From 44ac50493e76f8b035df2537a71d96e36eaba139 Mon Sep 17 00:00:00 2001
From: Yassin Kortam <yassin@berri.ai>
Date: Wed, 10 Jun 2026 20:03:24 -0700
Subject: [PATCH] ci(auth_v2): run the proxy auth_v2 suite with xmlsec1 in the
 proxy-auth shard

The proxy/auth_v2 tests were not picked up by any shard because the proxy-auth path list matched the literal proxy/auth directory, not its sibling. Add the path and install xmlsec1 so the pysaml2 signing tests run rather than skip; the install is gated behind a new optional apt-packages input so the other shards are unchanged.
---
 .github/workflows/_test-unit-base.yml      | 11 +++++++++++
 .github/workflows/test-unit-proxy-auth.yml |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/_test-unit-base.yml b/.github/workflows/_test-unit-base.yml
index a42b2f8f9df..e40007e8807 100644
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@@ -36,6 +36,11 @@ on:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: true
         type: string
+      apt-packages:
+        description: "Optional space-separated apt packages installed before dependencies (e.g. xmlsec1 libxmlsec1-dev for the SAML signing tests)"
+        required: false
+        type: string
+        default: ""
 
 permissions:
   contents: read
@@ -71,6 +76,12 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-uv-
 
+      - name: Install system packages
+        if: ${{ inputs.apt-packages != '' }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends ${{ inputs.apt-packages }}
+
       - name: Install dependencies
         run: |
           uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
diff --git a/.github/workflows/test-unit-proxy-auth.yml b/.github/workflows/test-unit-proxy-auth.yml
index 99882066a8e..a0b6233d7a0 100644
--- a/.github/workflows/test-unit-proxy-auth.yml
+++ b/.github/workflows/test-unit-proxy-auth.yml
@@ -21,7 +21,8 @@ jobs:
   proxy-auth:
     uses: ./.github/workflows/_test-unit-base.yml
     with:
-      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/auth_v2 tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      apt-packages: "xmlsec1 libxmlsec1-dev"
       workers: 2
       reruns: 2
       artifact-name: proxy-auth