From c2f40e89d52346cb3edda4a11adc99eb1541dd07 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 14:48:38 -0700
Subject: [PATCH 1/7] [Infra] Remove CCI/GHA test duplication and semantically
 shard proxy DB tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split into two related cleanups:

1. Delete CCI jobs that duplicate GHA coverage:
   - mcp_testing (tests/mcp_tests) — already run by test-mcp.yml
   - litellm_mapped_tests_proxy_part1/part2 (tests/test_litellm/proxy) —
     already run across test-unit-proxy-auth.yml, test-unit-proxy-endpoints.yml,
     and test-unit-proxy-infra.yml
   Add rag_endpoints and realtime_endpoints to test-unit-proxy-endpoints.yml
   (they were only covered by the deleted CCI part2 job).
   Remove the corresponding workflow wiring, coverage combine entries, and
   upload-coverage dependencies in .circleci/config.yml.

2. Re-shard test-unit-proxy-db.yml from 4 alphabetic buckets to 8 semantic
   ones (auth-and-jwt, proxy-server, logging-and-callbacks, db-and-spend,
   guardrails-budget-hooks, endpoints-and-responses, plus the existing
   serial key-generation and test_proxy_utils.py shards). New test files are
   placed in whichever group they belong to instead of reshuffling slices.
   Add a dist input to _test-unit-services-base.yml so the test_proxy_utils.py
   shard can use --dist=worksteal to spread its ~64 (many parametrized)
   functions across workers; the default --dist=loadscope pins a single file
   to a single worker, which was the root cause of that shard running 10m+.
---
 .circleci/config.yml                          |  77 +----------
 .../workflows/_test-unit-services-base.yml    |   8 +-
 .github/workflows/test-unit-proxy-db.yml      | 122 ++++++++++++++++--
 .../workflows/test-unit-proxy-endpoints.yml   |   2 +
 4 files changed, 120 insertions(+), 89 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index eabf4c61292..884ecbee0d3 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -563,39 +563,6 @@ jobs:
           paths:
             - realtime_translation_coverage.xml
             - realtime_translation_coverage
-  mcp_testing:
-    docker:
-      - *python312_image
-    working_directory: ~/project
-
-    steps:
-      - checkout
-      - setup_google_dns
-      - install_uv
-      - run:
-          name: Install Dependencies
-          command: |
-            uv sync --frozen --all-groups --all-extras --python 3.12
-      # Run pytest and generate JUnit XML report
-      - run:
-          name: Run tests
-          command: |
-            uv run --no-sync python -m pytest -vv tests/mcp_tests --cov=litellm --cov-report=xml -x -s -v --junitxml=test-results/junit.xml --durations=5 -n 2
-          no_output_timeout: 15m
-      - run:
-          name: Rename the coverage files
-          command: |
-            mv coverage.xml mcp_coverage.xml
-            mv .coverage mcp_coverage
-
-      # Store test results
-      - store_test_results:
-          path: test-results
-      - persist_to_workspace:
-          root: .
-          paths:
-            - mcp_coverage.xml
-            - mcp_coverage
   agent_testing:
     docker:
       - *python312_image
@@ -794,39 +761,6 @@ jobs:
           paths:
             - search_coverage.xml
             - search_coverage
-  # Split litellm_mapped_tests into parallel jobs
-  litellm_mapped_tests_proxy_part1:
-    docker:
-      - *python312_image
-    working_directory: ~/project
-    resource_class: large
-    steps:
-      - setup_litellm_test_deps
-      - run:
-          name: Run proxy tests part 1 (high-volume directories)
-          command: |
-            uv run --no-sync python -m prisma generate
-            export PYTHONUNBUFFERED=1
-            uv run --no-sync python -m pytest tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/client tests/test_litellm/proxy/auth --junitxml=test-results/junit-proxy-part1.xml --durations=10 -n 4 --maxfail=5 --timeout=60 -vv --log-cli-level=WARNING -r A
-          no_output_timeout: 15m
-      - store_test_results:
-          path: test-results
-  litellm_mapped_tests_proxy_part2:
-    docker:
-      - *python312_image
-    working_directory: ~/project
-    resource_class: large
-    steps:
-      - setup_litellm_test_deps
-      - run:
-          name: Run proxy tests part 2 (all other tests)
-          command: |
-            uv run --no-sync python -m prisma generate
-            export PYTHONUNBUFFERED=1
-            uv run --no-sync python -m pytest tests/test_litellm/proxy --ignore=tests/test_litellm/proxy/guardrails --ignore=tests/test_litellm/proxy/management_endpoints --ignore=tests/test_litellm/proxy/_experimental --ignore=tests/test_litellm/proxy/client --ignore=tests/test_litellm/proxy/auth --junitxml=test-results/junit-proxy-part2.xml --durations=10 -n 4 --maxfail=5 --timeout=120 -vv --log-cli-level=WARNING -r A
-          no_output_timeout: 15m
-      - store_test_results:
-          path: test-results
   litellm_mapped_enterprise_tests:
     docker:
       - *python312_image
@@ -2072,7 +2006,7 @@ jobs:
       - run:
           name: Combine Coverage
           command: |
-            uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage mcp_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage redis_caching_coverage
+            uv tool run --from 'coverage[toml]==7.10.6' coverage combine realtime_translation_coverage ocr_coverage search_coverage logging_coverage audio_coverage local_testing_part1_coverage local_testing_part2_coverage pass_through_unit_tests_coverage batches_coverage guardrails_coverage redis_caching_coverage
             uv tool run --from 'coverage[toml]==7.10.6' coverage xml
       - codecov/upload:
           file: ./coverage.xml
@@ -2407,8 +2341,6 @@ workflows:
           filters: *main_branches
       - realtime_translation_testing:
           filters: *main_branches
-      - mcp_testing:
-          filters: *main_branches
       - agent_testing:
           filters: *main_branches
       - guardrails_testing:
@@ -2423,10 +2355,6 @@ workflows:
           filters: *main_branches
       - litellm_mapped_enterprise_tests:
           filters: *main_branches
-      - litellm_mapped_tests_proxy_part1:
-          filters: *main_branches
-      - litellm_mapped_tests_proxy_part2:
-          filters: *main_branches
       - batches_testing:
           filters: *main_branches
       - litellm_utils_testing:
@@ -2444,14 +2372,11 @@ workflows:
       - upload-coverage:
           requires:
             - realtime_translation_testing
-            - mcp_testing
             - agent_testing
             - google_generate_content_endpoint_testing
             - guardrails_testing
             - ocr_testing
             - search_testing
-            - litellm_mapped_tests_proxy_part1
-            - litellm_mapped_tests_proxy_part2
             - litellm_mapped_enterprise_tests
             - batches_testing
             - litellm_utils_testing
diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index 8e0b3568aea..9de3ac3cf5f 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -32,6 +32,11 @@ on:
         required: false
         type: boolean
         default: false
+      dist:
+        description: "pytest-xdist distribution mode (loadscope|load|worksteal|loadfile|no)"
+        required: false
+        type: string
+        default: "loadscope"
       artifact-name:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: false
@@ -124,6 +129,7 @@ jobs:
           MAX_FAILURES: ${{ inputs.max-failures }}
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
+          DIST: ${{ inputs.dist }}
           DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
         run: |
           if [ "${WORKERS}" = "0" ]; then
@@ -143,7 +149,7 @@ jobs:
               -n "${WORKERS}" \
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
-              --dist=loadscope \
+              --dist="${DIST}" \
               --durations=20 \
               --cov=litellm \
               --cov-report=xml:coverage.xml \
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index a631a7c3005..f8d5bc265a7 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -12,6 +12,18 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+# Semantic matrix: each shard groups tests by concern (auth, server, logging, …)
+# rather than alphabetical letter ranges. Adding a new test file means adding it
+# to whichever group it belongs to, not reshuffling slices.
+#
+# Design targets:
+#   * Every shard runs in <= 7 minutes on a 4-core runner.
+#   * test_key_generate_prisma.py stays serial (workers=0) — it has event-loop
+#     conflicts with the logging worker when run in parallel.
+#   * test_proxy_utils.py runs in its own shard with --dist=worksteal so xdist
+#     spreads its ~64 functions (many parametrized) across workers instead of
+#     pinning the whole file to a single worker (the default --dist=loadscope
+#     behavior for single-file targets).
 jobs:
   proxy-db:
     permissions:
@@ -22,26 +34,111 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # Key generation tests must NOT run in parallel (event loop conflicts with logging worker)
+          # Must run serially — event-loop conflict with the logging worker.
           - test-group: key-generation
             test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
             workers: 0
-            timeout: 30
-          - test-group: auth-checks
-            test-path: "tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py"
-            workers: 8
+            dist: loadscope
             timeout: 20
-          # test_proxy_utils.py is large (168+ parametrized tests) — run it on its
-          # own matrix so --dist=loadscope doesn't pin all of it to a single xdist
-          # worker and push the "remaining" group past the job timeout.
+
+          - test-group: auth-and-jwt
+            test-path: >-
+              tests/proxy_unit_tests/test_auth_checks.py
+              tests/proxy_unit_tests/test_user_api_key_auth.py
+              tests/proxy_unit_tests/test_jwt.py
+              tests/proxy_unit_tests/test_jwt_key_mapping.py
+              tests/proxy_unit_tests/test_proxy_custom_auth.py
+              tests/proxy_unit_tests/test_key_generate_dynamodb.py
+              tests/proxy_unit_tests/test_deployed_proxy_keygen.py
+            workers: 8
+            dist: loadscope
+            timeout: 15
+
+          # Own shard, --dist=worksteal so parametrized cases fan out across workers.
           - test-group: proxy-utils
             test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
             workers: 8
-            timeout: 20
-          - test-group: remaining
-            test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py --ignore=tests/proxy_unit_tests/test_proxy_utils.py"
+            dist: worksteal
+            timeout: 15
+
+          - test-group: proxy-server
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_server.py
+              tests/proxy_unit_tests/test_proxy_server_keys.py
+              tests/proxy_unit_tests/test_proxy_server_caching.py
+              tests/proxy_unit_tests/test_proxy_server_langfuse.py
+              tests/proxy_unit_tests/test_proxy_server_spend.py
+              tests/proxy_unit_tests/test_aproxy_startup.py
+              tests/proxy_unit_tests/test_proxy_config_unit_test.py
+              tests/proxy_unit_tests/test_proxy_routes.py
+              tests/proxy_unit_tests/test_proxy_gunicorn.py
+              tests/proxy_unit_tests/test_server_root_path.py
+              tests/proxy_unit_tests/test_proxy_pass_user_config.py
+              tests/proxy_unit_tests/test_proxy_token_counter.py
             workers: 8
-            timeout: 30
+            dist: loadscope
+            timeout: 15
+
+          - test-group: logging-and-callbacks
+            test-path: >-
+              tests/proxy_unit_tests/test_custom_callback_input.py
+              tests/proxy_unit_tests/test_custom_logger_s3_gcs.py
+              tests/proxy_unit_tests/test_proxy_custom_logger.py
+              tests/proxy_unit_tests/test_proxy_reject_logging.py
+              tests/proxy_unit_tests/test_audit_logs_proxy.py
+              tests/proxy_unit_tests/test_search_api_logging.py
+            workers: 8
+            dist: loadscope
+            timeout: 15
+
+          - test-group: db-and-spend
+            test-path: >-
+              tests/proxy_unit_tests/test_prisma_client_backoff_retry.py
+              tests/proxy_unit_tests/test_db_schema_changes.py
+              tests/proxy_unit_tests/test_db_schema_migration.py
+              tests/proxy_unit_tests/test_e2e_pod_lock_manager.py
+              tests/proxy_unit_tests/test_skills_db.py
+              tests/proxy_unit_tests/test_update_daily_tag_spend.py
+              tests/proxy_unit_tests/test_update_spend.py
+              tests/proxy_unit_tests/test_project_endpoints_prisma.py
+              tests/proxy_unit_tests/test_proxy_encrypt_decrypt.py
+            workers: 8
+            dist: loadscope
+            timeout: 15
+
+          - test-group: guardrails-budget-hooks
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_setting_guardrails.py
+              tests/proxy_unit_tests/test_banned_keyword_list.py
+              tests/proxy_unit_tests/test_default_end_user_budget_simple.py
+              tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
+              tests/proxy_unit_tests/test_zero_cost_model_budget_bypass.py
+              tests/proxy_unit_tests/test_unit_test_proxy_hooks.py
+            workers: 8
+            dist: loadscope
+            timeout: 15
+
+          - test-group: endpoints-and-responses
+            test-path: >-
+              tests/proxy_unit_tests/test_blog_posts_endpoint.py
+              tests/proxy_unit_tests/test_models_fallback_endpoint.py
+              tests/proxy_unit_tests/test_google_endpoint_routing.py
+              tests/proxy_unit_tests/test_google_gemini_proxy_request.py
+              tests/proxy_unit_tests/test_get_favicon.py
+              tests/proxy_unit_tests/test_get_image.py
+              tests/proxy_unit_tests/test_ui_path_detection.py
+              tests/proxy_unit_tests/test_prompt_test_endpoint.py
+              tests/proxy_unit_tests/test_check_batch_cost.py
+              tests/proxy_unit_tests/test_check_responses_cost.py
+              tests/proxy_unit_tests/test_response_polling_handler.py
+              tests/proxy_unit_tests/test_response_polling_pre_call_checks.py
+              tests/proxy_unit_tests/test_realtime_cache.py
+              tests/proxy_unit_tests/test_proxy_exception_mapping.py
+              tests/proxy_unit_tests/test_custom_tokenizer_bug.py
+              tests/proxy_unit_tests/test_model_response_typing
+            workers: 8
+            dist: loadscope
+            timeout: 15
     uses: ./.github/workflows/_test-unit-services-base.yml
     with:
       test-path: ${{ matrix.test-path }}
@@ -49,6 +146,7 @@ jobs:
       reruns: 2
       timeout-minutes: ${{ matrix.timeout }}
       enable-postgres: true
+      dist: ${{ matrix.dist }}
       artifact-name: proxy-db-${{ matrix.test-group }}
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}
diff --git a/.github/workflows/test-unit-proxy-endpoints.yml b/.github/workflows/test-unit-proxy-endpoints.yml
index fafc866a3f6..1439b2c07f7 100644
--- a/.github/workflows/test-unit-proxy-endpoints.yml
+++ b/.github/workflows/test-unit-proxy-endpoints.yml
@@ -36,6 +36,8 @@ jobs:
         tests/test_litellm/proxy/health_endpoints
         tests/test_litellm/proxy/public_endpoints
         tests/test_litellm/proxy/prompts
+        tests/test_litellm/proxy/rag_endpoints
+        tests/test_litellm/proxy/realtime_endpoints
         tests/test_litellm/proxy/ui_crud_endpoints
       workers: 2
       reruns: 2

From 32c390a0f6afd3acc85aed4492aa154d6a2d401d Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 15:01:25 -0700
Subject: [PATCH 2/7] fix(tests): restore proxy_server.master_key in realtime
 fixture; add shard-coverage guard

Two fixes to proxy-db CI:

1. test_realtime_webrtc_endpoints.py's `proxy_app` fixture mutated the
   module-global `proxy_server.master_key` without restoring it, leaking
   state into any test that shared the same xdist worker. Under
   --dist=loadscope with 2 workers (GHA proxy-endpoints), this caused the
   google_endpoints tests to fail with "No api key passed in." because
   user_api_key_auth saw a set master_key and a missing API key on the
   test request. The fixture now saves and restores the original value.

2. Address the Greptile note that the semantic shard design has no
   catch-all, so a new test file added to tests/proxy_unit_tests/ without
   a matrix entry would silently skip CI. Adds an assert-shard-coverage
   job that enumerates test_*.py files and fails the workflow if any are
   not referenced by a matrix entry, with a clear message telling the
   author which semantic shard to place it in. All proxy-db shards now
   depend on this guard.
---
 .github/workflows/test-unit-proxy-db.yml      | 43 +++++++++++++++++++
 .../test_realtime_webrtc_endpoints.py         | 10 ++++-
 2 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index f8d5bc265a7..0f2694984e0 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -25,7 +25,50 @@ concurrency:
 #     pinning the whole file to a single worker (the default --dist=loadscope
 #     behavior for single-file targets).
 jobs:
+  # Fast guard — fails the workflow if a test_*.py file under
+  # tests/proxy_unit_tests/ is not referenced by any matrix entry below.
+  # The semantic-shard design (no catch-all "remaining" bucket) relies on
+  # every test file being explicitly assigned; this guard prevents a new
+  # file from silently dropping out of CI.
+  assert-shard-coverage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Assert every test_*.py is in a matrix shard
+        run: |
+          python3 - <<'PY'
+          import pathlib, re, sys, yaml
+          wf = yaml.safe_load(open(".github/workflows/test-unit-proxy-db.yml"))
+          matrix = wf["jobs"]["proxy-db"]["strategy"]["matrix"]["include"]
+          referenced = set()
+          for entry in matrix:
+              for token in entry["test-path"].split():
+                  if token.startswith("tests/proxy_unit_tests/"):
+                      referenced.add(pathlib.PurePosixPath(token).name)
+          actual = {p.name for p in pathlib.Path("tests/proxy_unit_tests").iterdir()
+                    if p.name.startswith("test_") and (p.suffix == ".py" or p.is_dir())
+                    and p.name != "test_configs"}
+          orphans = sorted(actual - referenced)
+          if orphans:
+              print("ERROR: the following files/dirs under tests/proxy_unit_tests/")
+              print("       are not assigned to any shard in test-unit-proxy-db.yml:")
+              for o in orphans:
+                  print(f"  - {o}")
+              print()
+              print("Add each to whichever semantic shard (auth-and-jwt, proxy-server,")
+              print("logging-and-callbacks, db-and-spend, guardrails-budget-hooks,")
+              print("endpoints-and-responses, proxy-utils, key-generation) it belongs to.")
+              sys.exit(1)
+          print(f"OK: all {len(actual)} files assigned to a shard.")
+          PY
+
   proxy-db:
+    needs: assert-shard-coverage
     permissions:
       contents: read
       id-token: write
diff --git a/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py b/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py
index e414f975f55..99b6335ce8a 100644
--- a/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py
+++ b/tests/test_litellm/proxy/realtime_endpoints/test_realtime_webrtc_endpoints.py
@@ -116,8 +116,16 @@ def test_decode_realtime_token_payload_ephemeral_key_not_string():
 def proxy_app():
     from litellm.proxy import proxy_server
 
+    # master_key is a module-global — restore it on teardown so this fixture
+    # doesn't leak state into unrelated tests that share the same xdist worker
+    # (e.g. tests that assume master_key is None and send unauthenticated
+    # requests to the shared FastAPI app).
+    original_master_key = proxy_server.master_key
     proxy_server.master_key = "sk-test-master-key"
-    return proxy_server.app
+    try:
+        yield proxy_server.app
+    finally:
+        proxy_server.master_key = original_master_key
 
 
 @pytest.fixture

From e0201ece1ed854eb317b88620938a0db63e75ac3 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 15:25:37 -0700
Subject: [PATCH 3/7] [Infra] Split slow proxy-db shards to hit 7m wall-clock
 target

Previous run (13.8m total) was bottlenecked by shards with 9-12m wall-clock.
Setup + xdist spawn + coverage teardown is ~3m per shard, so each shard's
pytest runtime must stay under ~4m to fit inside 7m total.

Observed per-shard pytest times (before split):
  db-and-spend            9:08   (170s outlier: test_aaaasschema_migration_check)
  proxy-server            7:15
  logging-and-callbacks   6:45
  guardrails-budget-hooks 6:37
  proxy-utils             6:23
  auth-and-jwt            6:54

Split 6 shards into 12, keeping key-generation and endpoints-and-responses
(already <7m). Adds a `keyword` input to _test-unit-services-base.yml so
test_proxy_utils.py can be split by -k expression (same file, two runners).
New matrix entries:

  auth-and-jwt           -> auth-checks + jwt-and-keys
  proxy-server           -> proxy-server-core + proxy-runtime
  logging-and-callbacks  -> custom-logging + logging-misc
  db-and-spend           -> schema-migration (isolated 170s test) + db-and-spend
  guardrails-budget-hooks-> guardrails-hooks + budgets
  proxy-utils            -> proxy-utils-a-h + proxy-utils-i-z (-k split)

The -k expression split is verified to cover every one of the 64 test
functions in test_proxy_utils.py exactly once. The assert-shard-coverage
guard still catches any file not in any shard.
---
 .../workflows/_test-unit-services-base.yml    |  18 ++-
 .github/workflows/test-unit-proxy-db.yml      | 110 +++++++++++++++---
 2 files changed, 107 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index 9de3ac3cf5f..766516d266e 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -37,6 +37,11 @@ on:
         required: false
         type: string
         default: "loadscope"
+      keyword:
+        description: "Optional pytest -k expression to filter tests (e.g. 'test_a or test_c')"
+        required: false
+        type: string
+        default: ""
       artifact-name:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: false
@@ -130,8 +135,15 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
           DIST: ${{ inputs.dist }}
+          KEYWORD: ${{ inputs.keyword }}
           DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
         run: |
+          # Build optional -k filter as an array so expressions with spaces
+          # (e.g. "test_a or test_b") stay a single argv entry to pytest.
+          K_ARGS=()
+          if [ -n "${KEYWORD}" ]; then
+            K_ARGS=(-k "${KEYWORD}")
+          fi
           if [ "${WORKERS}" = "0" ]; then
             uv run --no-sync pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -141,7 +153,8 @@ jobs:
               --durations=20 \
               --cov=litellm \
               --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
+              --cov-config=pyproject.toml \
+              "${K_ARGS[@]}"
           else
             uv run --no-sync pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -153,7 +166,8 @@ jobs:
               --durations=20 \
               --cov=litellm \
               --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
+              --cov-config=pyproject.toml \
+              "${K_ARGS[@]}"
           fi
 
       - name: Save coverage report
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index 0f2694984e0..b6b6fc0368f 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -17,13 +17,20 @@ concurrency:
 # to whichever group it belongs to, not reshuffling slices.
 #
 # Design targets:
-#   * Every shard runs in <= 7 minutes on a 4-core runner.
+#   * Every shard runs in <= 7 minutes of wall-clock on the default runner.
+#     Setup + xdist worker spawn + coverage teardown is ~3 minutes per shard,
+#     so each shard's pytest runtime must stay under ~4 minutes. That drives
+#     the split granularity: shards get subdivided when pytest call time
+#     exceeds ~4m or any single test exceeds ~3m (it pins one xdist worker).
 #   * test_key_generate_prisma.py stays serial (workers=0) — it has event-loop
 #     conflicts with the logging worker when run in parallel.
-#   * test_proxy_utils.py runs in its own shard with --dist=worksteal so xdist
-#     spreads its ~64 functions (many parametrized) across workers instead of
-#     pinning the whole file to a single worker (the default --dist=loadscope
-#     behavior for single-file targets).
+#   * test_proxy_utils.py is split into two -k-filtered shards (by first
+#     character of the test function name) so its 188 parametrized cases
+#     fan out across two runners rather than one. --dist=worksteal within
+#     each shard balances parametrized cases across xdist workers.
+#   * test_db_schema_migration.py is isolated because one test in it
+#     (test_aaaasschema_migration_check) takes ~170s — by itself it
+#     determines the shard's wall-clock floor.
 jobs:
   # Fast guard — fails the workflow if a test_*.py file under
   # tests/proxy_unit_tests/ is not referenced by any matrix entry below.
@@ -42,7 +49,7 @@ jobs:
       - name: Assert every test_*.py is in a matrix shard
         run: |
           python3 - <<'PY'
-          import pathlib, re, sys, yaml
+          import pathlib, sys, yaml
           wf = yaml.safe_load(open(".github/workflows/test-unit-proxy-db.yml"))
           matrix = wf["jobs"]["proxy-db"]["strategy"]["matrix"]["include"]
           referenced = set()
@@ -60,9 +67,7 @@ jobs:
               for o in orphans:
                   print(f"  - {o}")
               print()
-              print("Add each to whichever semantic shard (auth-and-jwt, proxy-server,")
-              print("logging-and-callbacks, db-and-spend, guardrails-budget-hooks,")
-              print("endpoints-and-responses, proxy-utils, key-generation) it belongs to.")
+              print("Add each to whichever semantic shard it belongs to.")
               sys.exit(1)
           print(f"OK: all {len(actual)} files assigned to a shard.")
           PY
@@ -82,12 +87,20 @@ jobs:
             test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
             workers: 0
             dist: loadscope
+            keyword: ""
             timeout: 20
 
-          - test-group: auth-and-jwt
+          # ---- auth: split into 2 shards (was 1 at ~10.4m wall-clock) ----
+          - test-group: auth-checks
             test-path: >-
               tests/proxy_unit_tests/test_auth_checks.py
               tests/proxy_unit_tests/test_user_api_key_auth.py
+            workers: 8
+            dist: loadscope
+            keyword: ""
+            timeout: 15
+          - test-group: jwt-and-keys
+            test-path: >-
               tests/proxy_unit_tests/test_jwt.py
               tests/proxy_unit_tests/test_jwt_key_mapping.py
               tests/proxy_unit_tests/test_proxy_custom_auth.py
@@ -95,16 +108,38 @@ jobs:
               tests/proxy_unit_tests/test_deployed_proxy_keygen.py
             workers: 8
             dist: loadscope
+            keyword: ""
             timeout: 15
 
-          # Own shard, --dist=worksteal so parametrized cases fan out across workers.
-          - test-group: proxy-utils
+          # ---- test_proxy_utils.py split into 2 by -k (was 1 at ~9.7m) ----
+          # Same file, same --dist=worksteal, filtered by first char of test
+          # function name. Keywords below cover all 63 test functions in the
+          # file. If new functions are added, balance between the two shards.
+          - test-group: proxy-utils-a-h
             test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
             workers: 8
             dist: worksteal
+            keyword: >-
+              test_add or test_check or test_custom or test_during or
+              test_dynamic or test_end_user or test_enforced or test_foward or
+              test_get_admin or test_get_complete or test_get_docs or
+              test_get_known or test_get_model_group or test_get_openapi or
+              test_get_redoc or test_get_temp or test_get_user_info or
+              test_handle or test_health
+            timeout: 15
+          - test-group: proxy-utils-i-z
+            test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
+            workers: 8
+            dist: worksteal
+            keyword: >-
+              test_is or test_litellm or test_merge or test_post_call or
+              test_prepare or test_provider or test_proxy_config or
+              test_reading or test_spend or test_team or test_traceparent or
+              test_update or test_get_key or test_get_team
             timeout: 15
 
-          - test-group: proxy-server
+          # ---- proxy server: split into 2 shards (was 1 at ~11.1m) ----
+          - test-group: proxy-server-core
             test-path: >-
               tests/proxy_unit_tests/test_proxy_server.py
               tests/proxy_unit_tests/test_proxy_server_keys.py
@@ -112,6 +147,12 @@ jobs:
               tests/proxy_unit_tests/test_proxy_server_langfuse.py
               tests/proxy_unit_tests/test_proxy_server_spend.py
               tests/proxy_unit_tests/test_aproxy_startup.py
+            workers: 8
+            dist: loadscope
+            keyword: ""
+            timeout: 15
+          - test-group: proxy-runtime
+            test-path: >-
               tests/proxy_unit_tests/test_proxy_config_unit_test.py
               tests/proxy_unit_tests/test_proxy_routes.py
               tests/proxy_unit_tests/test_proxy_gunicorn.py
@@ -120,25 +161,44 @@ jobs:
               tests/proxy_unit_tests/test_proxy_token_counter.py
             workers: 8
             dist: loadscope
+            keyword: ""
             timeout: 15
 
-          - test-group: logging-and-callbacks
+          # ---- logging: split into 2 shards (was 1 at ~10.1m) ----
+          - test-group: custom-logging
             test-path: >-
               tests/proxy_unit_tests/test_custom_callback_input.py
               tests/proxy_unit_tests/test_custom_logger_s3_gcs.py
               tests/proxy_unit_tests/test_proxy_custom_logger.py
+            workers: 8
+            dist: loadscope
+            keyword: ""
+            timeout: 15
+          - test-group: logging-misc
+            test-path: >-
               tests/proxy_unit_tests/test_proxy_reject_logging.py
               tests/proxy_unit_tests/test_audit_logs_proxy.py
               tests/proxy_unit_tests/test_search_api_logging.py
             workers: 8
             dist: loadscope
+            keyword: ""
             timeout: 15
 
+          # ---- db-and-spend: split out the 170s schema-migration test ----
+          # test_db_schema_migration.py has one test that runs ~170s; it
+          # single-handedly pins one xdist worker and determined the whole
+          # shard's 12.3m wall-clock. Isolated here so the other 45 tests
+          # finish faster.
+          - test-group: schema-migration
+            test-path: "tests/proxy_unit_tests/test_db_schema_migration.py"
+            workers: 8
+            dist: loadscope
+            keyword: ""
+            timeout: 15
           - test-group: db-and-spend
             test-path: >-
               tests/proxy_unit_tests/test_prisma_client_backoff_retry.py
               tests/proxy_unit_tests/test_db_schema_changes.py
-              tests/proxy_unit_tests/test_db_schema_migration.py
               tests/proxy_unit_tests/test_e2e_pod_lock_manager.py
               tests/proxy_unit_tests/test_skills_db.py
               tests/proxy_unit_tests/test_update_daily_tag_spend.py
@@ -147,20 +207,30 @@ jobs:
               tests/proxy_unit_tests/test_proxy_encrypt_decrypt.py
             workers: 8
             dist: loadscope
+            keyword: ""
             timeout: 15
 
-          - test-group: guardrails-budget-hooks
+          # ---- guardrails + budget + hooks: split into 2 (was 1 at ~10.1m) ----
+          - test-group: guardrails-hooks
             test-path: >-
               tests/proxy_unit_tests/test_proxy_setting_guardrails.py
               tests/proxy_unit_tests/test_banned_keyword_list.py
-              tests/proxy_unit_tests/test_default_end_user_budget_simple.py
-              tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
-              tests/proxy_unit_tests/test_zero_cost_model_budget_bypass.py
               tests/proxy_unit_tests/test_unit_test_proxy_hooks.py
             workers: 8
             dist: loadscope
+            keyword: ""
+            timeout: 15
+          - test-group: budgets
+            test-path: >-
+              tests/proxy_unit_tests/test_default_end_user_budget_simple.py
+              tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
+              tests/proxy_unit_tests/test_zero_cost_model_budget_bypass.py
+            workers: 8
+            dist: loadscope
+            keyword: ""
             timeout: 15
 
+          # Already under 7m; left as a single shard.
           - test-group: endpoints-and-responses
             test-path: >-
               tests/proxy_unit_tests/test_blog_posts_endpoint.py
@@ -181,6 +251,7 @@ jobs:
               tests/proxy_unit_tests/test_model_response_typing
             workers: 8
             dist: loadscope
+            keyword: ""
             timeout: 15
     uses: ./.github/workflows/_test-unit-services-base.yml
     with:
@@ -190,6 +261,7 @@ jobs:
       timeout-minutes: ${{ matrix.timeout }}
       enable-postgres: true
       dist: ${{ matrix.dist }}
+      keyword: ${{ matrix.keyword }}
       artifact-name: proxy-db-${{ matrix.test-group }}
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}

From 584a7cd40fc6e7250df06aaa6c415d10d5329a96 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 15:29:42 -0700
Subject: [PATCH 4/7] [Infra] Clean up proxy-db matrix job display names

Default GHA matrix job names join every matrix field, producing unreadable
check labels like:
  'proxy-db (logging-misc, tests/proxy_unit_tests/test_proxy_reject_logging.py
   tests/proxy_unit_tests/test_audit_logs_proxy.py ..., 8, loadscope, "", 15)'

Set the job's display name to '${{ matrix.test-group }}' so each check
shows just 'logging-misc', 'proxy-utils-a-h', etc.
---
 .github/workflows/test-unit-proxy-db.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index b6b6fc0368f..17b564d5b75 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -74,6 +74,10 @@ jobs:
 
   proxy-db:
     needs: assert-shard-coverage
+    # Display only the semantic shard name in the checks UI instead of GHA's
+    # default "proxy-db (key-generation, tests/proxy_unit_tests/…, 0, loadscope, "", 20)"
+    # which includes every matrix field and gets truncated past the test-path.
+    name: ${{ matrix.test-group }}
     permissions:
       contents: read
       id-token: write

From 5df9f397e6d97c0f523f12104ef5e4ec901dafef Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 15:56:27 -0700
Subject: [PATCH 5/7] [Infra] Match xdist workers to runner cores; revert
 test_proxy_utils -k split

Two changes:

1. workers: 8 -> 4 on every non-serial proxy-db shard. ubuntu-latest is a
   4-core runner; -n 8 oversubscribes 2x and workers block each other
   during their cold-start imports (pytest-cov instruments every litellm
   module per worker). Measured ~441% CPU locally with -n 8 on 8 cores
   (i.e. ~55% effective). Matching -n to physical cores should give
   ~2x faster worker startup, which is where most of the ~9m wall-clock
   per shard goes (7+ minutes is plugin load + xdist imports before any
   test runs).

2. Revert the -k split on test_proxy_utils.py. It was split into
   proxy-utils-a-h / proxy-utils-i-z as a semantic-adjacent hack; merge
   back to a single proxy-utils shard. Still uses --dist=worksteal so
   xdist can balance the 188 parametrized cases across workers.

Also drops the now-unused `keyword` input from _test-unit-services-base.yml
and its matching matrix field across all proxy-db entries.

Shard count: 14 -> 13 (+ the assert-shard-coverage guard).
---
 .../workflows/_test-unit-services-base.yml    | 18 +---
 .github/workflows/test-unit-proxy-db.yml      | 92 ++++++-------------
 2 files changed, 32 insertions(+), 78 deletions(-)

diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index 766516d266e..9de3ac3cf5f 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -37,11 +37,6 @@ on:
         required: false
         type: string
         default: "loadscope"
-      keyword:
-        description: "Optional pytest -k expression to filter tests (e.g. 'test_a or test_c')"
-        required: false
-        type: string
-        default: ""
       artifact-name:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: false
@@ -135,15 +130,8 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
           DIST: ${{ inputs.dist }}
-          KEYWORD: ${{ inputs.keyword }}
           DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
         run: |
-          # Build optional -k filter as an array so expressions with spaces
-          # (e.g. "test_a or test_b") stay a single argv entry to pytest.
-          K_ARGS=()
-          if [ -n "${KEYWORD}" ]; then
-            K_ARGS=(-k "${KEYWORD}")
-          fi
           if [ "${WORKERS}" = "0" ]; then
             uv run --no-sync pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -153,8 +141,7 @@ jobs:
               --durations=20 \
               --cov=litellm \
               --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml \
-              "${K_ARGS[@]}"
+              --cov-config=pyproject.toml
           else
             uv run --no-sync pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -166,8 +153,7 @@ jobs:
               --durations=20 \
               --cov=litellm \
               --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml \
-              "${K_ARGS[@]}"
+              --cov-config=pyproject.toml
           fi
 
       - name: Save coverage report
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index 17b564d5b75..b9496e39a30 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -18,16 +18,18 @@ concurrency:
 #
 # Design targets:
 #   * Every shard runs in <= 7 minutes of wall-clock on the default runner.
-#     Setup + xdist worker spawn + coverage teardown is ~3 minutes per shard,
-#     so each shard's pytest runtime must stay under ~4 minutes. That drives
-#     the split granularity: shards get subdivided when pytest call time
-#     exceeds ~4m or any single test exceeds ~3m (it pins one xdist worker).
+#     Most of a shard's time is pytest plugin load + xdist worker imports +
+#     pytest-cov instrumentation, not the tests themselves. Keeping per-shard
+#     work low and matching worker count to runner cores is what controls it.
+#   * workers: 4 matches the 4-core ubuntu-latest runner. -n 8 on 4 cores
+#     oversubscribes 2x and workers fight for CPU during their cold-start
+#     imports (measured ~441% CPU for -n 8 locally, i.e. ~55% effective).
 #   * test_key_generate_prisma.py stays serial (workers=0) — it has event-loop
 #     conflicts with the logging worker when run in parallel.
-#   * test_proxy_utils.py is split into two -k-filtered shards (by first
-#     character of the test function name) so its 188 parametrized cases
-#     fan out across two runners rather than one. --dist=worksteal within
-#     each shard balances parametrized cases across xdist workers.
+#   * test_proxy_utils.py runs as a single shard with --dist=worksteal so
+#     xdist balances its 188 parametrized cases across workers instead of
+#     pinning the whole file to one worker (the default --dist=loadscope
+#     behavior for single-file targets).
 #   * test_db_schema_migration.py is isolated because one test in it
 #     (test_aaaasschema_migration_check) takes ~170s — by itself it
 #     determines the shard's wall-clock floor.
@@ -75,7 +77,7 @@ jobs:
   proxy-db:
     needs: assert-shard-coverage
     # Display only the semantic shard name in the checks UI instead of GHA's
-    # default "proxy-db (key-generation, tests/proxy_unit_tests/…, 0, loadscope, "", 20)"
+    # default "proxy-db (key-generation, tests/proxy_unit_tests/…, 0, loadscope, 20)"
     # which includes every matrix field and gets truncated past the test-path.
     name: ${{ matrix.test-group }}
     permissions:
@@ -91,17 +93,15 @@ jobs:
             test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
             workers: 0
             dist: loadscope
-            keyword: ""
             timeout: 20
 
-          # ---- auth: split into 2 shards (was 1 at ~10.4m wall-clock) ----
+          # ---- auth: split into 2 shards ----
           - test-group: auth-checks
             test-path: >-
               tests/proxy_unit_tests/test_auth_checks.py
               tests/proxy_unit_tests/test_user_api_key_auth.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
           - test-group: jwt-and-keys
             test-path: >-
@@ -110,39 +110,18 @@ jobs:
               tests/proxy_unit_tests/test_proxy_custom_auth.py
               tests/proxy_unit_tests/test_key_generate_dynamodb.py
               tests/proxy_unit_tests/test_deployed_proxy_keygen.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
 
-          # ---- test_proxy_utils.py split into 2 by -k (was 1 at ~9.7m) ----
-          # Same file, same --dist=worksteal, filtered by first char of test
-          # function name. Keywords below cover all 63 test functions in the
-          # file. If new functions are added, balance between the two shards.
-          - test-group: proxy-utils-a-h
+          # ---- test_proxy_utils.py, single shard, worksteal distribution ----
+          - test-group: proxy-utils
             test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
-            workers: 8
+            workers: 4
             dist: worksteal
-            keyword: >-
-              test_add or test_check or test_custom or test_during or
-              test_dynamic or test_end_user or test_enforced or test_foward or
-              test_get_admin or test_get_complete or test_get_docs or
-              test_get_known or test_get_model_group or test_get_openapi or
-              test_get_redoc or test_get_temp or test_get_user_info or
-              test_handle or test_health
-            timeout: 15
-          - test-group: proxy-utils-i-z
-            test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
-            workers: 8
-            dist: worksteal
-            keyword: >-
-              test_is or test_litellm or test_merge or test_post_call or
-              test_prepare or test_provider or test_proxy_config or
-              test_reading or test_spend or test_team or test_traceparent or
-              test_update or test_get_key or test_get_team
             timeout: 15
 
-          # ---- proxy server: split into 2 shards (was 1 at ~11.1m) ----
+          # ---- proxy server: split into 2 shards ----
           - test-group: proxy-server-core
             test-path: >-
               tests/proxy_unit_tests/test_proxy_server.py
@@ -151,9 +130,8 @@ jobs:
               tests/proxy_unit_tests/test_proxy_server_langfuse.py
               tests/proxy_unit_tests/test_proxy_server_spend.py
               tests/proxy_unit_tests/test_aproxy_startup.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
           - test-group: proxy-runtime
             test-path: >-
@@ -163,41 +141,37 @@ jobs:
               tests/proxy_unit_tests/test_server_root_path.py
               tests/proxy_unit_tests/test_proxy_pass_user_config.py
               tests/proxy_unit_tests/test_proxy_token_counter.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
 
-          # ---- logging: split into 2 shards (was 1 at ~10.1m) ----
+          # ---- logging: split into 2 shards ----
           - test-group: custom-logging
             test-path: >-
               tests/proxy_unit_tests/test_custom_callback_input.py
               tests/proxy_unit_tests/test_custom_logger_s3_gcs.py
               tests/proxy_unit_tests/test_proxy_custom_logger.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
           - test-group: logging-misc
             test-path: >-
               tests/proxy_unit_tests/test_proxy_reject_logging.py
               tests/proxy_unit_tests/test_audit_logs_proxy.py
               tests/proxy_unit_tests/test_search_api_logging.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
 
-          # ---- db-and-spend: split out the 170s schema-migration test ----
+          # ---- db-and-spend: isolate the 170s schema-migration test ----
           # test_db_schema_migration.py has one test that runs ~170s; it
           # single-handedly pins one xdist worker and determined the whole
           # shard's 12.3m wall-clock. Isolated here so the other 45 tests
           # finish faster.
           - test-group: schema-migration
             test-path: "tests/proxy_unit_tests/test_db_schema_migration.py"
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
           - test-group: db-and-spend
             test-path: >-
@@ -209,32 +183,28 @@ jobs:
               tests/proxy_unit_tests/test_update_spend.py
               tests/proxy_unit_tests/test_project_endpoints_prisma.py
               tests/proxy_unit_tests/test_proxy_encrypt_decrypt.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
 
-          # ---- guardrails + budget + hooks: split into 2 (was 1 at ~10.1m) ----
+          # ---- guardrails + budget + hooks: split into 2 ----
           - test-group: guardrails-hooks
             test-path: >-
               tests/proxy_unit_tests/test_proxy_setting_guardrails.py
               tests/proxy_unit_tests/test_banned_keyword_list.py
               tests/proxy_unit_tests/test_unit_test_proxy_hooks.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
           - test-group: budgets
             test-path: >-
               tests/proxy_unit_tests/test_default_end_user_budget_simple.py
               tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
               tests/proxy_unit_tests/test_zero_cost_model_budget_bypass.py
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
 
-          # Already under 7m; left as a single shard.
           - test-group: endpoints-and-responses
             test-path: >-
               tests/proxy_unit_tests/test_blog_posts_endpoint.py
@@ -253,9 +223,8 @@ jobs:
               tests/proxy_unit_tests/test_proxy_exception_mapping.py
               tests/proxy_unit_tests/test_custom_tokenizer_bug.py
               tests/proxy_unit_tests/test_model_response_typing
-            workers: 8
+            workers: 4
             dist: loadscope
-            keyword: ""
             timeout: 15
     uses: ./.github/workflows/_test-unit-services-base.yml
     with:
@@ -265,7 +234,6 @@ jobs:
       timeout-minutes: ${{ matrix.timeout }}
       enable-postgres: true
       dist: ${{ matrix.dist }}
-      keyword: ${{ matrix.keyword }}
       artifact-name: proxy-db-${{ matrix.test-group }}
     secrets:
       DATABASE_URL: ${{ secrets.DATABASE_URL }}

From 21e08b0bb52af44046cce546c4e4a4a86810e375 Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 16:24:40 -0700
Subject: [PATCH 6/7] [Infra] Run schema-migration shard serially (workers: 0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_db_schema_migration.py has exactly one test, and that test is mostly
waiting on prisma subprocesses (~170s: prisma migrate deploy + prisma
migrate diff). No CPU-bound Python work inside the test body, and only
one test in the file means xdist's parallelism is unused regardless.

Previous run on commit 5df9f397e6: 10.0m wall-clock for the shard, of
which 4:56 was silence between step start and pytest banner — the cost
of 4 xdist workers each cold-starting (pytest plugin load + litellm
import + pytest-cov instrumentation) so that exactly one of them could
pick up the single test.

Switching to workers: 0 takes the serial pytest branch in the base
workflow, which already handles this case correctly (no -n, no --dist).
Single-process startup instead of 4. Expected wall-clock: ~6m.
---
 .github/workflows/test-unit-proxy-db.yml | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index b9496e39a30..14010d896b5 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -164,13 +164,15 @@ jobs:
             timeout: 15
 
           # ---- db-and-spend: isolate the 170s schema-migration test ----
-          # test_db_schema_migration.py has one test that runs ~170s; it
-          # single-handedly pins one xdist worker and determined the whole
-          # shard's 12.3m wall-clock. Isolated here so the other 45 tests
-          # finish faster.
+          # test_db_schema_migration.py has exactly one test, and that test
+          # is mostly waiting on `prisma migrate deploy` / `prisma migrate
+          # diff` subprocesses (~170s). It does no CPU-bound Python work
+          # inside the test. Running with workers=0 (serial, no xdist)
+          # skips the 4-worker cold-start cost we'd otherwise pay for a
+          # single test, saving ~4 minutes of wall-clock.
           - test-group: schema-migration
             test-path: "tests/proxy_unit_tests/test_db_schema_migration.py"
-            workers: 4
+            workers: 0
             dist: loadscope
             timeout: 15
           - test-group: db-and-spend

From 66bf890226e56d14549c43757833b5fd808f28bf Mon Sep 17 00:00:00 2001
From: Yuneng Jiang <yuneng@berri.ai>
Date: Thu, 23 Apr 2026 16:32:18 -0700
Subject: [PATCH 7/7] [Infra] Stop attaching push-only postgres workflows to a
 GHA environment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `_test-unit-services-base.yml` reusable workflow attached every job
to the `integration-postgres` GHA environment to read three "secrets":
DATABASE_URL, POSTGRES_USER, POSTGRES_PASSWORD. These are not secrets —
the postgres service container is spawned per-job on localhost and
destroyed with the job, so the user/password are bootstrap values for a
throwaway container and the URL is always `postgresql://…@localhost:…`.

Each environment attachment produces a "temporarily deployed to
integration-postgres" deployment record, which the PR timeline renders
as a message per matrix shard per push. With 14 proxy-db shards that's
~14 notifications per push, drowning the PR conversation.

Changes:
* Hardcode POSTGRES_USER/POSTGRES_PASSWORD/POSTGRES_DB and the derived
  DATABASE_URL in `_test-unit-services-base.yml`.
* Delete the `environment: integration-postgres` attachment.
* Delete the `secrets:` declarations on the reusable workflow and on
  the two callers (test-unit-proxy-db.yml, test-unit-security.yml).
* The `services:` container still starts a fresh postgres per job;
  the connection string now matches what the container boots up with.

Security review: no regression. The environment wasn't gating anything
real — no protection rules configured, no approval gates, and the
branch restriction is already enforced by `on: push: branches: [...]`
on both caller workflows. Zizmor pedantic-mode findings are identical
before and after (same 6 pre-existing findings, zero new ones).

The `integration-postgres` environment and its three "secrets" in repo
settings are now unreferenced and can be deleted from repo admin.
---
 .../workflows/_test-unit-services-base.yml    | 29 +++++++------------
 .github/workflows/test-unit-proxy-db.yml      |  4 ---
 .github/workflows/test-unit-security.yml      |  8 ++---
 3 files changed, 14 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/_test-unit-services-base.yml b/.github/workflows/_test-unit-services-base.yml
index 9de3ac3cf5f..8c47b6d7666 100644
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@@ -42,36 +42,29 @@ on:
         required: false
         type: string
         default: "run"
-    secrets:
-      DATABASE_URL:
-        required: false
-      POSTGRES_USER:
-        required: false
-      POSTGRES_PASSWORD:
-        required: false
 
 permissions:
   contents: read
 
+# The postgres service container below is spawned per-job on localhost and
+# destroyed with the job. Nothing outside the runner can reach it. The
+# user/password/database here are not secrets — they're bootstrap values
+# for a throwaway container — so we hardcode them instead of attaching
+# every matrix shard to a GHA environment just to read three "secrets"
+# (which also produces a "temporarily deployed to …" notification on the
+# PR timeline per shard per push).
 jobs:
   run:
     name: Run tests
     runs-on: ubuntu-latest
     timeout-minutes: ${{ inputs.timeout-minutes }}
-    # Environment is derived from the enable-* flags, not caller-controllable.
-    # This prevents callers from passing arbitrary environment names to bypass secret scoping.
-    environment: >-
-      ${{
-        inputs.enable-postgres && 'integration-postgres' ||
-        ''
-      }}
 
     services:
       postgres:
         image: postgres@sha256:705a5d5b5836f3fcba0d02c4d281e6a7dd9ed2dd4078640f08a1e1e9896e097d # postgres:14
         env:
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_USER: litellm
+          POSTGRES_PASSWORD: litellm
           POSTGRES_DB: litellm_test
         ports:
           - 5432:5432
@@ -119,7 +112,7 @@ jobs:
       - name: Run Prisma migrations
         if: ${{ inputs.enable-postgres }}
         env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          DATABASE_URL: "postgresql://litellm:litellm@localhost:5432/litellm_test"
         run: |
           uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
 
@@ -130,7 +123,7 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
           DIST: ${{ inputs.dist }}
-          DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
+          DATABASE_URL: ${{ inputs.enable-postgres && 'postgresql://litellm:litellm@localhost:5432/litellm_test' || '' }}
         run: |
           if [ "${WORKERS}" = "0" ]; then
             uv run --no-sync pytest ${TEST_PATH:?} \
diff --git a/.github/workflows/test-unit-proxy-db.yml b/.github/workflows/test-unit-proxy-db.yml
index 14010d896b5..49795ad4e8d 100644
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@@ -237,7 +237,3 @@ jobs:
       enable-postgres: true
       dist: ${{ matrix.dist }}
       artifact-name: proxy-db-${{ matrix.test-group }}
-    secrets:
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
diff --git a/.github/workflows/test-unit-security.yml b/.github/workflows/test-unit-security.yml
index 4defa03b4d0..4ee89897024 100644
--- a/.github/workflows/test-unit-security.yml
+++ b/.github/workflows/test-unit-security.yml
@@ -1,6 +1,8 @@
 name: "Unit Tests: Security"
 
-# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
+# Kept push-only (was previously required by DATABASE_URL secret scoping;
+# now the postgres credentials are ephemeral localhost values but the
+# push-trigger stays to match the proxy-db workflow cadence).
 on:
   push:
     branches: [main, "litellm_**"]
@@ -24,7 +26,3 @@ jobs:
       timeout-minutes: 20
       enable-postgres: true
       artifact-name: security
-    secrets:
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}