Add a security gate workflow that scans pull requests for malicious .pth file additions or renames. .pth files are a known Python security risk as they allow arbitrary code execution at interpreter startup. The workflow will fail the check if any .pth files are detected, prompting the author to rename legitimate fixtures to .pth.txt.
chore: remove malicious.pth file
The file was identified as potentially harmful and has been deleted to maintain repository security.
ci: update actions/github-script to pinned version v7.0.1
Update the GitHub Actions workflow to use a pinned version tag instead of a commit hash for the `actions/github-script` action. This improves maintainability and security by using an official, versioned release.
docs: add security gate check to PR templates and improve scan
Update CONTRIBUTING.md and pull request template to document the new Critical Entry Point Scan requirement. Enhance the security-gate workflow with a warning for large PRs exceeding GitHub API limits and add configuration notes for branch protection.
CI fails because LITELLM_MASTER_KEY is not set, causing
encrypt_value_helper to error on NoneType.encode(). Patch it
to pass through values unencrypted in the test.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Skip the integration test that requires a live proxy and OPENAI_API_KEY
(removed from CI/CD). Add deterministic mock test covering the same
add → delete → double-delete-fails lifecycle.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The sync and async failure handlers guarded plain-function callbacks with
`customLogger is not None`, but customLogger was only initialized in the
success handler path. If a request failed without any prior success in the
process, the failure callback was silently skipped.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Switch the passthrough e2e helper to direct HTTP transcript create/poll/delete calls so the request includes required speech_models and remains compatible with current AssemblyAI API behavior.
Made-with: Cursor
- test_caching_router: Use REDIS_HOST/PORT/PASSWORD/SSL instead of
non-existent REDIS_HOST_2 variants
- test_router_init_azure_service_principal: Use monkeypatch.setenv instead
of patching the os module in only one file, so both common_utils._resolve_env_var
and get_azure_ad_token_provider see the mocked credentials. Also clear
AZURE_OPENAI_API_KEY to prevent it from short-circuiting the token provider path.
Main rewrote the same tests we moved. Resolution: keep the tests only
in the unit test directory, adopting main's improved patterns (AsyncMock,
assert_called_once, stronger content assertions on streaming).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
