chore: move root configs and add root budget guard

.github/workflows/test-code-quality.yml

@@ -23,6 +23,7 @@ jobs:
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
@@ -37,6 +38,11 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Check root-size budget
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: python scripts/check_root_budget.py --base "$BASE_SHA"
+
       - name: Set up uv
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:

ci_cd/root-size-budget.json

@@ -0,0 +1,6 @@
+{
+  "max_tracked_root_dirs": 24,
+  "max_tracked_root_entries": 63,
+  "max_tracked_root_file_bytes": 3488525,
+  "max_tracked_root_files": 39
+}

cookbook/nova_sonic_realtime.py

@@ -1,3 +1,4 @@
+# ruff: noqa: T201
 """
 Client script to test Nova Sonic realtime API through LiteLLM proxy.
 
@@ -281,7 +282,7 @@ async def main():
 if __name__ == "__main__":
     print("\nMake sure:")
     print("1. LiteLLM proxy is running on port 4000")
-    print("2. Bedrock is configured in proxy_server_config.yaml")
+    print("2. Bedrock is configured in docker/proxy_server_config.yaml")
     print("3. AWS credentials are set")
     print()
 

docker-compose.hardened.yml

@@ -22,7 +22,7 @@ services:
       - /app/cache:rw,noexec,nosuid,nodev,size=128m,uid=101,gid=101,mode=1777
       - /app/migrations:rw,noexec,nosuid,nodev,size=64m,uid=101,gid=101,mode=1777
     volumes:
-      - ./proxy_server_config.yaml:/app/config.yaml:ro
+      - ./docker/proxy_server_config.yaml:/app/config.yaml:ro
     environment:
       LITELLM_NON_ROOT: "true"
       PRISMA_BINARY_CACHE_DIR: "/app/cache/prisma-python/binaries"

docker-compose.yml

@@ -57,7 +57,7 @@ services:
     image: prom/prometheus
     volumes:
       - prometheus_data:/prometheus
-      - ./prometheus.yml:/etc/prometheus/prometheus.yml
+      - ./docker/prometheus.yml:/etc/prometheus/prometheus.yml
     ports:
       - "9090:9090"
     command:

scripts/check_root_budget.py

@@ -0,0 +1,123 @@
+import argparse
+import json
+import subprocess
+import sys
+from pathlib import Path
+from typing import Any
+
+
+BUDGET_PATH = Path("ci_cd/root-size-budget.json")
+
+
+def _git(args: list[str], *, check: bool = True) -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        ["git", *args],
+        check=check,
+        capture_output=True,
+        text=True,
+    )
+
+
+def _tracked_files() -> list[str]:
+    result = _git(["ls-files"])
+    return [line for line in result.stdout.splitlines() if line]
+
+
+def current_root_metrics() -> dict[str, int]:
+    root_files: list[str] = []
+    root_dirs: set[str] = set()
+
+    for file_path in _tracked_files():
+        parts = Path(file_path).parts
+        if len(parts) == 1:
+            root_files.append(file_path)
+        else:
+            root_dirs.add(parts[0])
+
+    root_file_bytes = sum(Path(file_path).stat().st_size for file_path in root_files)
+    return {
+        "max_tracked_root_dirs": len(root_dirs),
+        "max_tracked_root_entries": len(root_files) + len(root_dirs),
+        "max_tracked_root_file_bytes": root_file_bytes,
+        "max_tracked_root_files": len(root_files),
+    }
+
+
+def load_budget() -> dict[str, int]:
+    with BUDGET_PATH.open() as budget_file:
+        budget = json.load(budget_file)
+    return {key: int(value) for key, value in budget.items()}
+
+
+def load_base_budget(base_ref: str | None) -> dict[str, int] | None:
+    if not base_ref:
+        return None
+
+    result = _git(["show", f"{base_ref}:{BUDGET_PATH}"], check=False)
+    if result.returncode != 0:
+        return None
+    parsed: dict[str, Any] = json.loads(result.stdout)
+    return {key: int(value) for key, value in parsed.items()}
+
+
+def check_current_budget(metrics: dict[str, int], budget: dict[str, int]) -> list[str]:
+    errors: list[str] = []
+    for key, actual_value in metrics.items():
+        budget_value = budget.get(key)
+        if budget_value is None:
+            errors.append(f"{key}: missing from {BUDGET_PATH}")
+            continue
+        if actual_value > budget_value:
+            errors.append(f"{key}: actual {actual_value} exceeds budget {budget_value}")
+    return errors
+
+
+def check_budget_ratchet(
+    budget: dict[str, int], base_budget: dict[str, int] | None
+) -> list[str]:
+    if base_budget is None:
+        return []
+
+    errors: list[str] = []
+    for key, budget_value in budget.items():
+        base_value = base_budget.get(key)
+        if base_value is None:
+            continue
+        if budget_value > base_value:
+            errors.append(
+                f"{key}: budget increased from {base_value} to {budget_value}"
+            )
+    return errors
+
+
+def emit(message: str = "") -> None:
+    sys.stdout.write(f"{message}\n")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Ensure tracked repo-root file/dir counts do not grow."
+    )
+    parser.add_argument("--base", help="Optional base ref for budget ratcheting")
+    args = parser.parse_args()
+
+    metrics = current_root_metrics()
+    budget = load_budget()
+    base_budget = load_base_budget(args.base)
+
+    errors = check_current_budget(metrics, budget)
+    errors.extend(check_budget_ratchet(budget, base_budget))
+
+    emit("Current root metrics:")
+    for key in sorted(metrics):
+        emit(f"  {key}: {metrics[key]} / {budget.get(key, 'missing')}")
+
+    if errors:
+        emit("\nRoot budget check failed:")
+        for error in errors:
+            emit(f"  - {error}")
+        raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main()