++
 .github/workflows/test-unit-enterprise-routing.yml      | 3 +++
 .github/workflows/test-unit-integrations.yml            | 3 +++
 .github/workflows/test-unit-llm-providers.yml           | 4 ++++
 .github/workflows/test-unit-misc.yml                    | 3 +++
 .github/workflows/test-unit-proxy-auth.yml              | 3 +++
 .github/workflows/test-unit-proxy-db.yml                | 2 ++
 .github/workflows/test-unit-proxy-endpoints.yml         | 3 +++
 .github/workflows/test-unit-proxy-infra.yml             | 3 +++
 .github/workflows/test-unit-responses-caching-types.yml | 3 +++
 .github/workflows/test-unit-security.yml                | 2 ++
 14 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/_test-unit-base.yml b/.github/workflows/_test-unit-base.yml
index 9579861fe6f..39cc96dcf85 100644
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@@ -27,6 +27,10 @@ on:
         required: false
         type: number
         default: 10
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -102,7 +106,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
-          name: coverage-${{ github.run_id }}-${{ github.run_attempt }}
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: coverage.xml
           retention-days: 1
 
@@ -123,7 +127,7 @@ jobs:
       - name: Download coverage report
         uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
         with:
-          pattern: coverage-${{ github.run_id }}-${{ github.run_attempt }}
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: coverage-reports
           merge-multiple: true
 
diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index f74e4e2fc6a..17d7ad759fb 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -194,7 +194,7 @@ jobs:
       - name: Download coverage report
         uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
         with:
-          pattern: coverage-${{ github.job }}-${{ github.run_id }}-${{ github.run_attempt }}
+          pattern: coverage-run-${{ github.run_id }}-${{ github.run_attempt }}
           path: coverage-reports
           merge-multiple: true
 
diff --git a/.github/workflows/test-unit-caching-redis.yml b/.github/workflows/test-unit-caching-redis.yml
index ca274324f2f..eb4bf734539 100644
--- a/.github/workflows/test-unit-caching-redis.yml
+++ b/.github/workflows/test-unit-caching-redis.yml
@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/test-unit-core-utils.yml b/.github/workflows/test-unit-core-utils.yml
index 2f3698fdf60..9696cea5616 100644
--- a/.github/workflows/test-unit-core-utils.yml
+++ b/.github/workflows/test-unit-core-utils.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,3 +20,4 @@ jobs:
       test-path: "tests/test_litellm/litellm_core_utils"
       workers: 2
       reruns: 1
+      artifact-name: core-utils
diff --git a/.github/workflows/test-unit-enterprise-routing.yml b/.github/workflows/test-unit-enterprise-routing.yml
index 13ae3efedba..986de119535 100644
--- a/.github/workflows/test-unit-enterprise-routing.yml
+++ b/.github/workflows/test-unit-enterprise-routing.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -22,3 +24,4 @@ jobs:
         tests/test_litellm/router_strategy
       workers: 2
       reruns: 2
+      artifact-name: enterprise-routing
diff --git a/.github/workflows/test-unit-integrations.yml b/.github/workflows/test-unit-integrations.yml
index 2789f99d81c..e73c09d6cd8 100644
--- a/.github/workflows/test-unit-integrations.yml
+++ b/.github/workflows/test-unit-integrations.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,3 +20,4 @@ jobs:
       test-path: "tests/test_litellm/integrations"
       workers: 2
       reruns: 3
+      artifact-name: integrations
diff --git a/.github/workflows/test-unit-llm-providers.yml b/.github/workflows/test-unit-llm-providers.yml
index 6c00272b0c8..93ffa263212 100644
--- a/.github/workflows/test-unit-llm-providers.yml
+++ b/.github/workflows/test-unit-llm-providers.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -19,6 +21,7 @@ jobs:
       test-path: "tests/test_litellm/llms/vertex_ai"
       workers: 1
       reruns: 2
+      artifact-name: llm-vertex-ai
 
   other-providers:
     name: All Other Providers
@@ -27,3 +30,4 @@ jobs:
       test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
       workers: 2
       reruns: 2
+      artifact-name: llm-other-providers
diff --git a/.github/workflows/test-unit-misc.yml b/.github/workflows/test-unit-misc.yml
index 9228decd7cc..e44133867e6 100644
--- a/.github/workflows/test-unit-misc.yml
+++ b/.github/workflows/test-unit-misc.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -29,3 +31,4 @@ jobs:
         tests/test_litellm/test_*.py
       workers: 2
       reruns: 2
+      artifact-name: misc
diff --git a/.github/workflows/test-unit-proxy-auth.yml b/.github/workflows/test-unit-proxy-auth.yml
index e71821db701..5e427a39f35 100644
--- a/.github/workflows/test-unit-proxy-auth.yml
+++ b/.github/workflows/test-unit-proxy-auth.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,3 +20,4 @@ jobs:
       test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
       workers: 2
       reruns: 2
+      artifact-name: proxy-auth
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index bdfb6efeef1..09ced37dd20 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/test-unit-proxy-endpoints.yml b/.github/workflows/test-unit-proxy-endpoints.yml
index caff3b3ae06..67d35ef794e 100644
--- a/.github/workflows/test-unit-proxy-endpoints.yml
+++ b/.github/workflows/test-unit-proxy-endpoints.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -33,3 +35,4 @@ jobs:
         tests/test_litellm/proxy/ui_crud_endpoints
       workers: 2
       reruns: 2
+      artifact-name: proxy-endpoints
diff --git a/.github/workflows/test-unit-proxy-infra.yml b/.github/workflows/test-unit-proxy-infra.yml
index 4dfbbe317ed..56801569345 100644
--- a/.github/workflows/test-unit-proxy-infra.yml
+++ b/.github/workflows/test-unit-proxy-infra.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -26,3 +28,4 @@ jobs:
         tests/test_litellm/proxy/test_*.py
       workers: 2
       reruns: 2
+      artifact-name: proxy-infra
diff --git a/.github/workflows/test-unit-responses-caching-types.yml b/.github/workflows/test-unit-responses-caching-types.yml
index 7f3acac2803..771a695a70c 100644
--- a/.github/workflows/test-unit-responses-caching-types.yml
+++ b/.github/workflows/test-unit-responses-caching-types.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,3 +20,4 @@ jobs:
       test-path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
       workers: 2
       reruns: 2
+      artifact-name: responses-caching-types
diff --git a/.github/workflows/test-unit-security.yml b/.github/workflows/test-unit-security.yml
index b38c82b1c24..bb6c0c834ec 100644
--- a/.github/workflows/test-unit-security.yml
+++ b/.github/workflows/test-unit-security.yml
@@ -7,6 +7,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}