docs(proxy): clarify _kill_engine_process is on the routine reconnect path

Greptile review on #26225 (P2): the docstring said "Called when disconnect()
fails", and the SIGTERM warning log read "after failed disconnect", but
both were stale — `_kill_engine_process` is now invoked on every routine
reconnect (via the unified `recreate_prisma_client` path), not as a
disconnect-failure recovery branch. The misleading wording would have
produced confusing log lines on every reconnect cycle in production.

Update the docstring to explain the actual reason (avoiding the blocking
`disconnect()` event-loop freeze) and reword the SIGTERM warning to "during
reconnect" so it matches reality.

No behavior change; logs only.

.cargo/config.toml

@@ -1,19 +0,0 @@
-[http]
-# CI has seen transient crates.io failures from libcurl's HTTP/2 multiplexing
-# during `maturin` metadata resolution. Disable multiplexing and retry more
-# aggressively so editable `uv sync` builds are not failed by one flaky frame.
-multiplexing = false
-
-[net]
-retry = 5
-
-# PyO3 cdylib (`litellm-python-bridge`) links against the host interpreter's
-# symbols, which are not present at link time when building an extension module.
-# On macOS, tell the linker to resolve undefined `_Py*` symbols dynamically at
-# load time (the standard pyo3 extension-module flag) so the cdylib links without
-# a libpython on the link line.
-[target.x86_64-apple-darwin]
-rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]
-
-[target.aarch64-apple-darwin]
-rustflags = ["-C", "link-arg=-undefined", "-C", "link-arg=dynamic_lookup"]

.circleci/scripts/classify_changes.sh

@@ -1,32 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-category="${1:?usage: classify_changes.sh <backend|client|ui>}"
-
-has_client=false
-has_backend=false
-has_ci=false
-while IFS= read -r file || [ -n "$file" ]; do
-  [ -n "$file" ] || continue
-  case "$file" in
-    ui/* | tests/e2e/ui/*) has_client=true ;;
-    docs/* | *.md | *.mdx) : ;;
-    .github/* | .circleci/*) has_ci=true; has_backend=true ;;
-    *) has_backend=true ;;
-  esac
-done
-
-case "$category" in
-  backend)
-    [ "$has_backend" = true ] && echo run || echo skip
-    ;;
-  client)
-    { [ "$has_client" = true ] || [ "$has_backend" = true ]; } && echo run || echo skip
-    ;;
-  ui)
-    { [ "$has_client" = true ] || [ "$has_ci" = true ]; } && echo run || echo skip
-    ;;
-  *)
-    echo run
-    ;;
-esac

.circleci/scripts/path_filter.sh

@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-category="${1:?usage: path_filter.sh <backend|client>}"
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-
-run_full() {
-  echo "path-filter[$category]: running job ($1)"
-  exit 0
-}
-
-[ -n "${CIRCLE_PULL_REQUEST:-}" ] || run_full "not a pull request"
-
-candidate_bases="main litellm_internal_staging litellm_oss_staging"
-merge_base=""
-for base in $candidate_bases; do
-  git fetch --quiet origin "$base" 2>/dev/null || continue
-  candidate="$(git merge-base HEAD FETCH_HEAD 2>/dev/null)" || continue
-  [ -n "$candidate" ] || continue
-  if [ -z "$merge_base" ] || git merge-base --is-ancestor "$merge_base" "$candidate" 2>/dev/null; then
-    merge_base="$candidate"
-  fi
-done
-
-[ -n "$merge_base" ] || run_full "could not resolve a merge base against $candidate_bases"
-
-changed="$(git diff --name-only "$merge_base" HEAD 2>/dev/null)" || run_full "git diff failed"
-[ -n "$changed" ] || run_full "no files changed vs $merge_base"
-
-echo "path-filter[$category]: changed files vs ${merge_base}:"
-printf '%s\n' "$changed" | sed 's/^/  /' || true
-
-decision="$(printf '%s\n' "$changed" | bash "$here/classify_changes.sh" "$category")" || run_full "classify_changes.sh failed"
-
-if [ "$decision" = run ]; then
-  run_full "$category-relevant changes detected"
-fi
-
-echo "path-filter[$category]: only unrelated (docs/client) changes detected; halting job as successful"
-circleci-agent step halt

.dockerignore

@@ -49,10 +49,6 @@ build/
 *.egg-info/
 .DS_Store
 **/node_modules
-ui/litellm-dashboard/.next
-ui/litellm-dashboard/out
-litellm-rust/target/
-litellm/rust_bridge/_native*.so
 *.log
 .env
 .env.local

.flake8

@@ -0,0 +1,46 @@
+[flake8]
+ignore =
+    # The following ignores can be removed when formatting using black
+    W191,W291,W292,W293,W391,W504
+    E101,E111,E114,E116,E117,E121,E122,E123,E124,E125,E126,E127,E128,E129,E131,
+    E201,E202,E221,E222,E225,E226,E231,E241,E251,E252,E261,E265,E271,E272,E275,
+    E301,E302,E303,E305,E306,
+    # line break before binary operator
+    W503,
+    # inline comment should start with '# '
+    E262,
+    # too many leading '#' for block comment
+    E266,
+    # multiple imports on one line
+    E401,
+    # module level import not at top of file
+    E402,
+    # Line too long (82 > 79 characters)
+    E501,
+    # comparison to None should be 'if cond is None:'
+    E711,
+    # comparison to True should be 'if cond is True:' or 'if cond:'
+    E712,
+    # do not compare types, for exact checks use `is` / `is not`, for instance checks use `isinstance()`
+    E721,
+    # do not use bare 'except'
+    E722,
+    # x is imported but unused
+    F401,
+    # 'from . import *' used; unable to detect undefined names
+    F403,
+    # x may be undefined, or defined from star imports:
+    F405,
+    # f-string is missing placeholders
+    F541,
+    # dictionary key '' repeated with different values
+    F601,
+    # redefinition of unused x from line 123
+    F811,
+    # undefined name x
+    F821,
+    # local variable x is assigned to but never used
+    F841,
+
+# https://black.readthedocs.io/en/stable/guides/using_black_with_other_tools.html#flake8
+extend-ignore = E203

.git-blame-ignore-revs

@@ -8,33 +8,3 @@
 
 # Update pydantic code to fix warnings (GH-3600)
 876840e9957bc7e9f7d6a2b58c4d7c53dad16481
-
-# style(ui): run prettier --write across the dashboard (#29622)
-7edf3a9cb55548b143df1692f4ed7c4681d7fcf7
-
-# style: reformat litellm/ with ruff format (#31317)
-17bfd415aeb5a57fb646b5cc67da1c730aa7c50b
-
-# style: unify ruff format width on 120 (#31518)
-48b5a5a0cc5a694a11219416ee0b6eb6e620e74e
-
-# refactor(imports): move collections.abc names out of typing (#35495)
-397e8e4918777e4e60a7f5e88699e0a9a7dabb3d
-
-# refactor(lint): apply every safe ruff autofix and zero 28 strict-rule budgets (#35495)
-b604e2b20c6db2099085a2f0e59b7e99e87eed6f
-
-# refactor(logging): drop redundant !s conversion flags from f-strings (#35546)
-7b2d3440cba3160277470f7a0180098ae9b87864
-
-# perf: build log messages lazily so filtered-out log records cost nothing (#35703)
-c9887a1f94bc1e7e4bdfe64d640f0509a0bc19dd
-
-# feat(lint): enforce Final on locals and freeze function parameters (#35807)
-2708620d6a599cc73c1950a942d26ac26a7ed3d4
-
-# chore(lint): remove litellm/types from the ruff lint exclusion (#35926)
-4e32a8bf6a1e1af1e04b67c759841ccef44b2235
-
-# chore(lint): strip inert type: ignore comments and zero LIT009/LIT010/LIT011 headroom (#35928)
-338e411103ad5d7003e97f34f04fa36bca542dbe

.gitattributes

@@ -1,2 +1 @@
-*.ipynb linguist-vendored
-ui/litellm-dashboard/src/lib/http/schema.d.ts linguist-generated
+*.ipynb linguist-vendored

.githooks/commit-msg

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-#
-# commit-msg — enforce Conventional Commits 1.0.0
-#   https://www.conventionalcommits.org/en/v1.0.0/
-#
-# Subject format:  <type>(<scope>)!: <description>
-#   - <type> must be one of the angular types (feat, fix, ...)
-#   - (<scope>) is optional
-#   - !       is optional and marks a breaking change
-#   - <description> is mandatory and must be non-empty
-#
-# Bypass: commit with --no-verify.
-# Merge, revert, fixup!, squash!, and amend! messages are passed through.
-
-set -eu
-
-COMMIT_MSG_FILE="${1:-}"
-if [ -z "$COMMIT_MSG_FILE" ] || [ ! -f "$COMMIT_MSG_FILE" ]; then
-    echo "commit-msg: missing commit message file" >&2
-    exit 1
-fi
-
-# First non-comment, non-empty line is the subject.
-subject=""
-while IFS= read -r line || [ -n "$line" ]; do
-    case "$line" in
-        ''|'#'*) continue ;;
-    esac
-    subject="$line"
-    break
-done < "$COMMIT_MSG_FILE"
-
-if [ -z "$subject" ]; then
-    echo "commit-msg: empty commit message" >&2
-    exit 1
-fi
-
-# Pass-through commits generated by git itself.
-case "$subject" in
-    "Merge "*|"Revert \""*|"fixup! "*|"squash! "*|"amend! "*)
-        exit 0
-        ;;
-esac
-
-ALLOWED_TYPES="feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert"
-# Description must not start with an uppercase letter — kept in sync with the
-# subjectPattern in .github/workflows/conventional-commits.yml so the local
-# hook is the strictly tighter of the two gates. (Without this guard, a commit
-# like "feat: Add thing" passes locally but fails the PR-title CI check.)
-PATTERN="^(${ALLOWED_TYPES})(\([^)]+\))?!?: [^A-Z].*"
-
-if printf '%s' "$subject" | grep -Eq "$PATTERN"; then
-    exit 0
-fi
-
-cat >&2 <<EOF
-✗ Commit message does not follow Conventional Commits.
-
-  Got:      $subject
-
-  Expected: <type>(<scope>)!: <description>
-            (description must start with a lowercase letter)
-
-  Allowed types: feat, fix, docs, style, refactor, perf, test, build, ci, chore, revert
-  Examples:
-    feat(router): add weighted round-robin strategy
-    fix(bedrock): decouple STS region from aws_region_name
-    chore(deps): bump black to 26.3.1
-    refactor!: drop Python 3.8 support
-
-See https://www.conventionalcommits.org/en/v1.0.0/
-
-To bypass (use sparingly): git commit --no-verify
-EOF
-exit 1

.githooks/pre-push

@@ -1,92 +0,0 @@
-#!/usr/bin/env bash
-#
-# pre-push — enforce Conventional Branches
-#   https://conventional-branch.github.io/
-#
-# Branch format:  <type>/<description>
-#   <type> must be one of: feature, bugfix, hotfix, release, chore
-#
-# Protected branches (always allowed):
-#   - main
-#   - litellm_internal_staging
-#   - dependabot/*
-#   - gh-readonly-queue/*
-#
-# Tag pushes and branch deletions are skipped.
-# Bypass: git push --no-verify.
-
-set -eu
-
-ZERO_OID="0000000000000000000000000000000000000000"
-ZERO_OID_SHA256="0000000000000000000000000000000000000000000000000000000000000000"
-ALLOWED_TYPES="feature|bugfix|hotfix|release|chore"
-BRANCH_PATTERN="^(${ALLOWED_TYPES})/.+"
-
-PROTECTED_NAMES="main litellm_internal_staging"
-PROTECTED_PREFIXES="dependabot/ gh-readonly-queue/"
-
-is_protected() {
-    branch="$1"
-    for name in $PROTECTED_NAMES; do
-        if [ "$branch" = "$name" ]; then
-            return 0
-        fi
-    done
-    for prefix in $PROTECTED_PREFIXES; do
-        case "$branch" in "$prefix"*) return 0 ;; esac
-    done
-    return 1
-}
-
-invalid=""
-
-while read -r local_ref local_oid remote_ref remote_oid; do
-    # Branch deletion (no local commit being pushed).
-    if [ "$local_oid" = "$ZERO_OID" ] || [ "$local_oid" = "$ZERO_OID_SHA256" ]; then
-        continue
-    fi
-
-    # Only validate branch pushes; ignore tags and other ref namespaces.
-    case "$remote_ref" in
-        refs/heads/*) ;;
-        *) continue ;;
-    esac
-
-    branch="${remote_ref#refs/heads/}"
-
-    if is_protected "$branch"; then
-        continue
-    fi
-
-    if ! printf '%s' "$branch" | grep -Eq "$BRANCH_PATTERN"; then
-        invalid="$invalid $branch"
-    fi
-done
-
-if [ -n "$invalid" ]; then
-    cat >&2 <<EOF
-✗ Branch name does not follow Conventional Branches.
-
-  Invalid:$invalid
-
-  Expected: <type>/<description>
-
-  Allowed types: feature, bugfix, hotfix, release, chore
-  Examples:
-    feature/weighted-round-robin
-    bugfix/streaming-empty-chunks
-    chore/bump-deps
-    hotfix/auth-bypass
-
-  Protected (always allowed): main, litellm_internal_staging,
-  dependabot/*, gh-readonly-queue/*.
-
-See https://conventional-branch.github.io/
-
-Rename with: git branch -m <new-name>
-To bypass (use sparingly): git push --no-verify
-EOF
-    exit 1
-fi
-
-exit 0

.github/CODEOWNERS

@@ -1,10 +0,0 @@
-/ui/ @yuneng-berri @ryan-crabbe-berri
-/litellm/proxy/_experimental/out/ @yuneng-berri @ryan-crabbe-berri
-/ui/Dockerfile
-/ui/nginx.conf
-/ui/litellm-dashboard/src/lib/http/schema.d.ts
-/ui/litellm-dashboard/tsconfig.tsbuildinfo
-/model_prices_and_context_window.json @mateo-berri
-/litellm/model_prices_and_context_window_backup.json @mateo-berri
-/litellm-proxy-extras/litellm_proxy_extras/migrations/ @yuneng-berri @ryan-crabbe-berri
-/.github/CODEOWNERS @yuneng-berri

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -23,56 +23,30 @@ body:
       label: What happened?
       description: Also tell us, what did you expect to happen?
       placeholder: Tell us what you see!
+      value: "A bug happened!"
     validations:
       required: true
   - type: textarea
-    id: user-flow
+    id: steps-to-reproduce
     attributes:
-      label: User Flow
-      description: |
-        Two ordered lists, "Before a (hypothetical) fix" and "After a (hypothetical) fix", walking the same end user through the same task, written strictly from that user's seat. Every rule below applies.
-
-        - Describe the real application and the routes its users actually hit, not a generic scenario
-        - Lead each list with one plain sentence saying where the flow fails (before) or would succeed (after), then number the steps
-        - Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
-        - No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
-        - Keep the two lists step-for-step identical until they diverge, so the broken step is obvious
-        - If the bug has a security or authorization consequence, end each list with what another user can do that they shouldn't be able to, and what they could no longer do after a fix
+      label: Steps to Reproduce
+      description: Please provide detailed steps to reproduce this bug(A curl/python code to reproduce the bug)
       placeholder: |
-        Before a (hypothetical) fix: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
-
-        1. They send POST https://litellm-domain/v1/chat/completions with "stream": true and no stream_options
-        2. The last SSE chunk arrives with "usage": null, so their app records 0 prompt and 0 completion tokens
-        3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
-
-        After a (hypothetical) fix: the same request comes back with real token counts, so the dashboard shows real spend
-
-        1. The proxy admin sets always_include_stream_usage: true and restarts the proxy
-        2. The developer sends the same POST https://litellm-domain/v1/chat/completions with "stream": true and no stream_options
-        3. The last SSE chunk now carries a usage object with real prompt and completion token counts
-        4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
+        1. config.yaml file/ .env file/ etc.
+        2. Run the following code...
+        3. Observe the error...
+      value: |
+        1. 
+        2. 
+        3. 
     validations:
       required: true
   - type: textarea
-    id: proof-of-bug
+    id: logs
     attributes:
-      label: Proof the bug occurs
-      description: |
-        The commands (e.g., curl) and their full output, screenshots, or a screen recording demonstrating that the bug happens. Every rule below applies.
-
-        - The proof must be completely e2e with no mocks, against a live proxy you ran yourself (e.g., `litellm --config config.yaml --detailed_debug` on localhost:4000), hitting real LLM provider APIs, costing real $ if needed, where the bug involves a provider call. `pytest` commands are not enough
-        - Show exactly what the end user sees or does, matching the User Flow above step for step
-        - Start with the config.yaml (or SDK setup) and any env vars the proxy ran with, then the exact version or commit hash the proof was captured at, so a maintainer can stand up the same proxy before running your commands. Keep the real values for env vars that aren't sensitive, they are often the reason the bug happens, and redact only the secrets: never paste a real API key, virtual key, database URL, or other credential, here or anywhere else in the issue
-        - If the bug applies to more than one of the LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), include proof for every one of them, not just one
-        - For UI bugs: include screenshots and the page URLs you were on. Scrub keys and tokens out of screenshots too (for example, the virtual key is briefly shown in the panel right after you create a virtual key)
-      placeholder: |
-        Config / setup the proxy ran with:
-
-        Version or commit:
-
-        Commands and their full output:
-    validations:
-      required: true
+      label: Relevant log output
+      description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks.
+      render: shell
   - type: dropdown
     id: component
     attributes:

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -24,53 +24,10 @@ body:
     validations:
       required: true
   - type: textarea
-    id: user-flow
+    id: motivation
     attributes:
-      label: User Flow
-      description: |
-        Two ordered lists, "Before this feature (today)" and "After this feature (ideal user flow)", walking the same end user through the same task, written strictly from that user's seat. Every rule below applies.
-
-        - Describe the real application and the routes its users actually hit, not a generic scenario. Link any related GitHub issue or provider API docs
-        - Lead each list with one plain sentence saying where the flow dead-ends today and what it would let them do instead, then number the steps
-        - Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
-        - No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. Ask for the behavior you need, not the implementation you imagine
-        - Keep the two lists step-for-step identical until they diverge, so the missing capability is obvious
-        - "Before this feature" is also where you show the workaround you're living with, which is what tells us how badly this is needed
-      placeholder: |
-        Before this feature (today): a developer batching nightly summaries has no way to mark those calls as low priority, so they compete with live traffic for the same rate limit
-
-        1. They send POST https://litellm-domain/v1/chat/completions for 500 documents in a loop
-        2. Around document 120 they start getting 429s naming the rpm limit, and their user-facing chat app starts getting them too
-        3. Their workaround is a hand-rolled sleep between calls, which stretches the batch to 3 hours and still collides at peak
-
-        After this feature (ideal user flow): the same batch runs as background work that yields to live traffic
-
-        1. The developer sends the same POST with "service_tier": "flex"
-        2. Batch calls queue behind interactive ones instead of 429ing, and the response comes back with the tier it was served at
-        3. The live chat app keeps returning 200s throughout the batch
-        4. https://litellm-domain/ui/?page=logs shows the batch requests tagged with that tier
-    validations:
-      required: true
-  - type: textarea
-    id: how-far-you-got
-    attributes:
-      label: How far you got
-      description: |
-        Run as many steps of the "After this feature (ideal user flow)" list as you can against a live proxy you ran yourself (e.g., `litellm --config config.yaml --detailed_debug` on localhost:4000), then paste the commands (e.g., curl) and their full output, ending at the step that dead-ends. Every rule below applies.
-
-        - Say plainly what stopped you there, in user terms: the option you passed came back ignored, the response 400'd naming an unsupported field, there is no button on the page for it. This is what proves the feature is genuinely missing rather than undocumented
-        - No mocks. Where the flow involves a provider call, hit the real provider API, even if it costs real $. `pytest` commands are not enough
-        - Include the config.yaml (or SDK setup) and env vars the proxy ran with, plus the version or commit you were on. Keep the real values for env vars that aren't sensitive, and redact only the secrets: never paste a real API key, virtual key, database URL, or other credential, here or anywhere else in the issue
-        - If the provider already supports this, link their API docs and paste a direct call to them succeeding, so we can see the shape LiteLLM should be sending
-        - For UI asks: include screenshots of the page you got stuck on and its URL. Scrub keys and tokens out of screenshots too (for example, the virtual key is briefly shown in the panel right after you create a virtual key)
-      placeholder: |
-        Config / setup the proxy ran with:
-
-        Version or commit:
-
-        Commands and their full output, up to the step that dead-ends:
-
-        What stopped me there:
+      label: Motivation, pitch
+      description: Please outline the motivation for the proposal. Is your feature request related to a specific problem? e.g., "I'm working on X and would like Y to be possible". If this is related to another GitHub issue, please link here too.
     validations:
       required: true
   - type: dropdown

.github/actions/cache-cargo-build/action.yml

@@ -1,31 +0,0 @@
-name: "Cache the Rust build"
-description: >-
-  Cache the Cargo registry and target directory the root package's build needs,
-  so only the first job on a given Cargo.lock compiles the bridge from scratch.
-
-  litellm builds through maturin, which compiles litellm-rust/crates/python-bridge
-  in release mode before it can produce a wheel. `uv sync` therefore pays a full
-  build in every job that installs the workspace: measured at 2m40s per unit shard
-  on 2026-08-21, more than the whole unit tier spends running tests. Nothing caught
-  it, because the uv cache holds wheels uv downloads rather than wheels it builds,
-  and a path dependency whose source moves every commit could never hit that cache
-  anyway. Cargo rebuilds only what changed when its target directory survives, so a
-  warm job pays for the bridge crate alone.
-
-  The key namespace is separate from test-rust.yml's. Both cache the same directory,
-  but that workflow fills it with debug and clippy artifacts, which a release build
-  cannot reuse, and a shared key would let whichever ran first deny the other a save.
-
-runs:
-  using: composite
-  steps:
-    - name: Restore the Cargo registry and target directory
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        path: |
-          ~/.cargo/registry
-          ~/.cargo/git
-          litellm-rust/target
-        key: ${{ runner.os }}-cargo-release-${{ hashFiles('litellm-rust/Cargo.lock') }}
-        restore-keys: |
-          ${{ runner.os }}-cargo-release-

.github/actions/cache-prisma-binaries/action.yml

@@ -1,40 +0,0 @@
-name: "Cache Prisma binaries"
-description: >-
-  Cache the Prisma CLI and engine binaries that `prisma generate` downloads, so
-  only the first job on a given prisma-client-py version pays for the download.
-
-  prisma-client-py shells out to `npm install prisma@<version>` whenever its
-  binary cache directory has no CLI entrypoint, which pulls ~85 MB of query and
-  schema engines over the network. That normally takes a few seconds, but it is
-  unbounded: one shard of a proxy-db run took 5m18s on that single step versus
-  3.8s on its eleven siblings, which pushed the job past its timeout and got a
-  fully passing test run cancelled.
-
-  Callers must not set PRISMA_BINARY_CACHE_DIR. The prisma-client-py default
-  (~/.cache/prisma-python/binaries/<prisma-version>/<engine-version>) is already
-  keyed by both versions, so a cache entry can never be served to a run that
-  expects different binaries.
-
-runs:
-  using: composite
-  steps:
-    - name: Resolve prisma-client-py version
-      id: version
-      shell: bash
-      run: |
-        version="$(grep -A1 '^name = "prisma"$' uv.lock | sed -n 's/^version = "\(.*\)"$/\1/p' | head -1)"
-        if [ -z "${version}" ]; then
-          echo "could not resolve the prisma package version from uv.lock" >&2
-          exit 1
-        fi
-        echo "version=${version}" >> "$GITHUB_OUTPUT"
-
-    - name: Restore Prisma binaries
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-      with:
-        # ~/.cache/prisma-python holds the npm install tree prisma-client-py
-        # drives; ~/.cache/prisma is where @prisma/engines stages its downloads.
-        path: |
-          ~/.cache/prisma-python
-          ~/.cache/prisma
-        key: ${{ runner.os }}-prisma-binaries-${{ steps.version.outputs.version }}

.github/actions/detect-changes/action.yml

@@ -1,41 +0,0 @@
-name: "Detect relevant changes"
-description: >-
-  Classify the pull request's changed files with .circleci/scripts/classify_changes.sh
-  and expose decision=run|skip for one category. backend means anything outside ui/,
-  docs/ and markdown; ui means the dashboard sources alone. decision=skip lets callers
-  short-circuit expensive steps while the job still completes successfully and satisfies
-  its required status check, which a paths: filter cannot do because a workflow that
-  never starts never reports. The file list comes from the pull request itself rather
-  than from a git diff, because the checked-out merge ref is recomputed as the base
-  branch advances and would otherwise attribute the base branch's own commits to the
-  pull request. The decision defaults to run for any non pull_request event or whenever
-  the changed set cannot be resolved, so jobs are never skipped when the classification
-  is uncertain.
-
-inputs:
-  category:
-    description: "Which classification to apply: backend, client or ui"
-    required: false
-    default: backend
-  github-token:
-    description: "Token used to list the pull request's files; needs pull-requests: read"
-    required: false
-    default: ${{ github.token }}
-
-outputs:
-  decision:
-    description: "run when category-relevant files changed, otherwise skip"
-    value: ${{ steps.classify.outputs.decision }}
-
-runs:
-  using: composite
-  steps:
-    - id: classify
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.github-token }}
-        CATEGORY: ${{ inputs.category }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ github.event.pull_request.number }}
-        CHANGED_FILE_COUNT: ${{ github.event.pull_request.changed_files }}
-      run: bash "${GITHUB_ACTION_PATH}/../../scripts/detect_changes.sh"

.github/actions/helm-oci-chart-releaser/action.yml

@@ -0,0 +1,94 @@
+name: Helm OCI Chart Releaser
+description: Push Helm charts to OCI-based (Docker) registries
+author: sergeyshaykhullin
+branding:
+  color: yellow
+  icon: upload-cloud
+inputs:
+  name:
+    required: true
+    description: Chart name
+  repository:
+    required: true
+    description: Chart repository name
+  tag:
+    required: true
+    description: Chart version
+  app_version:
+    required: true
+    description: App version
+  path:
+    required: false
+    description: Chart path (Default 'charts/{name}')
+  registry:
+    required: true
+    description: OCI registry
+  registry_username:
+    required: true
+    description: OCI registry username
+  registry_password:
+    required: true
+    description: OCI registry password
+  update_dependencies:
+    required: false
+    default: 'false'
+    description: Update chart dependencies before packaging (Default 'false')
+outputs:
+  image:
+    value: ${{ steps.output.outputs.image }}
+    description: Chart image (Default '{registry}/{repository}/{image}:{tag}')
+runs:
+  using: composite
+  steps:
+    - name: Helm | Setup
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+      with:
+        version: v3.20.0
+
+    - name: Helm | Login
+      shell: bash
+      env:
+        REGISTRY_PASSWORD: ${{ inputs.registry_password }}
+        REGISTRY_USERNAME: ${{ inputs.registry_username }}
+        REGISTRY: ${{ inputs.registry }}
+      run: echo "$REGISTRY_PASSWORD" | helm registry login -u "$REGISTRY_USERNAME" --password-stdin "$REGISTRY"
+
+    - name: Helm | Dependency
+      if: inputs.update_dependencies == 'true'
+      shell: bash
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+      run: helm dependency update "$CHART_PATH"
+
+    - name: Helm | Package
+      shell: bash
+      env:
+        CHART_PATH: ${{ inputs.path == null && format('{0}/{1}', 'charts', inputs.name) || inputs.path }}
+        TAG: ${{ inputs.tag }}
+        APP_VERSION: ${{ inputs.app_version }}
+      run: helm package "$CHART_PATH" --version "$TAG" --app-version "$APP_VERSION"
+
+    - name: Helm | Push
+      shell: bash
+      env:
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+      run: helm push "${NAME}-${TAG}.tgz" "oci://${REGISTRY}/${REPOSITORY}"
+
+    - name: Helm | Logout
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+      run: helm registry logout "$REGISTRY"
+
+    - name: Helm | Output
+      id: output
+      shell: bash
+      env:
+        REGISTRY: ${{ inputs.registry }}
+        REPOSITORY: ${{ inputs.repository }}
+        NAME: ${{ inputs.name }}
+        TAG: ${{ inputs.tag }}
+      run: echo "image=${REGISTRY}/${REPOSITORY}/${NAME}:${TAG}" >> $GITHUB_OUTPUT

.github/actions/setup-uv-with-retries/action.yml

@@ -1,47 +0,0 @@
-name: "Set up uv with retries"
-description: >-
-  Install uv via astral-sh/setup-uv, retrying on transient failures. Even with
-  an exact pinned version, the action resolves the artifact URL by fetching
-  https://raw.githubusercontent.com/astral-sh/versions/main/v1/uv.ndjson in a
-  single request with no retry, timeout, or fallback, so one connection-level
-  network error ("fetch failed") fails the whole job before any test runs.
-  Retrying the full step covers the manifest fetch and the binary download.
-
-inputs:
-  version:
-    description: "uv version to install"
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Set up uv (attempt 1)
-      id: attempt-1
-      continue-on-error: true
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      with:
-        version: ${{ inputs.version }}
-
-    - name: Wait before attempt 2
-      if: steps.attempt-1.outcome == 'failure'
-      shell: bash
-      run: sleep 15
-
-    - name: Set up uv (attempt 2)
-      id: attempt-2
-      if: steps.attempt-1.outcome == 'failure'
-      continue-on-error: true
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      with:
-        version: ${{ inputs.version }}
-
-    - name: Wait before attempt 3
-      if: steps.attempt-2.outcome == 'failure'
-      shell: bash
-      run: sleep 30
-
-    - name: Set up uv (attempt 3)
-      if: steps.attempt-2.outcome == 'failure'
-      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
-      with:
-        version: ${{ inputs.version }}

.github/ci-coverage-allowlist.yml

@@ -1,107 +0,0 @@
-description: >-
-  Paths deliberately outside CI coverage, each with the reason it is exempt.
-  assert_ci_coverage.py fails when a test file or Dockerfile is neither invoked
-  by a job nor listed here, so every entry below is a decision on the record.
-
-test_paths:
-  - reason: >-
-      What is left of the caching suite in tests/local_testing that runs nowhere. Every job that
-      globs that directory either deselects it (local_testing_part1 and part2 carry `-k "... and
-      not caching and not cache"`) or keeps only another keyword (langfuse, router, assistants),
-      and no job names these files the way redis_caching_unit_tests names test_dual_cache.py.
-      The gap was eight files and 118 tests when measured 2026-08-20; the five keyless ones now
-      run in the caching-local shard, leaving these three. Measured 2026-08-21 with no provider
-      credentials and no Redis: test_caching.py needs both (37 of 65 fail without them),
-      test_disk_cache_unit_tests.py needs OPENAI_API_KEY for 2 of its 4, and
-      test_gcs_cache_unit_tests.py needs GCS credentials for all 4. They want the keyless/live
-      split that porting tests/local_testing off CircleCI will force, not a job that is red by
-      construction
-    paths:
-      - tests/local_testing/test_caching.py
-      - tests/local_testing/test_disk_cache_unit_tests.py
-      - tests/local_testing/test_gcs_cache_unit_tests.py
-  - reason: >-
-      The end-to-end suite runs against a deployed proxy from its own in-cluster rig rather than
-      from a pull request; it needs a live gateway and provider credentials no PR job holds
-    paths:
-      - tests/e2e
-  - reason: >-
-      The documentation and code-quality workflows execute four files in this directory by name as
-      scripts and pytest never collects the directory, so these six run nowhere; listed individually
-      so a seventh cannot inherit the exemption
-    paths:
-      - tests/documentation_tests/test_exception_types.py
-      - tests/documentation_tests/test_general_setting_keys.py
-      - tests/documentation_tests/test_optional_params.py
-      - tests/documentation_tests/test_readme_providers.py
-      - tests/documentation_tests/test_requests_lib_usage.py
-      - tests/documentation_tests/test_standard_logging_payload.py
-  - reason: >-
-      Named like a test but shaped like a benchmark: it fetches live image URLs, times aiohttp
-      against httpx, prints the ratio, and asserts nothing, so pytest cannot collect it (its
-      functions take arguments, not fixtures) and running it beside its siblings in the
-      code-quality workflow would add a network dependency for a number nothing reads. Exempt
-      as a script rather than as an unresolved gap; revisit by deleting it once the aiohttp
-      choice it informed is settled
-    paths:
-      - tests/code_coverage_tests/test_aio_http_image_conversion.py
-  - reason: >-
-      No job invokes this suite and its files mix pure transformation tests with ones driving live
-      vendor vector stores, so assigning them needs a per-file decision
-    paths:
-      - tests/vector_store_tests/rag/test_rag_bedrock.py
-      - tests/vector_store_tests/rag/test_rag_openai.py
-      - tests/vector_store_tests/rag/test_rag_s3_vectors.py
-      - tests/vector_store_tests/rag/test_rag_vertex_ai.py
-      - tests/vector_store_tests/test_azure_ai_vector_store.py
-      - tests/vector_store_tests/test_azure_vector_store.py
-      - tests/vector_store_tests/test_bedrock_vector_store.py
-      - tests/vector_store_tests/test_gemini_vector_store.py
-      - tests/vector_store_tests/test_milvus_vector_store.py
-      - tests/vector_store_tests/test_openai_vector_store.py
-      - tests/vector_store_tests/test_ragflow_vector_store.py
-      - tests/vector_store_tests/test_s3_vectors_vector_store.py
-      - tests/vector_store_tests/test_vertex_ai_search_api_vector_store.py
-      - tests/vector_store_tests/test_vertex_ai_vector_store.py
-  - reason: >-
-      Throughput and memory-growth measurements whose runtime and variance make them unsuitable for
-      a per-pull-request job
-    paths:
-      - tests/load_tests/test_datadog_load_test.py
-      - tests/load_tests/test_langsmith_load_test.py
-      - tests/load_tests/test_linear_memory_growth.py
-      - tests/load_tests/test_memory_usage.py
-      - tests/load_tests/test_otel_load_test.py
-      - tests/load_tests/test_vertex_embeddings_load_test.py
-      - tests/load_tests/test_vertex_load_tests.py
-  - reason: >-
-      A local-only agent rig: test_a2a_completion_bridge.py needs a LangGraph server on
-      localhost:2024 and test_a2a.py drives a live A2A endpoint, so neither can run in a
-      pull request job. Until 2026-08-20 the CircleCI agent job hid them behind a grep -v
-      that this census could not see; the glob now excludes them structurally and this entry
-      is the decision on the record. Revisit when the A2A bridge gets a recorded-wire fixture
-    paths:
-      - tests/agent_tests/local_only_agent_tests
-  - reason: >-
-      Third-party integration tests that skip themselves without OCI configuration or sandbox
-      credentials, neither of which a pull request job holds
-    paths:
-      - tests/integration/sandbox/test_e2b_sandbox.py
-      - tests/integration/test_oci_integration.py
-      - tests/integration/test_oci_proxy_integration.py
-
-dockerfiles:
-  - reason: >-
-      The dashboard container is a static Next.js export served by nginx, and the dashboard build
-      and lint workflows already exercise that output, so building the image adds no signal about it
-    paths:
-      - ui/Dockerfile
-  - reason: >-
-      The Rust gateway ships as its own chart and package with a separate release pipeline, so its
-      image is not part of this repo's Python image set
-    paths:
-      - litellm-rust/crates/ai-gateway/Dockerfile
-  - reason: >-
-      An example image under cookbook/ that is documentation rather than a shipped artifact
-    paths:
-      - cookbook/litellm-ollama-docker-image/Dockerfile

.github/mutmut-coverage.rc

@@ -1,5 +0,0 @@
-# mutmut's gather_coverage() looks covered lines up by absolute path, so the
-# repo's `relative_files = true` makes every lookup miss and mutmut generates
-# zero mutants. Point COVERAGE_RCFILE here for mutation runs only.
-[run]
-relative_files = false

.github/pull_request_template.md

@@ -1,103 +1,43 @@
-<!-- The whole description's target audience is humans, not AI agents: write it in plain, simple,
-     everyday engineering language, extremely parsable and readable at a glance. This goes double for
-     the TLDR, User Flow, and Caveats sections -->
-
-## TLDR
-
-<!-- Fill in the bullets below and keep each one short and concrete: one line per bullet, roughly 10 words max -->
-
-Problem this solves:
-
-- <blah>
-- ...
-
-How it solves it:
-
-- <blah>
-- ...
-
-## User Flow
-
-<!-- Two ordered lists, Before and After, walking the same end user through the same task, written strictly from that user's seat
-     Read the linked issue, ticket, or customer thread first so the flow reflects the real application and the routes its users actually hit; don't invent a generic scenario
-     Lead each list with one plain sentence saying where the flow fails (Before) or succeeds (After), then number the steps
-     Every step is something the user does or observes: the HTTP method and full URL they hit, what they sent, and what visibly came back (status code, error text, the shape of an ID). UI steps name the page URL and what is on screen
-     No LiteLLM internals: never name functions, files, DB tables, config classes, hooks, callbacks, or code paths. "The upload hands back an ID that looks like OpenAI's own `file-abc123` instead of the scrambled one the gateway returned" is right, "no managed-file row was registered" is wrong
-     Keep the two lists step-for-step identical until they diverge, so the changed step is obvious
-     If the bug had a security or authorization consequence, end each list with what another user could or could no longer do
-     Regenerate this section whenever new commits change the PR's behavior, so it never describes an older revision
-
-Example:
-
-Before: a developer whose app streams chat completions gets no token counts back, so their cost dashboard reads zero
-
-1. They send POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
-2. The last SSE chunk arrives with `"usage": null`, so their app records 0 prompt and 0 completion tokens
-3. They open https://litellm-domain/ui/?page=logs and see the request logged at $0 spend
-
-After: the same request comes back with real token counts, so the dashboard shows real spend
-
-1. The proxy admin sets `always_include_stream_usage: true` and restarts the proxy
-2. The developer sends the same POST https://litellm-domain/v1/chat/completions with `"stream": true` and no `stream_options`
-3. The last SSE chunk now carries a `usage` object with real prompt and completion token counts
-4. https://litellm-domain/ui/?page=logs shows that request at non-zero spend
--->
-
 ## Relevant issues
 
-<!-- e.g., "Fixes #000" -->
-
-## Linear ticket
-
-<!-- if you are an internal contributor, add "Resolves " followed by the Linear ticket e.g., "Resolves LIT-1234" to link the Linear ticket to the GitHub PR. If you don't have one, leave the section blank rather than guessing -->
+<!-- e.g. "Fixes #000" -->
 
 ## Pre-Submission checklist
 
 **Please complete all items before asking a LiteLLM maintainer to review your PR**
 
-- [ ] I have added meaningful tests
-- [ ] The handful of test files covering my change pass locally, e.g. `uv run pytest tests/test_litellm/<your_test_file>.py -v`. Leave the suites (`make test-unit-*`, `make test-unit`) to CI: it finishes in ~15 minutes where a laptop takes an hour or more
-- [ ] My PR passes all required CI/CD checks (e.g., lint, schema.d.ts sync check, etc.)
-- [ ] My PR's scope is as isolated as possible; it only solves 1 specific problem
-- [ ] I have received a Greptile **Confidence Score of at least 4/5** before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment `@greptileai` to re-request a review after pushing changes)
+- [ ] I have Added testing in the [`tests/test_litellm/`](https://github.com/BerriAI/litellm/tree/main/tests/test_litellm) directory, **Adding at least 1 test is a hard requirement** - [see details](https://docs.litellm.ai/docs/extras/contributing_code)
+- [ ] My PR passes all unit tests on [`make test-unit`](https://docs.litellm.ai/docs/extras/contributing_code)
+- [ ] My PR's scope is as isolated as possible, it only solves 1 specific problem
+- [ ] I have requested a Greptile review by commenting `@greptileai` and received a **Confidence Score of at least 4/5** before requesting a maintainer review
 
 ## Delays in PR merge?
 
 If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slack (#pr-review)](https://join.slack.com/t/litellmossslack/shared_invite/zt-3o7nkuyfr-p_kbNJj8taRfXGgQI1~YyA).
 
+## CI (LiteLLM team)
+
+> **CI status guideline:**
+>
+> - 50-55 passing tests: main is stable with minor issues.
+> - 45-49 passing tests: acceptable but needs attention
+> - <= 40 passing tests: unstable; be careful with your merges and assess the risk.
+
+- [ ] **Branch creation CI run**  
+       Link:
+
+- [ ] **CI run for the last commit**  
+       Link:
+
+- [ ] **Merge / cherry-pick CI run**  
+       Links:
+
 ## Screenshots / Proof of Fix
 
-<!-- Include screenshots, screen recordings, or command (e.g., curl) + output demonstrating that your changes work as expected
-     The proof must be completely e2e with no mocks, using actual LLM calls costing real $$$ if applicable. `pytest` commands are not enough
-     Show ONLY the latest run: capture Before at the merge base and After at the PR's current tip, and when new commits change behavior, replace this whole section with the fresh run instead of stacking it on top of older ones. The run must be up to date. As soon as a new commit is made and it makes this PR description's after sha stale (it's no longer tip of PR), you must re-run the QA
-     Structure the section exactly as below: Before and After one heading level below this section, each naming the commit hash it was captured at, one lower-level heading per case inside each, the same case names in the same order on both sides, and numbered steps (command, observed output) under every case, never loose prose; shared setup (config, payloads) goes above Before, and with a single case, drop the case headings and number the steps directly
-
-### Before (<hash>)
-
-#### <case 1>
-
-1. ...
-2. ...
-
-#### <case 2>
-
-1. ...
-
-### After (<hash>)
-
-#### <case 1>
-
-1. ...
-2. ...
-
-#### <case 2>
-
-1. ...
-
-     For bug fixes: Before shows the reproduction, After shows the same steps passing
-     For new features: Before shows the capability missing, After shows it working end-to-end
-     If the change applies to all three LLM endpoints (/v1/responses, /v1/chat/completions, /v1/messages), make each endpoint its own case, not just one
-     For UI changes: before/after screenshots under the same headings -->
+<!-- Include screenshots, screen recordings, or log output demonstrating that your changes work as expected.
+     For bug fixes: show reproduction before the fix and passing behavior after.
+     For new features: show the feature working end-to-end.
+     For UI changes: include before/after screenshots. -->
 
 ## Type
 
@@ -111,44 +51,4 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 🚄 Infrastructure
 ✅ Test
 
-## Caveats (if any)
-
-<!-- Group caveats under severity subheadings (### Severe, ### High, ### Medium, ### Low), with
-     short bullet points inside each, just like the TLDR: one line per bullet, roughly 10 words max
-     Call out known limitations, follow-up work, or anything a reviewer should watch out for
-     Include only the tiers that have caveats; drop the empty ones
-     - Severe: inherent to what the PR deliberately ships, there even when the code works as intended:
-       it can degrade or take down a running deployment (e.g. a slow or table-locking boot migration),
-       rewrite data by design, break an existing workflow on purpose, or change auth behavior. An
-       operator must plan around it before rollout
-     - High: an unintended hole: a correctness, security, data-loss, or backward-compatibility bug,
-       unsafe to ship as is
-     - Medium: a real gap someone can hit, but with a workaround or a narrow blast radius
-     - Low: anything else worth noting: naming, cleanup, an edge case nobody hits
-     Nest bullets as deep as helps: hierarchy beats one long line when it makes things clearer to a
-     human reader
-     Leave this section empty if there are none -->
-
-## QA runbook
-
-<!-- Only needed when your PR edits tests/e2e; delete this section otherwise
-
-For each e2e test you added or changed, list the manual steps a reviewer can follow to reproduce it by hand against a live proxy, mapping 1:1 to what the test asserts: one top-level bullet per test giving its pytest node id followed by what it proves in plain words, then a nested "- [ ]" checklist where each item is a concrete action (route, request body, expected response) and the final item is the sanity-check step shown in the examples. Note environment prerequisites (provider credentials, config flags) and any nuances a manual run will hit. See PRs #32914 and #32963 for full examples
-
-Example checklists:
-
-- tests/e2e/quota_management/ratelimit/test_rate_limit_e2e.py::TestKeyRateLimits::test_rpm_limit_blocks_over_limit - a key allowed 2 requests a minute serves exactly 2 and refuses the 3rd
-  - [ ] Generate a limited key: curl -X POST http://localhost:4000/key/generate -H "Authorization: Bearer sk-1234" -d '{"rpm_limit": 2}'
-  - [ ] Send three /v1/chat/completions requests with that key inside one minute
-  - [ ] Expect the first two to return 200 and the third to return 429 naming the rpm limit
-  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
-
-- tests/e2e/management/test_management_e2e.py::TestModelRoutes::test_model_create_appears_in_ui - a deployment created through the API shows up on the Admin UI models page
-  - [ ] POST /model/new with the master key, a bedrock model, and aws_region_name (needs STORE_MODEL_IN_DB=True and AWS credentials)
-  - [ ] Open http://localhost:4000/ui/?page=models and expect a deployment row showing the returned model id
-  - [ ] Sanity check: this test makes sense to add and is not hand-wavey (e.g., assert actual expected spend instead of just spend > 0) or potentially flaky
--->
-
-## Final Attestation
-
-- [ ] The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR
+## Changes

.github/scripts/_agent_shin_actions.py

@@ -1,50 +0,0 @@
-"""Dry-run wrapper(s) around Agent Shin GitHub mutations.
-
-The rollout scripts currently need only one mutation wrapped, so this module
-exposes a single ``maybe_post_comment`` helper. It takes a ``dry_run: bool``
-keyword argument and the body is intentionally trivial:
-
-    if dry_run:
-        print(...)        # log what we would do, return
-        return
-    real_mutation(...)    # otherwise, actually do it
-
-That shape means a dry-run preview differs from the real run in exactly one
-line per side effect: the call site. So when you `python3 script.py` locally
-without ``--close``, you can be confident the actions printed are the ones the
-GitHub Action would have performed (modulo ordering on retry/error paths,
-which are deliberately simple). Any further mutation a rollout script needs
-should get the same ``maybe_*`` treatment instead of calling the raw
-``triage_with_llm`` mutation directly.
-
-Importing from this module pulls in the real mutation from ``triage_with_llm``
-— call sites in the rollout scripts should NEVER import ``post_comment``
-directly; that would skip the dry-run gate and is the bug class this module
-exists to prevent.
-"""
-
-from __future__ import annotations
-
-import sys
-import textwrap
-
-# Import the module itself rather than the bare names so monkeypatching
-# `triage_with_llm.post_comment` (or any of the other mutations) in tests is
-# reflected here — `from triage_with_llm import post_comment` would bind the
-# original function to a local name and bypass the patch, defeating the whole
-# point of these wrappers.
-import triage_with_llm
-
-
-def _log(line: str) -> None:
-    """Print a single dry-run line to stdout (one log statement per side effect)."""
-    print(line, file=sys.stdout, flush=True)
-
-
-def maybe_post_comment(repo: str, number: int, body: str, *, dry_run: bool) -> None:
-    """Post a comment on ``repo#number`` — or, in dry-run, log what we would post."""
-    if dry_run:
-        _log(f"[DRY RUN] comment {repo}#{number}:")
-        _log(textwrap.indent(body, "    "))
-        return
-    triage_with_llm.post_comment(repo, number, body)

.github/scripts/agent_shin_shared.py

@@ -1,211 +0,0 @@
-"""Constants and helpers shared by Agent Shin's triage scripts.
-
-Both `triage_with_llm.py` (the LLM-judge entrypoint) and
-`close_low_quality_prs.py` (the daily Greptile-score sweep) need to
-agree on the same notions of:
-
-  * What counts as a Greptile-authored review comment
-    (``GREPTILE_BOT_LOGINS``) and how to extract a confidence score from
-    its body (``SCORE_PATTERN`` / :func:`extract_greptile_score`).
-  * How long the 2-hour grace window is (``GRACE_PERIOD_SECONDS``) and
-    the HTML marker stamped into a grace-warning comment so the *other*
-    script can see "Agent Shin already warned" and behave accordingly
-    (``GRACE_COMMENT_MARKER``).
-  * Who Agent Shin is on GitHub (``AGENT_SHIN_DEFAULT_BOT_LOGIN``).
-  * How GitHub-style ISO-8601 timestamps round-trip into timezone-aware
-    :class:`datetime.datetime` (:func:`parse_iso8601`).
-
-Keeping these in one module means a future change (new Greptile output
-format, a longer grace window, a new allowlisted account) is a single edit
-instead of two — the original split version had to call out in comments
-that the two copies "must stay in sync" precisely because nothing
-enforced it.
-"""
-
-from __future__ import annotations
-
-import datetime as dt
-import json
-import os
-import re
-import subprocess
-from typing import Iterable
-
-GREPTILE_BOT_LOGINS = frozenset({"greptile-apps", "greptile-apps[bot]"})
-
-SCORE_PATTERN = re.compile(
-    r"confidence\s*score\s*[:\-]?\s*(\d+)\s*/\s*5",
-    re.IGNORECASE,
-)
-
-GRACE_COMMENT_MARKER = "<!-- agent-shin:grace-warning -->"
-
-# Hidden HTML marker stamped on every Agent Shin auto-close comment (the LLM
-# judge's grace/review-gate close and the daily Greptile sweep's close).
-# `was_closed_by_agent_shin` requires this marker — not just the closing actor —
-# before `@agent-shin reconsider` may reopen, because the `github-actions[bot]`
-# identity is shared with every other workflow in the repo and is not unique to
-# Agent Shin. Both close paths must stamp it or the reconsider path silently
-# rejects the contributor.
-AGENT_SHIN_CLOSE_MARKER = "<!-- agent-shin:closed -->"
-
-# 2 hours between the grace warning and the auto-close. Short enough to
-# dogfood the "fix it before it closes" loop in one sitting; bump back up
-# (e.g. 86400 for a day) for the public rollout.
-GRACE_PERIOD_SECONDS = 7200
-
-AGENT_SHIN_DEFAULT_BOT_LOGIN = "github-actions[bot]"
-
-
-def _logins(*names: str) -> frozenset[str]:
-    """Build a login set normalized for case-insensitive membership checks.
-
-    Callers compare via ``login.lower() in <set>``, so the stored values
-    must be lowercase. Normalizing here lets the literals keep each
-    account's canonical GitHub casing (e.g. ``SwiftWinds``) for
-    readability without breaking the lookup.
-    """
-    return frozenset(name.lower() for name in names)
-
-
-# Dogfood rollout gate. While this set is non-empty, Agent Shin acts ONLY on
-# PRs/issues authored by these logins and skips everyone else. For an
-# allowlisted author the usual internal/external classification is bypassed, so
-# an internal account (e.g. a maintainer's own work login) still gets triaged
-# while the bot is being tested on a small set of accounts. Empty the set to
-# lift the restriction and restore full triage for the public rollout. Logins
-# are compared case-insensitively.
-ALLOWLIST_LOGINS = _logins("mateo-berri", "SwiftWinds")
-
-# `gh {pr,issue} list` has no "fetch everything" flag — `--limit` is the only
-# control and it defaults to 30. Pass a ceiling far above any realistic open
-# backlog (low thousands today) so gh paginates the API until the queue is
-# exhausted rather than silently truncating. The bulk sweeps MUST see the whole
-# backlog: gh lists newest-first, so a low cap drops the *oldest* PRs/issues —
-# exactly the stale ones a low-quality sweep is meant to catch.
-GH_LIST_ALL_LIMIT = 100_000
-
-
-def extract_greptile_score(comments: Iterable[dict]) -> tuple[int, dict] | None:
-    """Return (score, comment) for the most recent Greptile-authored comment
-    that contains a "Confidence Score: X/5". Returns None if no such comment.
-
-    "Most recent" is determined by the comment's `updated_at` (falling back to
-    `created_at`), so re-reviews override earlier passes.
-    """
-    candidates: list[tuple[str, int, dict]] = []
-    for comment in comments:
-        user = (comment.get("user") or {}).get("login", "")
-        if user not in GREPTILE_BOT_LOGINS:
-            continue
-        body = comment.get("body") or ""
-        match = SCORE_PATTERN.search(body)
-        if not match:
-            continue
-        score = int(match.group(1))
-        timestamp = comment.get("updated_at") or comment.get("created_at") or ""
-        candidates.append((timestamp, score, comment))
-
-    if not candidates:
-        return None
-
-    candidates.sort(key=lambda triple: triple[0])
-    _, score, comment = candidates[-1]
-    return score, comment
-
-
-def parse_iso8601(value: str) -> dt.datetime:
-    """Parse a GitHub ISO-8601 timestamp into a timezone-aware datetime."""
-    return dt.datetime.fromisoformat(value.replace("Z", "+00:00"))
-
-
-def gh(*args: str) -> str:
-    """Run a `gh` CLI command and return stdout. Raises on non-zero exit.
-
-    Shared by both Agent Shin entrypoints so a future change here
-    (timeout handling, logging, retry on transient failures) only needs
-    to be made once.
-    """
-    result = subprocess.run(
-        ["gh", *args],
-        capture_output=True,
-        text=True,
-        check=True,
-    )
-    return result.stdout
-
-
-def list_open_items(kind: str, *, repo: str | None, fields: str) -> list[dict]:
-    """Return EVERY open PR (``kind="pr"``) or issue (``kind="issue"``) in ``repo``.
-
-    Wraps ``gh {pr,issue} list`` with ``--limit GH_LIST_ALL_LIMIT`` so the full
-    backlog is fetched instead of the default 30 (or any other arbitrary cap).
-    Both bulk sweeps — the daily Greptile closer and the one-shot rollout
-    heads-up — rely on this seeing the whole queue, including the oldest items.
-
-    ``fields`` is the comma-separated ``--json`` field list the caller needs
-    (e.g. ``"number"`` for the rollout, the full set for the closer).
-    """
-    if kind not in ("pr", "issue"):
-        raise ValueError(f"kind must be 'pr' or 'issue', got {kind!r}")
-    repo_args = ["--repo", repo] if repo else []
-    raw = gh(
-        kind,
-        "list",
-        "--state",
-        "open",
-        "--limit",
-        str(GH_LIST_ALL_LIMIT),
-        "--json",
-        fields,
-        *repo_args,
-    )
-    return json.loads(raw)
-
-
-def seconds_since_latest_marker_comment(
-    comments: Iterable[dict],
-    *,
-    marker: str,
-    bot_login: str | None = None,
-    now: dt.datetime | None = None,
-) -> float | None:
-    """Return seconds since the bot's most recent comment containing ``marker``.
-
-    Filters comments by author so a contributor who quotes the HTML
-    marker (e.g. via GitHub's "Quote reply" feature, which preserves
-    HTML comments in the raw markdown of the quoted text) is not
-    mistaken for a bot warning — that would silently reset cooldown
-    timers and suppress legitimate notifications.
-
-    ``bot_login`` defaults to the `AGENT_SHIN_BOT_LOGIN` env override or
-    ``AGENT_SHIN_DEFAULT_BOT_LOGIN`` so callers normally don't need to
-    pass it. ``now`` is injectable for tests / callers (like the daily
-    sweep) that want every age calculation pinned to one snapshot.
-    """
-    expected_login = (
-        bot_login
-        or os.environ.get("AGENT_SHIN_BOT_LOGIN")
-        or AGENT_SHIN_DEFAULT_BOT_LOGIN
-    ).lower()
-    latest: dt.datetime | None = None
-    for comment in comments:
-        author = ((comment.get("user") or {}).get("login") or "").lower()
-        if author != expected_login:
-            continue
-        body = comment.get("body") or ""
-        if marker not in body:
-            continue
-        created = comment.get("created_at")
-        if not created:
-            continue
-        try:
-            ts = parse_iso8601(created)
-        except ValueError:
-            continue
-        if latest is None or ts > latest:
-            latest = ts
-    if latest is None:
-        return None
-    reference = now if now is not None else dt.datetime.now(dt.timezone.utc)
-    return (reference - latest).total_seconds()

.github/scripts/assert_ci_coverage.py

@@ -1,543 +0,0 @@
-from __future__ import annotations
-
-import ast
-import operator
-import pathlib
-import re
-import sys
-import warnings
-from collections.abc import Callable, Iterable, Mapping, Sequence
-from dataclasses import dataclass
-from typing import Final
-
-import yaml
-
-REPO_ROOT = pathlib.Path(__file__).resolve().parents[2]
-WORKFLOW_DIR = REPO_ROOT / ".github" / "workflows"
-CIRCLECI_CONFIG = REPO_ROOT / ".circleci" / "config.yml"
-ALLOWLIST_FILE = REPO_ROOT / ".github" / "ci-coverage-allowlist.yml"
-TESTS_ROOT = REPO_ROOT / "tests"
-
-ALLOWLIST_KEYS = frozenset({"description", "test_paths", "dockerfiles"})
-PATH_FILTER_KEYS = frozenset({"paths", "paths-ignore"})
-TEST_PATH_KEYS = frozenset({"test-path", "test-paths"})
-DOCKERFILE_INPUT_KEYS = frozenset({"file", "dockerfile"})
-TEST_RUNNER_RE = re.compile(r"\bpytest\b|\bcircleci tests\b|\bhelm unittest\b|\bplaywright test\b|\bpython[0-9.]*\s")
-IMAGE_BUILD_RE = re.compile(r"\bdocker\s+(?:buildx\s+)?build\b")
-TEST_TOKEN_RE = re.compile(r"tests/[A-Za-z0-9_./*?-]+")
-DOCKERFILE_TOKEN_RE = re.compile(r"[A-Za-z0-9_./-]*Dockerfile[A-Za-z0-9_.-]*")
-COMMENT_RE = re.compile(r"^\s*#.*$", re.MULTILINE)
-GLOB_CHARS = frozenset("*?")
-
-# Trees whose jobs are sharded with no catch-all bucket, so every child that holds
-# tests has to be named by some shard or it runs nowhere. A child listed here is
-# itself decomposed one level deeper and is checked through its own entry.
-SHARDED_ROOTS: tuple[str, ...] = (
-    "tests/proxy_unit_tests",
-    "tests/test_litellm",
-    "tests/test_litellm/proxy",
-)
-
-
-@dataclass(frozen=True, slots=True)
-class AllowEntry:
-    paths: tuple[str, ...]
-    reason: str
-
-
-@dataclass(frozen=True, slots=True)
-class Allowlist:
-    test_paths: tuple[AllowEntry, ...]
-    dockerfiles: tuple[AllowEntry, ...]
-
-    def covers_test(self, relative_path: str) -> bool:
-        return any(_token_covers(path, relative_path) for entry in self.test_paths for path in entry.paths)
-
-    def covers_dockerfile(self, relative_path: str) -> bool:
-        return any(relative_path == path for entry in self.dockerfiles for path in entry.paths)
-
-
-@dataclass(frozen=True, slots=True)
-class Section:
-    name: str
-    entries: tuple[AllowEntry, ...]
-    candidates: tuple[str, ...]
-    matches: Callable[[str, str], bool]
-
-
-@dataclass(frozen=True, slots=True)
-class Scalar:
-    key: str
-    value: str
-
-
-@dataclass(frozen=True, slots=True)
-class Finding:
-    subject: str
-    detail: str
-
-
-def _scalars(node: object, key: str) -> tuple[Scalar, ...]:
-    if isinstance(node, str):
-        return (Scalar(key=key, value=node),)
-    if isinstance(node, Mapping):
-        return tuple(
-            scalar
-            for child_key, value in node.items()
-            if child_key not in PATH_FILTER_KEYS
-            for scalar in _scalars(value, str(child_key))
-        )
-    if isinstance(node, Sequence):
-        return tuple(scalar for item in node for scalar in _scalars(item, key))
-    return ()
-
-
-def _config_files() -> tuple[pathlib.Path, ...]:
-    workflows = tuple(sorted(path for path in WORKFLOW_DIR.iterdir() if path.suffix in (".yml", ".yaml")))
-    circleci = (CIRCLECI_CONFIG,) if CIRCLECI_CONFIG.is_file() else ()
-    return workflows + circleci
-
-
-def _all_scalars() -> tuple[Scalar, ...]:
-    return tuple(
-        scalar
-        for path in _config_files()
-        for scalar in _scalars(yaml.safe_load(path.read_text(encoding="utf-8")), path.name)
-    )
-
-
-def _uncommented(value: str) -> str:
-    return COMMENT_RE.sub("", value)
-
-
-def _invoked_test_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
-    return frozenset(
-        match.group(0).rstrip("/")
-        for scalar in scalars
-        if scalar.key in TEST_PATH_KEYS or TEST_RUNNER_RE.search(scalar.value)
-        for match in TEST_TOKEN_RE.finditer(_uncommented(scalar.value))
-    )
-
-
-def _built_dockerfile_tokens(scalars: Iterable[Scalar]) -> frozenset[str]:
-    return frozenset(
-        match.group(0)
-        for scalar in scalars
-        if scalar.key in DOCKERFILE_INPUT_KEYS or IMAGE_BUILD_RE.search(scalar.value)
-        for match in DOCKERFILE_TOKEN_RE.finditer(_uncommented(scalar.value))
-    )
-
-
-def _glob_to_regex(token: str, *, subtree: bool) -> re.Pattern[str]:
-    parts = re.split(r"(\*\*/|\*\*|\*|\?|\[[^\]]*\])", token)
-    translated = "".join(
-        {"**/": r"(?:.*/)?", "**": r".*", "*": r"[^/]*", "?": r"[^/]"}.get(part)
-        or (part if part.startswith("[") and part.endswith("]") else re.escape(part))
-        for part in parts
-    )
-    return re.compile(rf"{translated}(?:/.*)?$" if subtree else rf"{translated}$")
-
-
-def _token_covers(token: str, relative_path: str) -> bool:
-    if GLOB_CHARS & set(token):
-        return _glob_to_regex(token, subtree=True).match(relative_path) is not None
-    return relative_path == token or relative_path.startswith(f"{token}/")
-
-
-def _token_names(token: str, relative_path: str) -> bool:
-    """Whether the token names this path itself, rather than merely containing it.
-
-    A sharded tree has no catch-all bucket, so the ancestor token the census is happy
-    with (`tests/x` standing in for everything below it) is exactly what would let a
-    newly added child ride along without a shard.
-    """
-    if GLOB_CHARS & set(token):
-        return _glob_to_regex(token, subtree=False).match(relative_path) is not None
-    return token == relative_path
-
-
-def _test_files() -> tuple[str, ...]:
-    return tuple(
-        sorted(
-            path.relative_to(REPO_ROOT).as_posix()
-            for path in TESTS_ROOT.rglob("test_*.py")
-            if path.is_file() and "node_modules" not in path.parts
-        )
-    )
-
-
-def _dockerfiles() -> tuple[str, ...]:
-    return tuple(
-        sorted(
-            path.relative_to(REPO_ROOT).as_posix()
-            for path in REPO_ROOT.rglob("Dockerfile*")
-            if path.is_file()
-            and ".git" not in path.parts
-            and "node_modules" not in path.parts
-            and not path.name.endswith(".dockerignore")
-        )
-    )
-
-
-def _uncovered_tests(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
-    uncovered = tuple(
-        relative_path
-        for relative_path in _test_files()
-        if not any(_token_covers(token, relative_path) for token in tokens) and not allowlist.covers_test(relative_path)
-    )
-    directories = tuple(dict.fromkeys(path.rsplit("/", 1)[0] for path in uncovered))
-    return tuple(
-        Finding(
-            subject=directory,
-            detail=_describe(tuple(p for p in uncovered if p.rsplit("/", 1)[0] == directory)),
-        )
-        for directory in directories
-    )
-
-
-def _describe(paths: tuple[str, ...]) -> str:
-    names = ", ".join(path.rsplit("/", 1)[1] for path in paths[:3])
-    suffix = f", +{len(paths) - 3} more" if len(paths) > 3 else ""
-    return f"{len(paths)} test file(s) invoked by no job: {names}{suffix}"
-
-
-GLOB_CALL_RE = re.compile(r'circleci tests glob "([^"]+)"')
-KEYWORD_RE = re.compile(r"-k\s+\\?[\"']([^\"'\\]+)")
-
-
-@dataclass(frozen=True, slots=True)
-class Slice:
-    """One job's selection: the files it globs, narrowed by its `-k` expression."""
-
-    job: str
-    globs: tuple[str, ...]
-    named: frozenset[str]
-    required: tuple[str, ...]
-    excluded: tuple[str, ...]
-    understood: bool
-
-    def claims(self, relative_path: str, inner_names: frozenset[str]) -> bool:
-        """Whether this job runs any test in the file.
-
-        The question is deliberately per-file, not per-test. An excluded term is only
-        honoured when it appears in the path, because that is the case where it takes
-        the whole module with it; a term matching one function inside drops that test
-        and leaves the file claimed. Losing a whole file is the failure worth a gate,
-        and answering per-test would mean a baseline of test ids that churns on every
-        rename.
-        """
-        if relative_path in self.named:
-            return True
-        if not any(_token_covers(glob, relative_path) for glob in self.globs):
-            return False
-        if not self.understood:
-            return True  # a `-k` this parser cannot model is assumed to claim everything
-        if any(term.lower() in relative_path.lower() for term in self.excluded):
-            return False
-        return not self.required or any(
-            term.lower() in name.lower() for term in self.required for name in inner_names
-        )
-
-
-def _strings(node: object) -> Iterable[str]:
-    if isinstance(node, str):
-        yield node
-    elif isinstance(node, dict):
-        for value in node.values():
-            yield from _strings(value)
-    elif isinstance(node, list):
-        for value in node:
-            yield from _strings(value)
-
-
-def _keyword_terms(
-    expressions: Sequence[str], *, attributable: bool = True
-) -> tuple[tuple[str, ...], tuple[str, ...], bool]:
-    """A `-k` expression as (required, excluded, understood).
-
-    Only flat `and` chains of bare terms are modelled. Anything with `or`, parentheses
-    or negation of a group is left unmodelled, and its job is then treated as claiming
-    every file it globs, so an unparsed selector can never raise a false alarm.
-
-    `attributable` is False when a job runs several pytest commands, since a selector
-    read out of the job's text cannot then be tied to the glob it belongs to, and
-    pairing one command's exclusion with another's glob would invent a gap.
-    """
-    terms: Final = tuple(part.strip() for expression in expressions for part in expression.split(" and "))
-    if not attributable and terms:
-        return (), (), False
-    if any(("or " in term) or ("(" in term) or (term.startswith("not ") and " " in term[4:]) for term in terms):
-        return (), (), False
-    return (
-        tuple(term for term in terms if term and not term.startswith("not ")),
-        tuple(term[4:].strip() for term in terms if term.startswith("not ")),
-        True,
-    )
-
-
-def _slices() -> tuple[Slice, ...]:
-    if not CIRCLECI_CONFIG.exists():
-        return ()
-    jobs: Final = yaml.safe_load(CIRCLECI_CONFIG.read_text()).get("jobs", {})
-    return tuple(
-        Slice(job=job, globs=globs, named=named, required=required, excluded=excluded, understood=understood)
-        for job, body in jobs.items()
-        for text in ("\n".join(_strings(body)),)
-        if "pytest" in text
-        for globs in (tuple(GLOB_CALL_RE.findall(text)),)
-        for named in (frozenset(TEST_TOKEN_RE.findall(text)) & frozenset(_test_files()),)
-        for required, excluded, understood in (
-            _keyword_terms(tuple(KEYWORD_RE.findall(text)), attributable=len(globs) < 2),
-        )
-        if globs or named
-    )
-
-
-def _matchable_names(relative_path: str) -> frozenset[str]:
-    """Every name a `-k` term can match for this file: its path, plus the names inside it.
-
-    pytest matches a keyword against an item's own name and each of its parents', so a
-    positive term hits a file when it appears in the path or in a class or function name.
-    """
-    try:
-        with warnings.catch_warnings():
-            warnings.simplefilter("ignore")  # test files carry stray escapes; their names still parse
-            tree: Final = ast.parse((REPO_ROOT / relative_path).read_text())
-    except (OSError, SyntaxError):
-        return frozenset({relative_path})
-    return frozenset({relative_path}) | frozenset(
-        node.name
-        for node in ast.walk(tree)
-        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef))
-    )
-
-
-def _workflow_named_tokens() -> frozenset[str]:
-    """Test tokens a GitHub Actions job names directly.
-
-    A CircleCI `-k` that deselects a file no longer means the file runs nowhere once a
-    workflow names it, so the slice check has to credit those the same way the census does.
-    """
-    return _invoked_test_tokens(
-        scalar
-        for path in _config_files()
-        if path != CIRCLECI_CONFIG
-        for scalar in _scalars(yaml.safe_load(path.read_text(encoding="utf-8")), path.name)
-    )
-
-
-def _deselected_everywhere(allowlist: Allowlist) -> tuple[Finding, ...]:
-    slices: Final = _slices()
-    named_by_workflow: Final = _workflow_named_tokens()
-    globbed: Final = tuple(
-        path
-        for path in _test_files()
-        if any(_token_covers(glob, path) for slice_ in slices for glob in slice_.globs)
-    )
-    return tuple(
-        Finding(
-            subject=path,
-            detail="globbed by a job, then deselected by every one of their -k expressions",
-        )
-        for path in globbed
-        if not allowlist.covers_test(path)
-        and not any(_token_covers(token, path) for token in named_by_workflow)
-        and not any(slice_.claims(path, _matchable_names(path)) for slice_ in slices)
-    )
-
-
-def _holds_tests(directory: pathlib.Path) -> bool:
-    return any(directory.rglob("test_*.py"))
-
-
-def _shard_children(root: str, repo_root: pathlib.Path = REPO_ROOT) -> tuple[str, ...]:
-    """Children of a sharded root that carry tests, so each one needs its own shard.
-
-    A directory earns an entry by containing a test file rather than by being named
-    `test_*`, which is what keeps fixture directories (`test_configs`, `expected_*`)
-    out without a hand-maintained list of exceptions.
-    """
-    return tuple(
-        sorted(
-            child.relative_to(repo_root).as_posix()
-            for child in (repo_root / root).iterdir()
-            if not child.name.startswith(".")
-            and (
-                _holds_tests(child)
-                if child.is_dir()
-                else child.name.startswith("test_") and child.suffix == ".py"
-            )
-        )
-    )
-
-
-def _unassigned_shard_children(
-    tokens: frozenset[str],
-    roots: tuple[str, ...] = SHARDED_ROOTS,
-    repo_root: pathlib.Path = REPO_ROOT,
-) -> tuple[Finding, ...]:
-    return tuple(
-        Finding(subject=child, detail=f"holds tests but no shard of {root} names it")
-        for root in roots
-        if (repo_root / root).is_dir()
-        for child in _shard_children(root, repo_root)
-        if child not in roots and not any(_token_names(token, child) for token in tokens)
-    )
-
-
-def _uncovered_dockerfiles(allowlist: Allowlist, tokens: frozenset[str]) -> tuple[Finding, ...]:
-    return tuple(
-        Finding(subject=relative_path, detail="built by no job")
-        for relative_path in _dockerfiles()
-        if relative_path not in tokens and not allowlist.covers_dockerfile(relative_path)
-    )
-
-
-def _stale_allowlist_paths(
-    allowlist: Allowlist,
-    *,
-    test_files: tuple[str, ...],
-    dockerfiles: tuple[str, ...],
-) -> tuple[Finding, ...]:
-    sections: Final[tuple[Section, ...]] = (
-        Section("test_paths", allowlist.test_paths, test_files, _token_covers),
-        Section("dockerfiles", allowlist.dockerfiles, dockerfiles, operator.eq),
-    )
-    return tuple(
-        Finding(subject=path, detail=f"listed under '{section.name}' but matches no file the census looks at")
-        for section in sections
-        for entry in section.entries
-        for path in entry.paths
-        if not any(section.matches(path, candidate) for candidate in section.candidates)
-    )
-
-
-def _parse_entry(item: object, section: str) -> AllowEntry:
-    if not isinstance(item, dict):
-        raise SystemExit(f"{ALLOWLIST_FILE.name}: '{section}' entries must be mappings")
-    paths = item.get("paths")
-    reason = item.get("reason")
-    if (
-        not isinstance(paths, list)
-        or not paths
-        or not all(isinstance(path, str) for path in paths)
-        or not isinstance(reason, str)
-        or not reason.strip()
-    ):
-        raise SystemExit(
-            f"{ALLOWLIST_FILE.name}: every '{section}' entry needs a non-empty 'paths' "
-            "list of strings and a non-empty 'reason'"
-        )
-    return AllowEntry(paths=tuple(paths), reason=reason)
-
-
-def _parse_entries(raw: object, section: str) -> tuple[AllowEntry, ...]:
-    if not isinstance(raw, list):
-        raise SystemExit(f"{ALLOWLIST_FILE.name}: '{section}' must be a list")
-    return tuple(_parse_entry(item, section) for item in raw)
-
-
-def _load_allowlist() -> Allowlist:
-    if not ALLOWLIST_FILE.is_file():
-        return Allowlist(test_paths=(), dockerfiles=())
-    raw = yaml.safe_load(ALLOWLIST_FILE.read_text(encoding="utf-8")) or {}
-    if not isinstance(raw, dict):
-        raise SystemExit(f"{ALLOWLIST_FILE.name}: top level must be a mapping")
-    unknown = sorted(str(key) for key in raw if key not in ALLOWLIST_KEYS)
-    if unknown:
-        raise SystemExit(
-            f"{ALLOWLIST_FILE.name}: unknown top-level key(s) {unknown}; expected only {sorted(ALLOWLIST_KEYS)}"
-        )
-    return Allowlist(
-        test_paths=_parse_entries(raw.get("test_paths", []), "test_paths"),
-        dockerfiles=_parse_entries(raw.get("dockerfiles", []), "dockerfiles"),
-    )
-
-
-def _write(message: str) -> None:
-    sys.stdout.write(f"{message}\n")
-
-
-def _report(title: str, findings: tuple[Finding, ...], remedy: str) -> None:
-    _write(f"ERROR: {title}")
-    for finding in findings:
-        _write(f"  - {finding.subject}: {finding.detail}")
-    _write("")
-    _write(remedy)
-    _write("")
-
-
-def _check_slices() -> int:
-    findings: Final = _deselected_everywhere(_load_allowlist())
-    if findings:
-        _report(
-            "test files a -k expression removes from every job that globs them",
-            findings,
-            "Give each one a job whose -k keeps it, or list it in "
-            ".github/ci-coverage-allowlist.yml with the reason it may stay unrun.",
-        )
-        return 1
-
-    _write(f"OK: no test file is globbed by a job and then deselected by every -k across {len(_slices())} slices.")
-    return 0
-
-
-def _check_shards() -> int:
-    findings = _unassigned_shard_children(_invoked_test_tokens(_all_scalars()))
-    if findings:
-        _report(
-            "test directories and files that no shard claims",
-            findings,
-            "Add each to the shard it belongs to. A directory that is itself split across "
-            "several shards belongs in SHARDED_ROOTS instead, so its own children get checked.",
-        )
-        return 1
-
-    counted = sum(len(_shard_children(root)) for root in SHARDED_ROOTS if (REPO_ROOT / root).is_dir())
-    _write(f"OK: all {counted} test children across {len(SHARDED_ROOTS)} sharded trees are assigned to a shard.")
-    return 0
-
-
-def main() -> int:
-    if "--shards" in sys.argv[1:]:
-        return _check_shards()
-    if "--slices" in sys.argv[1:]:
-        return _check_slices()
-
-    allowlist = _load_allowlist()
-    scalars = _all_scalars()
-
-    test_findings = _uncovered_tests(allowlist, _invoked_test_tokens(scalars))
-    dockerfile_findings = _uncovered_dockerfiles(allowlist, _built_dockerfile_tokens(scalars))
-    stale_findings = _stale_allowlist_paths(allowlist, test_files=_test_files(), dockerfiles=_dockerfiles())
-
-    if stale_findings:
-        _report(
-            "allowlist entries that exempt nothing",
-            stale_findings,
-            "Delete each from .github/ci-coverage-allowlist.yml; the file it named is gone or was renamed.",
-        )
-    if test_findings:
-        _report(
-            "test files that no CI job invokes",
-            test_findings,
-            "Add each to a job's test path, or list it in .github/ci-coverage-allowlist.yml with a reason.",
-        )
-    if dockerfile_findings:
-        _report(
-            "Dockerfiles that no CI job builds",
-            dockerfile_findings,
-            "Build each in a workflow, or list it in .github/ci-coverage-allowlist.yml with a reason.",
-        )
-    if stale_findings or test_findings or dockerfile_findings:
-        return 1
-
-    _write(
-        f"OK: {len(_test_files())} test files and {len(_dockerfiles())} Dockerfiles are each "
-        "invoked by at least one job or carry an explicit allowlist entry."
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scripts/assert_workflow_dir_hygiene.py

@@ -1,149 +0,0 @@
-#!/usr/bin/env python3
-"""Three invariants about what lives in .github/workflows/ and what its names mean.
-
-`.github/workflows/` is a directory GitHub reads, not a place to keep things. Every
-file at its top level is parsed as a workflow, so a script or a data file parked there
-is either an invalid workflow or an orphan nobody can find. A subdirectory is not read
-at all, so helper files may live in one. GitHub accepts both `.yml` and `.yaml`, and
-this repo spells them `.yml`, which is a naming rule rather than a validity one and is
-reported separately. And the `_` prefix is the repo's only signal that a workflow is a
-reusable building block rather than something that runs on its own, which is worth
-nothing unless it is true both ways.
-
-    WF001   a top-level file in .github/workflows/ that is not a workflow at all
-    WF002   a workflow whose only trigger is `workflow_call` but is not `_`-prefixed
-    WF003   a `_`-prefixed workflow that no other workflow can call
-    WF004   a real workflow spelled `.yaml` where this directory spells them `.yml`
-
-A workflow with `workflow_call` alongside a human trigger is deliberately dual-mode
-and belongs under its plain name, so only the call-only ones are held to WF002.
-
-Usage
------
-    python assert_workflow_dir_hygiene.py
-
-Exit code 1 if any violation is found.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-from dataclasses import dataclass
-from typing import Final
-
-import yaml
-
-REPO_ROOT: Final = pathlib.Path(__file__).resolve().parents[2]
-WORKFLOW_DIR: Final = REPO_ROOT / ".github" / "workflows"
-SCRIPT_HOME: Final = ".github/scripts/"
-REUSABLE_PREFIX: Final = "_"
-CALL_TRIGGER: Final = "workflow_call"
-CANONICAL_SUFFIX: Final = ".yml"
-WORKFLOW_SUFFIXES: Final = frozenset((CANONICAL_SUFFIX, ".yaml"))
-
-
-@dataclass(frozen=True, slots=True)
-class Finding:
-    subject: str
-    code: str
-    detail: str
-
-    def render(self) -> str:
-        return f"  - {self.subject}: {self.code} {self.detail}"
-
-
-def _triggers(document: object) -> frozenset[str]:
-    if not isinstance(document, dict):
-        return frozenset()
-    raw: Final = document.get("on", document.get(True))
-    if isinstance(raw, str):
-        return frozenset({raw})
-    if isinstance(raw, dict):
-        return frozenset(str(key) for key in raw)
-    if isinstance(raw, list):
-        return frozenset(str(item) for item in raw)
-    return frozenset()
-
-
-def _workflows(directory: pathlib.Path) -> tuple[pathlib.Path, ...]:
-    return tuple(
-        path
-        for path in sorted(directory.iterdir())
-        if path.is_file() and path.suffix in WORKFLOW_SUFFIXES
-    )
-
-
-def _strays(directory: pathlib.Path) -> tuple[Finding, ...]:
-    return tuple(
-        Finding(
-            path.name,
-            "WF001",
-            f"is not a workflow, and GitHub parses every top-level file here as one; "
-            f"move it to {SCRIPT_HOME} or into a subdirectory, which GitHub does not read",
-        )
-        for path in sorted(directory.iterdir())
-        if path.is_file() and path.suffix not in WORKFLOW_SUFFIXES
-    )
-
-
-def _misspelled(directory: pathlib.Path) -> tuple[Finding, ...]:
-    return tuple(
-        Finding(
-            path.name,
-            "WF004",
-            f"is a real workflow and GitHub reads it, but this directory spells them "
-            f"{CANONICAL_SUFFIX}; rename it to {path.stem}{CANONICAL_SUFFIX}",
-        )
-        for path in _workflows(directory)
-        if path.suffix != CANONICAL_SUFFIX
-    )
-
-
-def _misnamed(directory: pathlib.Path) -> tuple[Finding, ...]:
-    return tuple(
-        finding
-        for path in _workflows(directory)
-        for finding in _naming_findings(path, _triggers(yaml.safe_load(path.read_text(encoding="utf-8"))))
-    )
-
-
-def _naming_findings(path: pathlib.Path, triggers: frozenset[str]) -> tuple[Finding, ...]:
-    underscored: Final = path.name.startswith(REUSABLE_PREFIX)
-    if triggers == frozenset({CALL_TRIGGER}) and not underscored:
-        return (
-            Finding(
-                path.name,
-                "WF002",
-                f"is only callable by another workflow, so name it {REUSABLE_PREFIX}{path.name}",
-            ),
-        )
-    if underscored and CALL_TRIGGER not in triggers:
-        return (
-            Finding(
-                path.name,
-                "WF003",
-                f"is named as a reusable workflow but has no {CALL_TRIGGER} trigger; "
-                "add one or drop the prefix",
-            ),
-        )
-    return ()
-
-
-def main() -> int:
-    findings: Final = _strays(WORKFLOW_DIR) + _misspelled(WORKFLOW_DIR) + _misnamed(WORKFLOW_DIR)
-    if not findings:
-        total: Final = len(_workflows(WORKFLOW_DIR))
-        sys.stdout.write(
-            f"OK: {total} workflows, every file in .github/workflows/ is one, and the "
-            f"{REUSABLE_PREFIX} prefix means callable in both directions.\n"
-        )
-        return 0
-    sys.stdout.write("ERROR: .github/workflows/ holds files that break its own conventions\n")
-    for finding in findings:
-        sys.stdout.write(f"{finding.render()}\n")
-    return 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scripts/close_low_quality_prs.py

@@ -1,573 +0,0 @@
-#!/usr/bin/env python3
-"""
-Auto-close low-quality pull requests.
-
-Closes open PRs (including drafts, regardless of age) that satisfy ALL of:
-  1. Have a Greptile (`greptile-apps`) review comment whose latest
-     "Confidence Score: X/5" is below the configured threshold (default: 4).
-  2. Are authored by an external OSS contributor (internal BerriAI
-     contributors are exempt).
-  3. Do not carry an opt-out label (default: "do not close").
-
-`--min-age-days` is retained as an opt-in safety net for one-off backfill
-runs (default: 0). The team's intent is that the count of open PRs equals
-the count of PRs internal collaborators need to action on, so neither age
-nor draft status acts as a free pass.
-
-For each match, the script posts an explanatory comment and closes the PR.
-Because OSS contributors *cannot* reopen a PR closed by the bot/maintainer
-(GitHub limitation), the close-comment instructs them to push their fixes
-and **open a fresh PR**, or to comment `@agent-shin reconsider` on the
-closed PR to have the LLM judge re-evaluate (and reopen on pass).
-
-Requires the `gh` CLI to be authenticated.
-
-Usage examples:
-    # Dry run (default) - prints what would be closed
-    python3 close_low_quality_prs.py
-
-    # Actually close matching PRs
-    python3 close_low_quality_prs.py --close
-
-    # Restrict to PRs at least N days old (one-off backfill safety net)
-    python3 close_low_quality_prs.py --min-age-days 7 --min-score 4 --close
-"""
-
-from __future__ import annotations
-
-import argparse
-import datetime as dt
-import json
-import os
-import subprocess
-import sys
-from typing import Iterable
-
-# Add this script's directory to `sys.path` so the sibling
-# `agent_shin_shared` module is importable when the script is invoked
-# directly (e.g. `python3 .github/scripts/close_low_quality_prs.py ...`).
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-
-from agent_shin_shared import (  # noqa: E402  -- sys.path adjusted above
-    AGENT_SHIN_CLOSE_MARKER,
-    ALLOWLIST_LOGINS,
-    GRACE_COMMENT_MARKER,
-    GRACE_PERIOD_SECONDS,
-    GREPTILE_BOT_LOGINS,
-    SCORE_PATTERN,
-    extract_greptile_score,
-    gh,
-    list_open_items,
-    parse_iso8601,
-    seconds_since_latest_marker_comment,
-)
-
-# `GREPTILE_BOT_LOGINS` and `SCORE_PATTERN` (Greptile's GitHub App login
-# variants and the "Confidence Score: X/5" regex) are imported from
-# `agent_shin_shared` so the LLM judge in `triage_with_llm.py` and this
-# daily Greptile sweep read the score through the same set of logins
-# and the same regex.
-
-# `author_association` values for internal BerriAI contributors who should be
-# exempt from auto-triage.
-INTERNAL_AUTHOR_ASSOCIATIONS = frozenset({"OWNER", "MEMBER", "COLLABORATOR"})
-
-# Default labels that exempt a PR from auto-close. Defined at module scope (not
-# as a mutable argparse default) so that `--optout-label foo` REPLACES the
-# defaults instead of appending to them — the argparse `action="append"` +
-# `default=[...]` combination silently mutates the shared default list.
-DEFAULT_OPTOUT_LABELS = ("do not close", "keep open", "wip")
-
-# `GRACE_COMMENT_MARKER` (HTML marker appended to grace-period warning
-# comments — used by either script to recognize that a warning was
-# already posted) and `GRACE_PERIOD_SECONDS` (length of the grace
-# period between the warning and the actual auto-close, 2 hours) are
-# imported from `agent_shin_shared` so the Agent Shin LLM judge and
-# this daily Greptile sweep agree on the same marker and duration.
-
-
-def fetch_open_prs(repo: str | None) -> list[dict]:
-    """Fetch all open PRs (number, createdAt, isDraft, labels, author).
-
-    Includes drafts: `gh pr list --state open` returns both ready-for-review
-    and draft PRs by default. This is the desired behavior — drafts are not
-    a free pass; the internal-collaborator open-PR queue should reflect every
-    PR that needs human attention regardless of draft status.
-    """
-    fields = "number,title,createdAt,isDraft,labels,author,url"
-    return list_open_items("pr", repo=repo, fields=fields)
-
-
-def fetch_pr_author_association(pr_number: int, repo: str | None) -> str:
-    """Return the GitHub `author_association` for a PR, uppercase.
-
-    Values: OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR,
-    FIRST_TIMER, MANNEQUIN, NONE. Returns "" on lookup failure.
-    """
-    endpoint = (
-        f"repos/{repo}/pulls/{pr_number}"
-        if repo
-        else f"repos/{{owner}}/{{repo}}/pulls/{pr_number}"
-    )
-    try:
-        data = json.loads(gh("api", endpoint))
-    except subprocess.CalledProcessError:
-        return ""
-    return (data.get("author_association") or "").upper()
-
-
-def is_external_pr_author(pr: dict, repo: str | None) -> bool:
-    """Return True if the PR author is an external OSS contributor.
-
-    Internal = `OWNER` / `MEMBER` / `COLLABORATOR` association, or a bot login.
-    """
-    login = ((pr.get("author") or {}).get("login") or "").lower()
-    if login.endswith("[bot]") or login in {"dependabot", "github-actions"}:
-        return False
-    association = fetch_pr_author_association(pr["number"], repo)
-    # Fail-safe: if the API lookup failed (empty string), treat the author as
-    # internal so we don't auto-close their PR. Auto-close is destructive, so
-    # an unknown association should never make a PR eligible for closing.
-    if not association or association in INTERNAL_AUTHOR_ASSOCIATIONS:
-        return False
-    return True
-
-
-def fetch_pr_comments(pr_number: int, repo: str | None) -> list[dict]:
-    """Fetch issue-level comments on a PR (where Greptile posts its summary)."""
-    endpoint = (
-        f"repos/{repo}/issues/{pr_number}/comments?per_page=100"
-        if repo
-        else f"repos/{{owner}}/{{repo}}/issues/{pr_number}/comments?per_page=100"
-    )
-    raw = gh("api", "--paginate", endpoint)
-    comments: list[dict] = []
-    for line in raw.strip().splitlines():
-        line = line.strip()
-        if not line:
-            continue
-        try:
-            parsed = json.loads(line)
-        except json.JSONDecodeError:
-            # A malformed line should not blow up the whole sweep. Skip and
-            # carry on so the remaining PRs in this run still get evaluated.
-            continue
-        if isinstance(parsed, list):
-            comments.extend(parsed)
-        else:
-            comments.append(parsed)
-    return comments
-
-
-def has_optout_label(pr: dict, optout_labels: set[str]) -> bool:
-    labels = {label.get("name", "").lower() for label in pr.get("labels", [])}
-    return bool(labels & {lbl.lower() for lbl in optout_labels})
-
-
-def seconds_since_last_grace_warning(
-    comments: Iterable[dict],
-    *,
-    bot_login: str | None = None,
-    now: dt.datetime | None = None,
-) -> float | None:
-    """Return seconds since the bot's most recent grace-period warning, or
-    None if no such warning has ever been posted on this PR.
-
-    Thin wrapper over
-    `agent_shin_shared.seconds_since_latest_marker_comment` — the
-    centralized helper handles the bot-author filter, marker match,
-    timestamp parsing, and `now` injection. Keeping this wrapper
-    preserves the closer's "already-fetched comments + injectable now"
-    interface so callers (and tests) don't need to change.
-    """
-    return seconds_since_latest_marker_comment(
-        comments,
-        marker=GRACE_COMMENT_MARKER,
-        bot_login=bot_login,
-        now=now,
-    )
-
-
-def format_grace_warning_comment(score: int, threshold: int) -> str:
-    """Comment posted on the FIRST low-Greptile-score detection — gives
-    the contributor a 2-hour grace window before the auto-close fires on
-    the next daily cron run.
-
-    Mirrors `format_grace_warning_pr_comment` in
-    `triage_with_llm.py` in spirit (2-hour grace + escape hatches), but
-    framed around Greptile's confidence score instead of the LLM judge's
-    rubric since the close trigger here is the Greptile signal.
-    """
-    return (
-        "🚅 Hi, thanks for the PR! I'm **Agent Shin**, the automated triage bot for this "
-        "repository.\n"
-        "\n"
-        "Heads up: Greptile's most recent review scored this PR "
-        f"**{score}/5**, below our merge bar of **{threshold}/5**.\n"
-        "\n"
-        "If the score isn't lifted in the next **2 hours**, I'll auto-close this PR. That's "
-        "**not** us saying the change isn't worthwhile. We want the open-PR list to mirror "
-        "what a maintainer can act on *right now*, so contributors like you don't get lost in "
-        "a backlog. Take your time; everything below still works after the close.\n"
-        "\n"
-        "**During the grace period:** push fixes that address Greptile's feedback, then comment "
-        "`@greptileai` to request a fresh review. If "
-        f"the new score is **{threshold}/5 or higher**, the PR stays open and no further "
-        "action is needed on your side.\n"
-        "\n"
-        "**If the PR does get auto-closed in 2 hours, you still have an easy recovery path:**\n"
-        "\n"
-        "- Comment `@greptileai` to request a fresh review. **This still works even after "
-        f"the PR is closed**, and a score of {threshold}/5 or higher is one of the signals "
-        "that lifts the PR back into the review queue. A low Greptile score isn't a blocker.\n"
-        "- Comment `@agent-shin reconsider` after pushing fixes; I'll re-run the rubric and "
-        "reopen the PR if both gates (description rubric + Greptile score) now pass.\n"
-        "\n"
-        f"{GRACE_COMMENT_MARKER}"
-    )
-
-
-def post_grace_warning(
-    pr: dict,
-    score: int,
-    threshold: int,
-    repo: str | None,
-    dry_run: bool,
-) -> None:
-    """Post the 2-hour grace-period warning comment on `pr`.
-
-    The warning carries `GRACE_COMMENT_MARKER` so subsequent runs can
-    detect that the contributor has already been told about the
-    pending close. Does NOT close the PR — the close happens on the
-    next eligible run after `GRACE_PERIOD_SECONDS` elapses (handled
-    by `close_pr`).
-    """
-    pr_number = pr["number"]
-    repo_args = ["--repo", repo] if repo else []
-
-    if dry_run:
-        print(
-            f"  [DRY RUN] Would post grace warning to PR #{pr_number} "
-            f"(greptile={score}/5): {pr['title']}"
-        )
-        return
-
-    comment_body = format_grace_warning_comment(score, threshold)
-    gh("pr", "comment", str(pr_number), "--body", comment_body, *repo_args)
-    print(f"  Posted grace warning on PR #{pr_number} (greptile={score}/5)")
-
-
-def format_close_comment(score: int, threshold: int) -> str:
-    """Comment posted when a low-Greptile-score PR is auto-closed.
-
-    Carries `AGENT_SHIN_CLOSE_MARKER` so the `@agent-shin reconsider` path
-    (guarded by `was_closed_by_agent_shin`) recognizes this as an Agent Shin
-    close and is allowed to reopen the PR once it passes again; without the
-    marker that recovery path the comment advertises silently rejects the
-    contributor.
-    """
-    score_sentence = (
-        f"Greptile's most recent review scored this PR **{score}/5**, below "
-        f"our merge bar of **{threshold}/5**, and the 2-hour grace period since "
-        "the warning has elapsed.\n\n"
-    )
-    return (
-        f"Closing as part of automated PR triage.\n\n"
-        f"{score_sentence}"
-        "We close low-confidence PRs aggressively to keep the review queue "
-        "manageable for maintainers and contributors alike. **This is not a "
-        "rejection of the idea.** To bring this back:\n\n"
-        "1. Push the fixes that address Greptile's feedback (continue using "
-        "your existing branch is fine).\n"
-        "2. **Open a new PR** with the updated branch. Greptile will review "
-        "it again, and if it scores "
-        f"**{threshold}/5 or higher** a maintainer will take another look.\n\n"
-        "_Why open a new PR instead of reopening this one?_ GitHub does not "
-        "let external contributors reopen a PR that was closed by a bot or "
-        "maintainer, so a fresh PR is the most reliable path forward. If you "
-        "would prefer this exact PR re-evaluated, comment "
-        "`@agent-shin reconsider` once you've pushed the fixes; Agent Shin "
-        "will re-run triage and reopen this PR if it now meets the bar. "
-        "You can also comment `@greptileai` to request a fresh Greptile "
-        "review; that works **even after the PR is closed**.\n\n"
-        "Thanks for contributing to LiteLLM. We know auto-closures can sting; "
-        "the goal is to keep the project healthy, not to dismiss your work."
-        f"\n\n{AGENT_SHIN_CLOSE_MARKER}"
-    )
-
-
-def close_pr(
-    pr: dict,
-    score: int,
-    threshold: int,
-    age_days: int,
-    repo: str | None,
-    dry_run: bool,
-    label: str | None,
-) -> None:
-    """Post the explanatory comment and close the PR."""
-    pr_number = pr["number"]
-    repo_args = ["--repo", repo] if repo else []
-
-    if dry_run:
-        print(
-            f"  [DRY RUN] Would close PR #{pr_number} "
-            f"(age={age_days}d, greptile={score}/5): {pr['title']}"
-        )
-        return
-
-    comment_body = format_close_comment(score, threshold)
-    gh("pr", "comment", str(pr_number), "--body", comment_body, *repo_args)
-
-    if label:
-        try:
-            gh("pr", "edit", str(pr_number), "--add-label", label, *repo_args)
-        except subprocess.CalledProcessError as exc:
-            stderr = (exc.stderr or "").strip()
-            print(f"  warn: failed to add label '{label}' to #{pr_number}: {stderr}")
-
-    gh("pr", "close", str(pr_number), *repo_args)
-    print(f"  Closed PR #{pr_number} (greptile={score}/5, age={age_days}d)")
-
-
-def evaluate_pr(
-    pr: dict,
-    now: dt.datetime,
-    min_age_days: int,
-    min_score: int,
-    repo: str | None,
-    optout_labels: set[str],
-    allowlist: frozenset[str] = ALLOWLIST_LOGINS,
-) -> tuple[str, int | None, int | None]:
-    """Decide what to do with `pr` on this triage run.
-
-    Returns (action, score_or_none, age_days_or_none) where action is one of:
-        "skip-too-young", "skip-optout-label", "skip-not-allowlisted",
-        "skip-internal", "skip-no-greptile-score", "skip-score-ok",
-        "warn-grace", "skip-in-grace-period", or "close".
-
-    Drafts are NOT skipped — the goal is "open PR count == PRs internal
-    collaborators need to action on", and a draft that Greptile scored <4/5
-    is still in that queue. Authors can opt out via the `wip` label (see
-    `DEFAULT_OPTOUT_LABELS`) if they need to keep a long-lived draft open.
-
-    Grace-period semantics: the first time a PR fails the rubric, the
-    action is `warn-grace` — the caller should post a warning comment but
-    NOT close the PR. On a subsequent run, if the warning is still less
-    than `GRACE_PERIOD_SECONDS` old AND the PR still fails, the action is
-    `skip-in-grace-period`. Once the warning ages out and the rubric is
-    still failing, the action is `close`.
-    """
-    if has_optout_label(pr, optout_labels):
-        return ("skip-optout-label", None, None)
-
-    created = parse_iso8601(pr["createdAt"])
-    age_days = (now - created).days
-    # `min_age_days` defaults to 0 (close as soon as Greptile scores low).
-    # Set a positive value via --min-age-days for one-off backfill runs that
-    # want to skip very-young PRs.
-    if min_age_days > 0 and age_days < min_age_days:
-        return ("skip-too-young", None, age_days)
-
-    # While the allowlist is active it is the sole author gate: only those
-    # logins are acted on and the external-only restriction is bypassed for
-    # them. Otherwise auto-close only external OSS contributors — internal
-    # contributors (BerriAI org members) handle their own backlog.
-    login = ((pr.get("author") or {}).get("login") or "").lower()
-    if allowlist:
-        if login not in allowlist:
-            return ("skip-not-allowlisted", None, age_days)
-    elif not is_external_pr_author(pr, repo):
-        return ("skip-internal", None, age_days)
-
-    comments = fetch_pr_comments(pr["number"], repo)
-    extraction = extract_greptile_score(comments)
-    if extraction is None:
-        return ("skip-no-greptile-score", None, age_days)
-
-    score, _ = extraction
-    if score >= min_score:
-        return ("skip-score-ok", score, age_days)
-
-    grace_age = seconds_since_last_grace_warning(comments, now=now)
-    if grace_age is None:
-        return ("warn-grace", score, age_days)
-    if grace_age < GRACE_PERIOD_SECONDS:
-        return ("skip-in-grace-period", score, age_days)
-
-    return ("close", score, age_days)
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument(
-        "--repo",
-        type=str,
-        default=None,
-        help="Repository (owner/repo). Auto-detected if omitted.",
-    )
-    parser.add_argument(
-        "--min-age-days",
-        type=int,
-        default=0,
-        help=(
-            "Minimum age (in days) before a PR is eligible. Default 0 = "
-            "close as soon as Greptile flags it. Set a positive value for "
-            "one-off backfill runs that want to spare very-young PRs."
-        ),
-    )
-    parser.add_argument(
-        "--min-score",
-        type=int,
-        default=4,
-        choices=range(1, 6),
-        help="Greptile score below which a PR is closed (default: 4 -> closes <4/5).",
-    )
-    parser.add_argument(
-        "--optout-label",
-        action="append",
-        default=None,
-        help=(
-            "Label(s) that exempt a PR from auto-close. Repeat to add more. "
-            "Case-insensitive. When omitted, defaults to "
-            f"{list(DEFAULT_OPTOUT_LABELS)!r}; passing this flag REPLACES the "
-            "defaults (argparse `append` with a mutable default would append "
-            "instead, which we explicitly avoid)."
-        ),
-    )
-    parser.add_argument(
-        "--close-label",
-        type=str,
-        default=None,
-        help=(
-            "Optional label to add to PRs that get auto-closed "
-            "(e.g. 'auto-closed-low-quality'). Must already exist on the repo."
-        ),
-    )
-    parser.add_argument(
-        "--close",
-        action="store_true",
-        help="Actually close matching PRs (default is dry-run).",
-    )
-    parser.add_argument(
-        "--limit",
-        type=int,
-        default=None,
-        help="Maximum number of PRs to close in one run (safety net).",
-    )
-    args = parser.parse_args()
-
-    dry_run = not args.close
-    if dry_run:
-        print("=== DRY RUN MODE (pass --close to actually close PRs) ===\n")
-
-    print("Fetching open PRs...")
-    prs = fetch_open_prs(args.repo)
-    print(f"Found {len(prs)} open PRs.\n")
-
-    now = dt.datetime.now(dt.timezone.utc)
-    optout_labels = set(args.optout_label or DEFAULT_OPTOUT_LABELS)
-
-    closed = 0
-    summary = {
-        "close": 0,
-        "warn-grace": 0,
-        "skip-in-grace-period": 0,
-        "skip-too-young": 0,
-        "skip-optout-label": 0,
-        "skip-not-allowlisted": 0,
-        "skip-internal": 0,
-        "skip-no-greptile-score": 0,
-        "skip-score-ok": 0,
-    }
-
-    # `warned` tracks grace-warning comments posted in this run so the
-    # `--limit` safety net bounds *all* destructive write actions, not
-    # just closures. Without this cap, a backlog of PRs failing the
-    # threshold simultaneously could flood contributors with comments.
-    warned = 0
-    for pr in sorted(prs, key=lambda p: p["createdAt"]):
-        try:
-            action, score, age_days = evaluate_pr(
-                pr,
-                now,
-                args.min_age_days,
-                args.min_score,
-                args.repo,
-                optout_labels,
-            )
-            summary[action] = summary.get(action, 0) + 1
-
-            if action == "warn-grace":
-                assert score is not None
-                print(
-                    f"#{pr['number']}: \"{pr['title']}\" "
-                    f"(age={age_days}d, greptile={score}/5) -> warn-grace"
-                )
-                post_grace_warning(
-                    pr,
-                    score=score,
-                    threshold=args.min_score,
-                    repo=args.repo,
-                    dry_run=dry_run,
-                )
-                if not dry_run:
-                    warned += 1
-                    if args.limit is not None and (warned + closed) >= args.limit:
-                        print(
-                            f"\nReached --limit={args.limit} "
-                            f"(closed={closed}, warned={warned}); stopping."
-                        )
-                        break
-                continue
-
-            if action != "close":
-                continue
-
-            assert score is not None and age_days is not None
-            print(
-                f"#{pr['number']}: \"{pr['title']}\" "
-                f"(age={age_days}d, greptile={score}/5) -> close"
-            )
-            close_pr(
-                pr,
-                score=score,
-                threshold=args.min_score,
-                age_days=age_days,
-                repo=args.repo,
-                dry_run=dry_run,
-                label=args.close_label,
-            )
-
-            if not dry_run:
-                closed += 1
-                if args.limit is not None and (warned + closed) >= args.limit:
-                    print(
-                        f"\nReached --limit={args.limit} "
-                        f"(closed={closed}, warned={warned}); stopping."
-                    )
-                    break
-        except Exception as exc:  # noqa: BLE001 - per-PR errors don't abort the sweep
-            summary["error"] = summary.get("error", 0) + 1
-            print(
-                f"!! PR #{pr.get('number')}: {exc}",
-                file=sys.stderr,
-            )
-            continue
-
-    print("\n=== Summary ===")
-    for key, value in summary.items():
-        print(f"  {key:28s} {value}")
-    if dry_run:
-        print(f"\nTotal would close: {summary['close']}")
-    else:
-        print(f"\nTotal closed: {closed}")
-    print(
-        f"Total {'would warn (grace)' if dry_run else 'warned (grace)'}: "
-        f"{summary['warn-grace']}"
-    )
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scripts/detect_changes.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-readonly API_FILE_CEILING=3000
-readonly CATEGORY="${CATEGORY:-backend}"
-
-decide() {
-  echo "detect-changes[${CATEGORY}]: decision=$1"
-  [ -z "${GITHUB_OUTPUT:-}" ] || echo "decision=$1" >>"${GITHUB_OUTPUT}"
-  exit 0
-}
-
-run_full() {
-  echo "detect-changes[${CATEGORY}]: $1; running job"
-  decide run
-}
-
-here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-classify="${here}/../../.circleci/scripts/classify_changes.sh"
-
-[ -n "${PR_NUMBER:-}" ] || run_full "not a pull_request event"
-[ -n "${REPO:-}" ] || run_full "no repository in the environment"
-
-case "${CHANGED_FILE_COUNT:-}" in
-'' | *[!0-9]*) run_full "the event payload carries no changed_files count" ;;
-esac
-[ "${CHANGED_FILE_COUNT}" -le "${API_FILE_CEILING}" ] ||
-  run_full "PR #${PR_NUMBER} changes ${CHANGED_FILE_COUNT} files, past the ${API_FILE_CEILING}-file listing ceiling"
-
-changed="$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/files" --paginate --jq '.[].filename')" ||
-  run_full "could not list the files on PR #${PR_NUMBER}"
-[ -n "${changed}" ] || run_full "the API listed no files on PR #${PR_NUMBER}"
-
-echo "detect-changes[${CATEGORY}]: files changed by PR #${PR_NUMBER}:"
-printf '%s\n' "${changed}" | sed 's/^/  /'
-
-decision="$(printf '%s\n' "${changed}" | bash "${classify}" "${CATEGORY}")" ||
-  run_full "classify_changes.sh failed"
-case "${decision}" in
-run | skip) decide "${decision}" ;;
-*) run_full "classify_changes.sh printed an unexpected decision: ${decision}" ;;
-esac

.github/scripts/e2e_egress_sentinel.py

@@ -1,198 +0,0 @@
-"""Prove an e2e replay run makes zero outbound provider calls, by counting them.
-
-`serve` pins each provider host (`--host`) to a local sink address in the hosts
-file and binds a counting listener on that address, so any connection the proxy
-or the record/replay edge opens to a real provider is redirected to the sink,
-recorded as one line in `--hits-file`, and never leaves the box. The record and
-replay edge only ever dials `127.0.0.1:<edge-port>` (a different host than the
-pinned provider names), so in a clean replay the sink sees nothing; a single hit
-means a provider call escaped the bundle. `assert-empty` turns that hit file into
-the pass/fail check.
-
-Stdlib only, so CI runs it under the system interpreter as root (binding :443 and
-editing the hosts file both need root); `--sink-address`, `--port`, and
-`--hosts-file` are injectable so it runs unprivileged against a temp hosts file on
-a high port under test.
-"""
-
-# ruff: noqa: T201  # CLI script: its stdout/stderr progress and results are the interface
-from __future__ import annotations
-
-import argparse
-import json
-import os
-import signal
-import socket
-import sys
-import threading
-import time
-from dataclasses import dataclass
-from pathlib import Path
-from types import FrameType
-from typing import Final
-
-_BLOCK_BEGIN: Final = "# BEGIN e2e-egress-sentinel"
-_BLOCK_END: Final = "# END e2e-egress-sentinel"
-
-
-@dataclass(frozen=True, slots=True)
-class ServeConfig:
-    hosts: tuple[str, ...]
-    sink_address: str
-    ports: tuple[int, ...]
-    hits_file: Path
-    hosts_file: Path
-    ready_file: Path | None
-    pid_file: Path | None
-
-
-def _pin_block(sink_address: str, hosts: tuple[str, ...]) -> str:
-    lines = "\n".join(f"{sink_address}\t{host}" for host in hosts)
-    return f"\n{_BLOCK_BEGIN}\n{lines}\n{_BLOCK_END}\n"
-
-
-def _install_pins(hosts_file: Path, sink_address: str, hosts: tuple[str, ...]) -> bytes:
-    original = hosts_file.read_bytes() if hosts_file.exists() else b""
-    hosts_file.write_bytes(original + _pin_block(sink_address, hosts).encode())
-    return original
-
-
-def _restore_pins(hosts_file: Path, original: bytes) -> None:
-    hosts_file.write_bytes(original)
-
-
-def _bind(sink_address: str, port: int) -> socket.socket:
-    listener = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-    listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-    listener.bind((sink_address, port))
-    listener.listen(128)
-    return listener
-
-
-@dataclass(frozen=True, slots=True)
-class _HitLog:
-    path: Path
-    _lock: threading.Lock
-
-    def record(self, *, port: int, peer: tuple[str, int]) -> None:
-        entry = json.dumps({"ts": time.time(), "port": port, "peer": list(peer)})
-        with self._lock:
-            with self.path.open("a", encoding="utf-8") as handle:
-                handle.write(entry + "\n")
-
-
-def _serve_socket(listener: socket.socket, port: int, hits: _HitLog, stop: threading.Event) -> None:
-    while not stop.is_set():
-        try:
-            conn, peer = listener.accept()
-        except OSError:
-            return
-        hits.record(port=port, peer=(peer[0], peer[1]))
-        try:
-            conn.close()
-        except OSError:
-            pass
-
-
-def serve(config: ServeConfig) -> int:
-    config.hits_file.write_text("", encoding="utf-8")
-    original_hosts = _install_pins(config.hosts_file, config.sink_address, config.hosts)
-    try:
-        listeners = tuple(_bind(config.sink_address, port) for port in config.ports)
-    except OSError as exc:
-        _restore_pins(config.hosts_file, original_hosts)
-        print(f"egress sentinel could not bind a sink: {exc}", file=sys.stderr)
-        return 1
-
-    stop = threading.Event()
-    hits = _HitLog(path=config.hits_file, _lock=threading.Lock())
-    threads = tuple(
-        threading.Thread(target=_serve_socket, args=(listener, port, hits, stop), daemon=True)
-        for listener, port in zip(listeners, config.ports)
-    )
-    for thread in threads:
-        thread.start()
-
-    def _handle(_signum: int, _frame: FrameType | None) -> None:
-        stop.set()
-        for listener in listeners:
-            try:
-                listener.close()
-            except OSError:
-                pass
-
-    signal.signal(signal.SIGTERM, _handle)
-    signal.signal(signal.SIGINT, _handle)
-
-    if config.pid_file is not None:
-        config.pid_file.write_text(str(os.getpid()), encoding="utf-8")
-    if config.ready_file is not None:
-        config.ready_file.write_text("ready", encoding="utf-8")
-    print(
-        f"egress sentinel up: pinned {', '.join(config.hosts)} to {config.sink_address} "
-        f"on port(s) {', '.join(str(p) for p in config.ports)}",
-        flush=True,
-    )
-
-    stop.wait()
-    _restore_pins(config.hosts_file, original_hosts)
-    if config.ready_file is not None and config.ready_file.exists():
-        config.ready_file.unlink()
-    if config.pid_file is not None and config.pid_file.exists():
-        config.pid_file.unlink()
-    return 0
-
-
-def assert_empty(hits_file: Path) -> int:
-    if not hits_file.exists():
-        print(f"egress sentinel recorded no provider calls ({hits_file} absent): zero egress")
-        return 0
-    hits = [line for line in hits_file.read_text(encoding="utf-8").splitlines() if line.strip()]
-    if not hits:
-        print("egress sentinel recorded no provider calls: zero egress")
-        return 0
-    print(f"egress sentinel recorded {len(hits)} provider call(s); replay was not hermetic:", file=sys.stderr)
-    for line in hits:
-        print(f"  {line}", file=sys.stderr)
-    return 1
-
-
-def _serve_from_args(args: argparse.Namespace) -> int:
-    config = ServeConfig(
-        hosts=tuple(args.host),
-        sink_address=args.sink_address,
-        ports=tuple(args.port),
-        hits_file=Path(args.hits_file),
-        hosts_file=Path(args.hosts_file),
-        ready_file=Path(args.ready_file) if args.ready_file else None,
-        pid_file=Path(args.pid_file) if args.pid_file else None,
-    )
-    return serve(config)
-
-
-def main(argv: tuple[str, ...]) -> int:
-    parser = argparse.ArgumentParser(description="count outbound provider calls during an e2e replay")
-    sub = parser.add_subparsers(dest="command", required=True)
-
-    serve_parser = sub.add_parser("serve", help="pin provider hosts and count connection attempts")
-    serve_parser.add_argument("--host", action="append", required=True, help="provider host to pin and watch")
-    serve_parser.add_argument("--sink-address", default="127.0.0.1")
-    serve_parser.add_argument("--port", action="append", type=int, default=None)
-    serve_parser.add_argument("--hits-file", required=True)
-    serve_parser.add_argument("--hosts-file", default="/etc/hosts")
-    serve_parser.add_argument("--ready-file", default=None)
-    serve_parser.add_argument("--pid-file", default=None)
-
-    assert_parser = sub.add_parser("assert-empty", help="exit non-zero if any provider call was recorded")
-    assert_parser.add_argument("--hits-file", required=True)
-
-    args = parser.parse_args(argv)
-    if args.command == "serve":
-        if args.port is None:
-            args.port = [443]
-        return _serve_from_args(args)
-    return assert_empty(Path(args.hits_file))
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(tuple(sys.argv[1:])))

.github/scripts/e2e_fetch_fixture_bundle.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-REPO="${1:-${GITHUB_REPOSITORY:?REPO required}}"
-ARTIFACT_NAME="${2:-e2e-fixtures-bundle}"
-BASE_BRANCH="${3:?base branch required}"
-DEST_DIR="${4:?destination bundle dir required}"
-
-: "${GH_TOKEN:?GH_TOKEN required to query and download artifacts}"
-
-WORKDIR="$(mktemp -d)"
-trap 'rm -rf "${WORKDIR}"' EXIT
-
-echo "resolving newest non-expired '${ARTIFACT_NAME}' artifact on ${REPO}@${BASE_BRANCH}"
-
-SELECTED="$(
-  gh api "repos/${REPO}/actions/artifacts" -X GET -f per_page=100 --paginate \
-    --jq ".artifacts[] | select(.name == \"${ARTIFACT_NAME}\" and .expired == false and .workflow_run.head_branch == \"${BASE_BRANCH}\") | {id, digest, created_at, run_id: .workflow_run.id, run_number: .workflow_run.run_number}" \
-    | jq -s 'sort_by(.created_at) | reverse | .[0] // empty'
-)"
-
-if [[ -z "${SELECTED}" ]]; then
-  echo "no usable '${ARTIFACT_NAME}' artifact on ${BASE_BRANCH}: the last record run produced none (a red Saturday), so there is nothing fresh to replay; failing loudly instead of replaying a stale bundle" >&2
-  exit 1
-fi
-
-RUN_ID="$(echo "${SELECTED}" | jq -r '.run_id')"
-RUN_NUMBER="$(echo "${SELECTED}" | jq -r '.run_number')"
-ARTIFACT_ID="$(echo "${SELECTED}" | jq -r '.id')"
-GH_DIGEST="$(echo "${SELECTED}" | jq -r '.digest // "unknown"')"
-CREATED_AT="$(echo "${SELECTED}" | jq -r '.created_at')"
-
-echo "pinned bundle: run #${RUN_NUMBER} (run_id=${RUN_ID}, artifact_id=${ARTIFACT_ID}), recorded ${CREATED_AT}, github digest ${GH_DIGEST}"
-
-gh run download "${RUN_ID}" --repo "${REPO}" -n "${ARTIFACT_NAME}" -D "${WORKDIR}"
-
-TARBALL="$(find "${WORKDIR}" -name '*.tar.gz' -type f | head -n 1)"
-if [[ -z "${TARBALL}" ]]; then
-  echo "downloaded artifact contained no tarball" >&2
-  exit 1
-fi
-SIDECAR="${TARBALL}.sha256"
-if [[ ! -f "${SIDECAR}" ]]; then
-  echo "downloaded artifact has no ${SIDECAR}: cannot verify the bundle digest" >&2
-  exit 1
-fi
-
-echo "verifying bundle against its recorded sha256 digest"
-( cd "$(dirname "${TARBALL}")" && sha256sum -c "$(basename "${SIDECAR}")" )
-
-mkdir -p "${DEST_DIR}"
-tar xzf "${TARBALL}" -C "${DEST_DIR}"
-
-echo "extracted bundle into ${DEST_DIR}"
-python3 -c "import json,sys; m=json.load(open(sys.argv[1])); print('  recorded_at', m['recorded_at'], 'harness', m['harness_version'], 'format_version', m['format_version'])" "${DEST_DIR}/manifest.json"

.github/scripts/e2e_pack_fixture_bundle.sh

@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-if [[ $# -ne 2 ]]; then
-  echo "usage: $0 <bundle-dir> <out-tarball>" >&2
-  exit 2
-fi
-
-BUNDLE_DIR="$1"
-OUT_TARBALL="$2"
-
-MANIFEST="${BUNDLE_DIR}/manifest.json"
-if [[ ! -f "${MANIFEST}" ]]; then
-  echo "no ${MANIFEST}: refusing to publish a bundle with no manifest (record produced nothing)" >&2
-  exit 1
-fi
-
-echo "packing fixture bundle from ${BUNDLE_DIR}"
-python3 -c "import json,sys; m=json.load(open(sys.argv[1])); print('  format_version', m['format_version'], 'recorded_at', m['recorded_at'], 'harness', m['harness_version'])" "${MANIFEST}"
-
-TEST_DIRS=$(find "${BUNDLE_DIR}" -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')
-if [[ "${TEST_DIRS}" -eq 0 ]]; then
-  echo "bundle at ${BUNDLE_DIR} has a manifest but no recorded interactions; refusing to publish an empty bundle" >&2
-  exit 1
-fi
-echo "  ${TEST_DIRS} recorded test director(ies)"
-
-mkdir -p "$(dirname "${OUT_TARBALL}")"
-tar czf "${OUT_TARBALL}" -C "${BUNDLE_DIR}" .
-
-OUT_DIR="$(cd "$(dirname "${OUT_TARBALL}")" && pwd)"
-OUT_BASE="$(basename "${OUT_TARBALL}")"
-( cd "${OUT_DIR}" && sha256sum "${OUT_BASE}" > "${OUT_BASE}.sha256" )
-
-echo "wrote ${OUT_TARBALL} ($(du -h "${OUT_TARBALL}" | cut -f1)) and ${OUT_BASE}.sha256"
-cat "${OUT_DIR}/${OUT_BASE}.sha256"

.github/scripts/select_ui_test_scope.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-set -uo pipefail
-
-has_file=false
-has_file_outside_src=false
-while IFS= read -r file || [ -n "$file" ]; do
-  [ -n "$file" ] || continue
-  has_file=true
-  case "$file" in
-    src/*) ;;
-    *) has_file_outside_src=true ;;
-  esac
-done
-
-{ [ "$has_file" = true ] && [ "$has_file_outside_src" = false ]; } && echo related || echo full

.github/scripts/triage-requirements.txt

@@ -1,282 +0,0 @@
-# Hash-pinned dependency set for the Agent Shin triage scripts.
-# Installed in privileged triage workflows, so every package is pinned to an
-# exact version with SHA-256 hashes and installed with pip --require-hashes.
-#
-# Regenerate after bumping openai:
-#   echo 'openai==<version>' \
-#     | uv pip compile - --generate-hashes --python-version 3.12 \
-#       --no-annotate --no-header -o .github/scripts/triage-requirements.txt
-
-annotated-types==0.7.0 \
-    --hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \
-    --hash=sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89
-anyio==4.14.0 \
-    --hash=sha256:b47c1f9ccf73e67021df785332508f99379c68fa7d0684e8e3492cb1d4b23f89 \
-    --hash=sha256:dd9b7a2a9799ed6552fde617b2c5df02b7fdd7d88392fc48101e51bae46164d9
-certifi==2026.6.17 \
-    --hash=sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432 \
-    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
-distro==1.9.0 \
-    --hash=sha256:2fa77c6fd8940f116ee1d6b94a2f90b13b5ea8d019b98bc8bafdcabcdd9bdbed \
-    --hash=sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2
-h11==0.16.0 \
-    --hash=sha256:4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208ee5ff1 \
-    --hash=sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86
-httpcore==1.0.9 \
-    --hash=sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55 \
-    --hash=sha256:6e34463af53fd2ab5d807f399a9b45ea31c3dfa2276f15a2c3f00afff6e176e8
-httpx==0.28.1 \
-    --hash=sha256:75e98c5f16b0f35b567856f597f06ff2270a374470a5c2392242528e3e3e42fc \
-    --hash=sha256:d909fcccc110f8c7faf814ca82a9a4d816bc5a6dbfea25d6591d6985b8ba59ad
-idna==3.18 \
-    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \
-    --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848
-jiter==0.15.0 \
-    --hash=sha256:01a8222cf05ab1128e239421156c207949808acaaea2bdfd33130ae666786e86 \
-    --hash=sha256:032396229564bca02440396bd327710719f724f5e7b7e9f7a8eb3faa4a2c2281 \
-    --hash=sha256:04b400bbf8c9efb03d9bdd976475c919c1d85593b04b9fff7ae234065daf87ae \
-    --hash=sha256:05906b93d72f03339e6bb7cf8dc10ebda64a0266126eed6beba79e20abcf5fd4 \
-    --hash=sha256:066f8f33f18b2419cd8213b2436fa7fbc9c499f315971cfa3ce1f9820c001b1b \
-    --hash=sha256:0ab068bce62a45aa3e7367eceaffb5dde60b7eb853be8dece45132e3d0ff4879 \
-    --hash=sha256:0be6f5ad41a809f303f416d17cec92a7a725902fb9b4f3de3d19362ac0ef8554 \
-    --hash=sha256:0e90a1c315a0226ec822d973817967f9223b7701546c8c2a7913e7ab0926294d \
-    --hash=sha256:0f862193b8696249d22ec433e85fd2ab0ad9596bc3e45e6c0bc55e8aeba97be2 \
-    --hash=sha256:1303d4d68a9b051ea90502402063ecf3807da00ad2affa19ca1ae3b90b3c5f67 \
-    --hash=sha256:144f8e72cb53dab146347b91cceac01f5481237f2b93b4a339a1ee8f8878b67c \
-    --hash=sha256:182226cbc930c9fab81bc2e41a4da672f89539906dadb05e75670ac07b94f71f \
-    --hash=sha256:1c11465f97e2abf45a014b83b730222f8f1c5335e802c7055a67d50de6f1f4e3 \
-    --hash=sha256:1c15024a3d892223b18f597c86d59387249dc396590844ce6b9f6131d1093bae \
-    --hash=sha256:1d54fb5b31dea401a41af3f8a7d2512e9b6a6a005491e6166c7e4ffab9639a9c \
-    --hash=sha256:25ffbe229aa8cd98c28879d8aa1a6e34ae77992ab984a65fba800859dab16269 \
-    --hash=sha256:2a77aadd57cac1682e4401a72724d2796d89a4ba129b1a5812aa94ee480826eb \
-    --hash=sha256:2ae901f3a55bfafdde31d289590fa25e3245735a2b1e8c7cc15871710a002871 \
-    --hash=sha256:2b0074e2f56eb2dacca1689760fd2852a068f85a0547a157b82cb4cafeb6768b \
-    --hash=sha256:2c8aea7781d2a372227871de4e1a1332aa96f5a89fd76c5e835dafdbad102887 \
-    --hash=sha256:2c9cb907439d20bd0c7d7565ca01ee52234203208433749bae5b516907526928 \
-    --hash=sha256:2fb6a5d26af81fc0f00f9360a891e05cf755e149bba391c4d563adc54812973d \
-    --hash=sha256:2fd73e3da91a0a722d67165e849ce2cdc10de0e0d48738c142be8c6c5f310f4c \
-    --hash=sha256:30ce1a5d16b5641dc935d50ef775af6a0871e3d14ab05d6fc54dff371b78e558 \
-    --hash=sha256:30ce785d2adb8e32c3f7741442370a74834ec4c01f3c48f0750227a0b4ef27d6 \
-    --hash=sha256:30f2218e6a9e5c18bc10fe6d41ac189c442c88eacf11bad9f28ef95a9bef00e6 \
-    --hash=sha256:351a341c2105aa430b7047e30f1bf7975f6313b00165d3fc07be2edaf741f279 \
-    --hash=sha256:37a10c377ce3a4a85f4a67f28b7afe093154cde77eaf248a72e856aa08b4d865 \
-    --hash=sha256:392b8ab019e5502d08aff85c6272209c24bc2cbe706ea82a56368f524236614a \
-    --hash=sha256:3e4540b8e74e4268811ac05db226a6a128ff572e7e0ce3f1163b693cadb184cd \
-    --hash=sha256:40b2c7e92c44a84d748d21706c68dc6ff8161d80b59c99d774721a0d2317d7c7 \
-    --hash=sha256:411fa4dfa5a7ae3d11491027ffb9beadec3996010a986862db70d91abba1c750 \
-    --hash=sha256:4251acc80e2b7c9b7b8823456ea0fceeb0734dac2df7636d3c711b38476b5a76 \
-    --hash=sha256:42bfb257930800cf43e7c62c832402c704ab60797c992faf88d20e903eac8f32 \
-    --hash=sha256:4363818355dbc70ae1a8e9eaba9de350d93ede4ff6992b8f8eb8cbb6e5122d42 \
-    --hash=sha256:4ab395feec8d249ec4044e228e98a7033f043426a265df439dc3698823f0a4e4 \
-    --hash=sha256:50164d7610c00e7cd913a873fce30b6beeebf4b37e53983e33f22de4c900f6b8 \
-    --hash=sha256:50e51156192722a9c58db112837d3f8ef96fb3c5ecc14e95f409134b08b158ec \
-    --hash=sha256:510c8b3c17a0ed9ac69850c0438dada3c9b82d9c4d589fcb62002a5a9cf3a866 \
-    --hash=sha256:5157de9f76eb4bc5ea74a1219366a25f945ad305641d74e04f59c54087091aa9 \
-    --hash=sha256:54d5d6090cdc1b7c9e780dfb04949a990adb1e301a2fc0bbcee7de4638d33f9a \
-    --hash=sha256:553fcac2ef2cb990877f9fc0833b8b629a3e6a5670b6b5fd58219b41a653ddc4 \
-    --hash=sha256:5607e6013ed7e6b0ec9661e467b7ffde0aa7ab36833a04850f26fcf88ed4845b \
-    --hash=sha256:5d6a60072b44c3c2b797a7ddcbcbbf2b34ea3cfd4721580fbfd2a09d9d9b84ba \
-    --hash=sha256:5f30bae8bc1c2d613e28e5af3e8cceb09b742f1c8a8a5f839fb67afaffc03b61 \
-    --hash=sha256:62ebd14e47e9aed9df4472afcb2663668ce4d74891cd54f86bf6e44029d6dc89 \
-    --hash=sha256:631f13a3d04e97d4e083993b10f4b99530e3a10d953e2eb5e196b7dc7f812ce0 \
-    --hash=sha256:6550fa135c7deb8ead6af49ed7ff648532ea8334a1447fe34a36315ef79c5c29 \
-    --hash=sha256:66b1880df2d01e206e8339769d1c7c1753bcb653efd6289e203f6f24ebada0c0 \
-    --hash=sha256:6eac374c5c975709b69c10f09afd199df74150172156ad10c8d4fd785b7da995 \
-    --hash=sha256:71683c38c825452999b5717fcae07ea708e8c93003e808be4319c1b02e3d176e \
-    --hash=sha256:7553333dd0930c104a5a0db8df72bf7219fe663d731383b576bb6ed6351c984d \
-    --hash=sha256:75e8a04e91432dde9f1838373cf93d23726c79d3e908d319acf0e796f85592e7 \
-    --hash=sha256:773b6eb282ce11ee19f05f6b2d4404fa308e5bbd353b0b80a0262caad6db2cd7 \
-    --hash=sha256:774f93f65031856bf14ad9f59bdcab8b8cad501e5ceabd51ba3525f76937a25b \
-    --hash=sha256:7c468136b8bd6bb18c8786e4236a1fa27362f24cb23450ba0cb204ab379b8e6f \
-    --hash=sha256:7ce8902f939970048b233087082e7bb829db29375811c7ad50687b8624c6fd08 \
-    --hash=sha256:7d3d6683288c11cbab50e865f2e2f13950179aa45410e30b2cfbd3fb7b0177bf \
-    --hash=sha256:7f6163c0f10b055245f814dcc59f4818da60dfe72f3e72ab89fc24b6bd5e9c52 \
-    --hash=sha256:8020c99ec13a7db2b6f96cbe82ef4721c88b426a4892f27478044af0284615ef \
-    --hash=sha256:813dfbb17d65328bf86e5f0905dd277ba2265d3ca20556e86c0c7035b7182e5a \
-    --hash=sha256:860a74063284a2ae9bfedd694f299cc2c68e2696c5f3d440cc9d18bb81b9dd04 \
-    --hash=sha256:8c9004af7c8d67cce7f1aae1026fb55607f4aa600710d08ede3a3ce4aeefe7e0 \
-    --hash=sha256:8d2c0c44d569ce0f2850f5c926f8caeb5f245fbc84475aeb36efccc2103e6dbd \
-    --hash=sha256:8f7e9bc0f1135039b22ee6eab588d42df1ce55842b30740a352885eb267bd941 \
-    --hash=sha256:90c5db5527c221249a876160663ab891ace358c17f7b9c93ec1478b7f0550e5c \
-    --hash=sha256:9100ddbec09741cc66feb0fc6773f8bdbd0e3c345689368f260082ff85dcc0cd \
-    --hash=sha256:913d02d29c9606643418d9ccfc3b72492ab25a6bf7889934e09a3490f8d3438b \
-    --hash=sha256:980c256edb05b78a111b99c4de3b1d32e31634b867fd1fc2cf726e7b7bba9854 \
-    --hash=sha256:9f924585cdacf631cd382b657966847bb537bf9ed0a6f9b991da5f05a631480f \
-    --hash=sha256:a254e10b593624d230c365b6d616b22ca0ad65e63a16e6631c2b3466022e6ba8 \
-    --hash=sha256:a2a438005b6f22d0273413484d6094d7c2c5d10ec1b3a3bf128e0d1d3ba53258 \
-    --hash=sha256:a97261f1fccb8e50ecd2890a96e46efdc3f57c80a197324c6777827231eca712 \
-    --hash=sha256:ab596fa3837e91e7e6a31b5f639988bfc6a35d1f915ac3932d946062219d588f \
-    --hash=sha256:abbf258599526ad0326fe51e252e24f2bd6f24f1852681b4b78feda3808f1d18 \
-    --hash=sha256:ac0d9ddea4350974be7a221fc25895f251a8fee748c889bdced2141c0fec1a49 \
-    --hash=sha256:acf4ee4d1fc55917239fe72972fb292dd773055d05eb040d36f4326e02cc2c0e \
-    --hash=sha256:ae1b0d82ac2d987f9ea512b1c9adfcc71a28de3dea3a6039b54d76cffda9901e \
-    --hash=sha256:b15741f501469009ae0ae90b7147958a664a7dede40aa7ff174a8a4645f546d0 \
-    --hash=sha256:b15d3ec9b0449c40e85319bdb4caa8b77ab526e74f5532ed94bec15e2f66822c \
-    --hash=sha256:b3b3b775e33d3bfaec9899edc526ae97b0da0bf9d071a46124ba419149a414f8 \
-    --hash=sha256:b6c0ffae686c39bf3737be60793783267628783ea42545632c10b291105aee45 \
-    --hash=sha256:c210f8b35dc6f30aafd4b4365ca89b9d1189f21ab49b8e68fa6322a847aef138 \
-    --hash=sha256:c2f6bb8b5216ab9e7873bc08b5d7bef2b8abbb578a3069bf1cd14a45d71d771d \
-    --hash=sha256:c60e71b6d10cfc284c9bf36bd885e8d44c46f688ce50aa91b5edd90181dea687 \
-    --hash=sha256:c6694a173ecabc12eb60efbc0b474464ead1951ff65cd8b1e72100715c64512b \
-    --hash=sha256:c77496cb10bd7549690fbbab3e5ec05857b83e49276f4a9423a766ddd2afcd4c \
-    --hash=sha256:c84c1b7be454b0c16f8499b4ebfbfd82ea5cca6527cceefcbbc06a7557b5ed2e \
-    --hash=sha256:cc0bc345cf2df9d1c00ac443f50d543c1ccfa8b0422cb85b1ab70d681c0b255b \
-    --hash=sha256:ceb8fc27d38793f9c97149be8302720c5b22e5c195a37bf2c45dc36c4600a512 \
-    --hash=sha256:cf4bd113a69c0a740e27cb962ce10630c36d2b8f59d759a651b955ee9d18a823 \
-    --hash=sha256:d1aa62e277fc1cbd80e6deacae6f4d983b41b3d7728e0645c5d741a6149bba45 \
-    --hash=sha256:d1e7b1776f0797956c509e123d0952d10d293a9492dea9f288ab9570ec01d1a5 \
-    --hash=sha256:d636d5095155afd364247f65070fab7beda13498d7ff4de331046e704ab9657f \
-    --hash=sha256:d726e3ceeb337191324b49de298142f27c3ad10886341555d1d5315b5f252c6a \
-    --hash=sha256:d72d8af5c1013656a8870c866660627d1a75bc185814ee022c8533caa1de88ae \
-    --hash=sha256:d8d2955167274e15d79a7a020afdd9b39c990eb80b2d89fca695d92dcfdd38ec \
-    --hash=sha256:d92a5cd21fdb083931d546c207aa29633787c5dc5b02daab2d32b843f88a2c53 \
-    --hash=sha256:e58585a58209d72691ce2d62a9147445f5a87beb0bde97fde284c96ae392a3d1 \
-    --hash=sha256:e7196e56f1cd69af1dbb07dff02dcfb260a50b45a82d409d92a06fedb32473b5 \
-    --hash=sha256:eda3071db3346334beae1360b46da4606da57bf3528c167b3c38533afaf9f2c5 \
-    --hash=sha256:edebcf7d1f601199084bb6e844d7dc67e03e04f6ac786b0332d616635c4ff7a4 \
-    --hash=sha256:ef1fd24d9413f6209e00d3d5a453e67acfe004a25cc6c8e8484faed4311ab9e8 \
-    --hash=sha256:f0b271b462769543716f92d3a4f90527df6ef5ed05ee95ec4137f513e21e1b77 \
-    --hash=sha256:f18f85e4218d1b40f000f42a92239a7a61a902cd42c65e6c360dbd17dcb20894 \
-    --hash=sha256:f1e1754960f38ec40613a07e5e372df67acb3b890fb383b6fb3de3e49ddbf3c7 \
-    --hash=sha256:f2143ab06181d2b029eedcb6af3cebe95f11bbac62441781860f98ee9330a6a6 \
-    --hash=sha256:f3d37768fce7f88dd2a8c6091f2325dea27d30d30d5c6e7a1c0f0af77723b708 \
-    --hash=sha256:fa248c9eb220197d363f688818dac2fd4b2f0cd7d843ca7105d652034823427d
-openai==2.33.0 \
-    --hash=sha256:03ac37d70e8c9e3a8124214e3afa785e2cbc12e627fbd98177a086ef2fd87ad5 \
-    --hash=sha256:f850c435e2a4685bba3295bd54912dd26315d9c1b7733068186134d6e0599f9a
-pydantic==2.13.4 \
-    --hash=sha256:45a282cde31d808236fd7ea9d919b128653c8b38b393d1c4ab335c62924d9aba \
-    --hash=sha256:c40756b57adaa8b1efeeced5c196f3f3b7c435f90e84ea7f443901bec8099ef6
-pydantic-core==2.46.4 \
-    --hash=sha256:00c603d540afdd6b80eb39f078f33ebd46211f02f33e34a32d9f053bba711de0 \
-    --hash=sha256:0186750b482eefa11d7f435892b09c5c606193ef3375bcf94aa00ae6bfb66262 \
-    --hash=sha256:041bde0a48fd37cf71cab1c9d56d3e8625a3793fef1f7dd232b3ff37e978ecda \
-    --hash=sha256:0c563b08bca408dc7f65f700633d8442fffb2421fc47b8101377e9fd65051ff0 \
-    --hash=sha256:0cbe8b01f948de4286c74cdd6c667aceb38f5c1e26f0693b3983d9d74887c65e \
-    --hash=sha256:0ce40cd7b21210e99342afafbd4d0f76d784eb5b1d60f3bdc566be4983c6c73b \
-    --hash=sha256:0e96592440881c74a213e5ad528e2b24d3d4f940de2766bed9010ab1d9e51594 \
-    --hash=sha256:10e17cbb10a330363733efc4d7c4d0dd827ac0909b8f6a6542298fed1ea62f29 \
-    --hash=sha256:133878133d271ade3d41d1bfb2a45ec38dbdbda40bc065921c6b04e4630127e2 \
-    --hash=sha256:14d4edf427bdcf950a8a02d7cb44a08614388dd6e1bdcbf4f67504fa7887da9c \
-    --hash=sha256:14f4c5d6db102bd796a627bbb3a17b4cf4574b9ae861d8b7c9a9661c6dd3362d \
-    --hash=sha256:17299feefe090f2caa5b8e37222bb5f663e4935a8bfa6931d4102e5df1a9f398 \
-    --hash=sha256:184c081504d17f1c1066e430e117142b2c77d9448a97f7b65c6ac9fd9aee238d \
-    --hash=sha256:18e5ceec2ab67e6d5f1a9085e5a24c9c4e2ac4545730bfe668680bca05e555f3 \
-    --hash=sha256:19e51f073cd3df251856a8a4189fbdf1de4012c3ebacfb1884f94f1eb406079f \
-    --hash=sha256:1a7dd0b3ee80d90150e3495a3a13ac34dbcbfd4f012996a6a1d8900e91b5c0fb \
-    --hash=sha256:1d8ba486450b14f3b1d63bc521d410ec7565e52f887b9fb671791886436a42f7 \
-    --hash=sha256:2108ba5c1c1eca18030634489dc544844144ee36357f2f9f780b93e7ddbb44b5 \
-    --hash=sha256:228ee9bae8bef5b1e97ec58302f80357c37199e0d0a99174e138d28e6957b9d9 \
-    --hash=sha256:23ace664830ee0bfe014a0c7bc248b1f7f25ed7ad103852c317624a1083af462 \
-    --hash=sha256:2412e734dcb48da14d4e4006b82b46b74f2518b8a26ee7e58c6844a6cd6d03c4 \
-    --hash=sha256:29c61fc04a3d840155ff08e475a04809278972fe6aef51e2720554e96367e34b \
-    --hash=sha256:2f84c03c8607173d16b5a854ec68a2f9079ae03237a54fb506d13af47e1d018d \
-    --hash=sha256:3009f12e4e90b7f88b4f9adb1b0c4a3d58fe7820f3238c190047209d148026df \
-    --hash=sha256:3245406455a5d98187ec35530fd772b1d799b26667980872c8d4614991e2c4a2 \
-    --hash=sha256:3447661d99f75a3683a4cf5c87da72f2161964611864dbbeac7fbb118bb4bfc0 \
-    --hash=sha256:372429a130e469c9cd698925ce5fc50940b7a1336b0d82038e63d5bbc4edc519 \
-    --hash=sha256:395aebd9183f9d112f569aeb5b2214d1a10a33bec8456447f7fbdfa51d38d4cd \
-    --hash=sha256:3a233125ac121aa3ffba9a2b59edfc4a985a76092dc8279586ab4b71390875e7 \
-    --hash=sha256:3be77f45df024d789a672ae34f8b06fb346c4f9f46ea714956660ea4862e89ac \
-    --hash=sha256:3bf92c5d0e00fefaab325a4d27828fe6b6e2a21848686b5b60d2d9eeb09d76c6 \
-    --hash=sha256:3ecbc122d18468d06ca279dc26a8c2e2d5acb10943bb35e36ae92096dc3b5565 \
-    --hash=sha256:3fb702cd90b0446a3a1c5e470bfa0dd23c0233b676a9099ddcc964fa6ca13898 \
-    --hash=sha256:428e04521a40150c85216fc8b85e8d39fece235a9cf5e383761238c7fa9b96fb \
-    --hash=sha256:432c179df7874eeb73307aad2df0755e1ae0efa61ff0ea89b93e194411ae3928 \
-    --hash=sha256:4a05d69cba51d852c5c3e92758653245a50c0b646ced0cf05bd793ed592839d6 \
-    --hash=sha256:4c63ebc82684aa89d9a3bcbd13d515b3be44250dc68dd3bd81526c1cb31286c3 \
-    --hash=sha256:4fc73cb559bdb54b1134a706a2802a4cddd27a0633f5abb7e53056268751ac6a \
-    --hash=sha256:4fcbe087dbc2068af7eda3aa87634eba216dbda64d1ae73c8684b621d33f6596 \
-    --hash=sha256:56cb4851bcaf3d117eddcef4fe66afd750a50274b0da8e22be256d10e5611987 \
-    --hash=sha256:5855698a4856556d86e8e6cd8434bc3ac0314ee8e12089ae0e143f64c6256e4e \
-    --hash=sha256:5a4330cdbc57162e4b3aa303f588ba752257694c9c9be3e7ebb11b4aca659b5d \
-    --hash=sha256:5b712b53160b79a5850310b912a5ef8e57e56947c8ad690c227f5c9d7e561712 \
-    --hash=sha256:5d5902252db0d3cedf8d4a1bc68f70eeb430f7e4c7104c8c476753519b423008 \
-    --hash=sha256:617d7e2ca7dcb8c5cf6bcb8c59b8832c94b36196bbf1cbd1bfb56ed341905edd \
-    --hash=sha256:62f875393d7f270851f20523dd2e29f082bcc82292d66db2b64ea71f64b6e1c1 \
-    --hash=sha256:633147d34cf4550417f12e2b1a0383973bdf5cdfde212cb09e9a581cf10820be \
-    --hash=sha256:66ce7632c22d837c95301830e111ad0128a32b8207533b60896a96c4915192ea \
-    --hash=sha256:6b3ace8194b0e5204818c92802dcdca7fc6d88aabbb799d7c795540d9cd6d292 \
-    --hash=sha256:6f2eeda33a839975441c86a4119e1383c50b47faf0cbb5176985565c6bb02c33 \
-    --hash=sha256:7027560ee92211647d0d34e3f7cd6f50da56399d26a9c8ad0da286d3869a53f3 \
-    --hash=sha256:7283d57845ecf5a163403eb0702dfc220cc4fbdd18919cb5ccea4f95ee1cdab4 \
-    --hash=sha256:7a5f930472650a82629163023e630d160863fce524c616f4e5186e5de9d9a49b \
-    --hash=sha256:7bfb192b3f4b9e8a89b6277b6ce787564f62cfd272055f6e685726b111dc7826 \
-    --hash=sha256:811ff8e9c313ab425368bcbb36e5c4ebd7108c2bbf4e4089cfbb0b01eff63fac \
-    --hash=sha256:8233f2947cf85404441fd7e0085f53b10c93e0ee78611099b5c7237e36aacbf7 \
-    --hash=sha256:82cf5301172168103724d49a1444d3378cb20cdee30b116a1bd6031236298a5d \
-    --hash=sha256:8358a950c8909158e3df31538a7e4edc2d7265a7c54b47f0864d9e5bae9dcebf \
-    --hash=sha256:85bb3611ff1802f3ee7fdd7dbff26b56f343fb432d57a4728fdd49b6ef35e2f4 \
-    --hash=sha256:86e1a4418c6cd97d60c95c71164158eaf7324fae7b0923264016baa993eba6fc \
-    --hash=sha256:8b9bab013d1c7a79d3501ff86d0bc9c31bf587db4551677b96bec07df78c6b15 \
-    --hash=sha256:8c5dac79fa1614d1e06ca695109c6105923bd9c7d1d6c918d4e637b7e6b32fd3 \
-    --hash=sha256:8d0820e8192167f80d88d64038e609c31452eeca865b4e1d9950a27a4609b00b \
-    --hash=sha256:8daafc69c93ee8a0204506a3b6b30f586ef54028f52aeeeb5c4cfc5184fd5914 \
-    --hash=sha256:9037063db01f09b09e237c282b6792bd4da634b5402c4e7f0c61effed7701a04 \
-    --hash=sha256:905a0ed8ea6f2d61c1738835f99b699348d7857379083e5fc497fa0c967a407c \
-    --hash=sha256:90884113d8b48f760e9587002789ddd741e76ab9f89518cd1e43b1f1a52ec44b \
-    --hash=sha256:91a06d2e259ecfbd8c901d70c3c507900458498142b3026a296b7de4d1322cc9 \
-    --hash=sha256:926c9541b14b12b1681dca8a0b75feb510b06c6341b70a8e500c2fdcff837cce \
-    --hash=sha256:9401557acd873c3a7f3eb9383edef8ac4968f9510e340f4808d427e75667e7b4 \
-    --hash=sha256:9551187363ffc0de2a00b2e47c25aeaeb1020b69b668762966df15fc5659dd5a \
-    --hash=sha256:962ccbab7b642487b1d8b7df90ef677e03134cf1fd8880bf698649b22a69371f \
-    --hash=sha256:97e7cf2be5c77b7d1a9713a05605d49460d02c6078d38d8bef3cbe323c548424 \
-    --hash=sha256:9aa768456404a8bf48a4406685ac2bec8e72b62c69313734fa3b73cf33b3a894 \
-    --hash=sha256:9bc519fbf2b7578398853d815009ae5e4d4603d12f4e3f91da8c06852d3da3e9 \
-    --hash=sha256:9d56801be94b86a9da183e5f3766e6310752b99ff647e38b09a9500d88e46e76 \
-    --hash=sha256:9f444c499b3eefd3a92e348059471ea0c3a6e303d9c1cec09fa748fd9f895201 \
-    --hash=sha256:9fa8ae11da9e2b3126c6426f147e0fba88d96d65921799bb30c6abd1cb2c97fb \
-    --hash=sha256:a0f62d0a58f4e7da165457e995725421e0064f2255d8eccebc49f41bbc23b109 \
-    --hash=sha256:a396dcc17e5a0b164dbe026896245a4fa9ff402edca1dff0be3d53a517f74de4 \
-    --hash=sha256:aaa2a54443eff1950ba5ddc6b6ccda0d9c84a364276a62f969bdf2a390650848 \
-    --hash=sha256:ad785e92e6dc634c21555edc8bd6b64957ab844541bcb96a1366c202951ae526 \
-    --hash=sha256:af8244b2bef6aaad6d92cda81372de7f8c8d36c9f0c3ea36e827c60e7d9467a0 \
-    --hash=sha256:b078afbc25f3a1436c7a1d2cd3e322497ee99615ba97c563566fdf46aff1ee01 \
-    --hash=sha256:b2f69dec1725e79a012d920df1707de5caf7ed5e08f3be4435e25803efc47458 \
-    --hash=sha256:b8458003118a712e66286df6a707db01c52c0f52f7db8e4a38f0da1d3b94fc4e \
-    --hash=sha256:bb63e0198ca18aad131c089b9204c23079c3afa95487e561f4c522d519e55aba \
-    --hash=sha256:bfec22eab3c8cc2ceec0248aec886624116dc079afa027ecc8ad4a7e62010f8a \
-    --hash=sha256:c1747f85cee84c26985853c6f3d9bd3e75da5212912443fa111c113b9c246f39 \
-    --hash=sha256:c1b3f518abeca3aa13c712fd202306e145abf59a18b094a6bafb2d2bbf59192c \
-    --hash=sha256:c50f2528cf200c5eed56faf3f4e22fcd5f38c157a8b78576e6ba3168ec35f000 \
-    --hash=sha256:c68fcd102d71ea85c5b2dfac3f4f8476eff42a9e078fd5faefff6d145063536b \
-    --hash=sha256:c7a7bd4e39e8e4c12c39cd480356842b6a8a06e41b23a55a5e3e191718838ddf \
-    --hash=sha256:c94f0688e7b8d0a67abf40e57a7eaaecd17cc9586706a31b76c031f63df052b4 \
-    --hash=sha256:cbaf13819775b7f769bf4a1f066cb6df7a28d4480081a589828ef190226881cd \
-    --hash=sha256:cd2213145bcc2ba85884d0ac63d222fece9209678f77b9b4d76f054c561adb28 \
-    --hash=sha256:ce5c1d2a8b27468f433ca974829c44060b8097eedc39933e3c206a90ee49c4a9 \
-    --hash=sha256:d396ec2b979760aaf3218e76c24e65bd0aca24983298653b3a9d7a45f9e47b30 \
-    --hash=sha256:d51026d73fcfd93610abc7b27789c26b313920fcfb20e27462d74a7f8b06e983 \
-    --hash=sha256:d80ee3d731373b24cebbc10d689ca4ee1875caf0d5703a245db18efd4dd37fc1 \
-    --hash=sha256:d995260fdf4e1db774581b4900e0f832abe3c7c84996726bbc161b19c8f29e76 \
-    --hash=sha256:da4b951fe36dc7c3a1ccb4e3cd1747c3542b8c9ceede8fc86cae054e764485f5 \
-    --hash=sha256:daa27d92c36f24388fe3ad306b174781c747627f134452e4f128ea00ce1fe8c4 \
-    --hash=sha256:db06ffe51636ffe9ca531fe9023dd64bdd794be8754cb5df57c5498ae5b518a7 \
-    --hash=sha256:e0d65b8c354be7fb5f720c3caa8bc940bc2d20ce749c8e06135f07f8ed95dd7c \
-    --hash=sha256:e68b7a074f65a2fd746c52a7ce6142ab7006074ac269ace0c25cd8ba171f8066 \
-    --hash=sha256:e739fee756ba1010f8bcccb534252e85a35fe45ae92c295a06059ce58b74ccd3 \
-    --hash=sha256:e846ae7835bf0703ae43f534ab79a867146dadd59dc9ca5c8b53d5c8f7c9ef02 \
-    --hash=sha256:e9c26f834c65f5752f3f06cb08cb86a913ceb7274d0db6e267808a708b46bc89 \
-    --hash=sha256:ea793e075b70290d89d8142074262885d3f7da19634845135751bd6344f73b50 \
-    --hash=sha256:f027324c56cd5406ca49c124b0db10e56c69064fec039acc571c29020cc87c76 \
-    --hash=sha256:f13a646d65d09fbf1bc6b3a9635d30095c8e7e5cc419ff35ecc563c5fd04cd49 \
-    --hash=sha256:f47286a97f0bc9b8859519809077b91b2cefe4ae47fcbf5e466a009c1c5d742b \
-    --hash=sha256:f747929cf940cddb5b3668a390056ddd5ba2e5010615ea2dcf4f9c4f3ab8791d \
-    --hash=sha256:f99626688942fb746e545232e7726926f3be91b5975f8b55327665fafda991c7 \
-    --hash=sha256:f9fa868638bf362d3d138ea55829cefb3d5f4b0d7f142234382a15e2485dbec4 \
-    --hash=sha256:fbdb89b3e1c94a30cc5edfce477c6e6a5dc4d8f84665b455c27582f211a1c72c \
-    --hash=sha256:fc010ab034c8c7452522748bf937df58020d256ccae0874463d1f4d01758af8e \
-    --hash=sha256:fc3e9034a63de20e15e8ade85358bc6efc614008cab72898b4b4952bea0509ff \
-    --hash=sha256:fd8b3d9fd264be37976686c7f65cd52a83f5e84f4bfd2adf9c1d469676bbb6ae
-sniffio==1.3.1 \
-    --hash=sha256:2f6da418d1f1e0fddd844478f41680e794e6051915791a034ff65e5f100525a2 \
-    --hash=sha256:f4324edc670a0f49750a81b895f35c3adb843cca46f0530f79fc1babb23789dc
-tqdm==4.68.3 \
-    --hash=sha256:00dfa48452b6b6cfae3dd9885636c23d3422d1ec97c66d96818cbd5e0821d482 \
-    --hash=sha256:39832cc2def2789a6f29df83f172db7416cea70052c0907a57801c5f2fdccb03
-typing-extensions==4.15.0 \
-    --hash=sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466 \
-    --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
-typing-inspection==0.4.2 \
-    --hash=sha256:4ed1cacbdc298c220f1bd249ed5287caa16f34d44ef4e9c3d0cbad5b521545e7 \
-    --hash=sha256:ba561c48a67c5958007083d386c3295464928b01faa735ab8547c5692e87f464

.github/scripts/uv_sync_with_retries.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-max_attempts="${UV_SYNC_MAX_ATTEMPTS:-5}"
-delay_seconds="${UV_SYNC_RETRY_DELAY_SECONDS:-15}"
-
-export CARGO_HTTP_MULTIPLEXING="${CARGO_HTTP_MULTIPLEXING:-false}"
-export CARGO_NET_RETRY="${CARGO_NET_RETRY:-5}"
-
-if [[ "$#" -eq 0 ]]; then
-  echo "usage: $0 <uv sync args...>" >&2
-  exit 2
-fi
-
-for attempt in $(seq 1 "${max_attempts}"); do
-  echo "uv sync attempt ${attempt}/${max_attempts}"
-  status=0
-  if uv sync "$@"; then
-    exit 0
-  else
-    status=$?
-  fi
-
-  if [[ "${attempt}" -eq "${max_attempts}" ]]; then
-    echo "uv sync failed after ${max_attempts} attempts" >&2
-    exit "${status}"
-  fi
-
-  echo "uv sync failed; retrying in ${delay_seconds}s..."
-  sleep "${delay_seconds}"
-done

.github/workflows/README.md

@@ -0,0 +1,35 @@
+# Simple PyPI Publishing
+
+A GitHub workflow to manually publish LiteLLM packages to PyPI with a specified version.
+
+## How to Use
+
+1. Go to the **Actions** tab in the GitHub repository
+2. Select **Simple PyPI Publish** from the workflow list
+3. Click **Run workflow**
+4. Enter the version to publish (e.g., `1.74.10`)
+
+## What the Workflow Does
+
+1. **Updates** the version in `pyproject.toml`
+2. **Copies** the model prices backup file
+3. **Builds** the Python package
+4. **Publishes** to PyPI
+
+## Prerequisites
+
+Make sure the following secret is configured in the repository:
+- `PYPI_PUBLISH_PASSWORD`: PyPI API token for authentication
+
+## Example Usage
+
+- Version: `1.74.11` → Publishes as v1.74.11
+- Version: `1.74.10-hotfix1` → Publishes as v1.74.10-hotfix1
+
+## Features
+
+- ✅ Manual trigger with version input
+- ✅ Automatic version updates in `pyproject.toml`
+- ✅ Repository safety check (only runs on official repo)
+- ✅ Clean package building and publishing
+- ✅ Success confirmation with PyPI package link 

.github/workflows/_test-unit-base.yml

@@ -18,35 +18,15 @@ on:
         type: number
         default: 2
       timeout-minutes:
-        description: >-
-          Timeout for the test step alone. Setup (checkout, dependency install,
-          Prisma client generation) gets its own allowance on top, so a slow
-          runner or a cold binary download can never cancel passing tests.
+        description: "Job timeout in minutes"
         required: false
         type: number
         default: 20
-      job-timeout-minutes:
-        description: >-
-          Backstop for the whole job. Keep it >= `timeout-minutes` plus 40: 35 for
-          the per-step ceilings on the setup steps below, and 5 for the runner
-          overhead the job clock charges but no step owns (job init, step
-          transitions, post-job cleanup). That headroom is what makes the test
-          budget a floor rather than a hope, since setup cannot overrun into it
-          without failing its own step first. GitHub expressions have no
-          arithmetic, so the sum is passed in rather than computed.
-        required: false
-        type: number
-        default: 60
       max-failures:
         description: "Stop after this many failures"
         required: false
         type: number
         default: 10
-      dist:
-        description: "pytest-xdist distribution mode (loadscope|load|worksteal|loadfile|no)"
-        required: false
-        type: string
-        default: "loadscope"
       artifact-name:
         description: "Unique name for the coverage artifact (must be unique per run)"
         required: true
@@ -59,41 +39,24 @@ jobs:
   run:
     name: Run tests
     runs-on: ubuntu-latest
-    timeout-minutes: ${{ inputs.job-timeout-minutes }}
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      decision: ${{ steps.changes.outputs.decision }}
+    timeout-minutes: ${{ inputs.timeout-minutes }}
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        timeout-minutes: 3
         with:
           persist-credentials: false
 
-      - name: Detect relevant changes
-        id: changes
-        timeout-minutes: 2
-        uses: ./.github/actions/detect-changes
-
       - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
       - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
@@ -103,71 +66,37 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-uv-
 
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 8
         run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
 
       - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
           uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
 
       - name: Run tests
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: ${{ inputs.timeout-minutes }}
         env:
           TEST_PATH: ${{ inputs.test-path }}
           MAX_FAILURES: ${{ inputs.max-failures }}
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
-          DIST: ${{ inputs.dist }}
-          # coverage.py's sys.monitoring backend (PEP 669), the cheapest core it has.
-          # It is only the default from Python 3.14, and these shards run 3.12, so it
-          # has to be asked for. Coverage refuses it when branch measurement is on
-          # (`branch_right_left` needs > 3.14.0a5) and falls back to the slow core with
-          # a `no-sysmon` warning, so turning on `branch = true` here means giving this
-          # back until the runners move to 3.14.
-          COVERAGE_CORE: sysmon
         run: |
-          if [ "${WORKERS}" = "0" ]; then
-            uv run --no-sync pytest ${TEST_PATH:?} \
-              --tb=short -vv \
-              --maxfail="${MAX_FAILURES}" \
-              --reruns "${RERUNS}" \
-              --reruns-delay 1 \
-              --durations=20 \
-              --cov=./litellm --cov=./enterprise/litellm_enterprise \
-              --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
-          else
-            uv run --no-sync pytest ${TEST_PATH:?} \
-              --tb=short -vv \
-              --maxfail="${MAX_FAILURES}" \
-              -n "${WORKERS}" \
-              --reruns "${RERUNS}" \
-              --reruns-delay 1 \
-              --dist="${DIST}" \
-              --durations=20 \
-              --cov=./litellm --cov=./enterprise/litellm_enterprise \
-              --cov-report=xml:coverage.xml \
-              --cov-config=pyproject.toml
-          fi
+          uv run --no-sync pytest ${TEST_PATH:?} \
+            --tb=short -vv \
+            --maxfail="${MAX_FAILURES}" \
+            -n "${WORKERS}" \
+            --reruns "${RERUNS}" \
+            --reruns-delay 1 \
+            --dist=loadscope \
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage.xml \
+            --cov-config=pyproject.toml
 
       - name: Save coverage report
-        if: always() && steps.changes.outputs.decision != 'skip'
+        if: always()
         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
@@ -177,7 +106,7 @@ jobs:
   upload-coverage:
     name: Upload coverage to Codecov
     needs: run
-    if: always() && needs.run.outputs.decision != 'skip'
+    if: always()
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -198,23 +127,9 @@ jobs:
           merge-multiple: true
 
       - name: Upload to Codecov
-        id: codecov-upload
-        continue-on-error: true
         uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
         with:
           use_oidc: true
           directory: coverage-reports
           root_dir: ${{ github.workspace }}
-          flags: ${{ inputs.artifact-name }}
-          fail_ci_if_error: false
-
-      - name: Upload to Codecov (retry)
-        if: steps.codecov-upload.outcome == 'failure'
-        continue-on-error: true
-        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          flags: ${{ inputs.artifact-name }}
           fail_ci_if_error: false

.github/workflows/_test-unit-services-base.yml

@@ -0,0 +1,189 @@
+name: _Unit Test Services Base (Reusable)
+
+on:
+  workflow_call:
+    inputs:
+      test-path:
+        description: "Pytest path(s) to run"
+        required: true
+        type: string
+      workers:
+        description: "Number of pytest-xdist workers (0 = no parallelism)"
+        required: false
+        type: number
+        default: 2
+      reruns:
+        description: "Number of reruns for flaky tests"
+        required: false
+        type: number
+        default: 2
+      timeout-minutes:
+        description: "Job timeout in minutes"
+        required: false
+        type: number
+        default: 20
+      max-failures:
+        description: "Stop after this many failures"
+        required: false
+        type: number
+        default: 10
+      enable-postgres:
+        description: "Start a local Postgres service container and run Prisma migrations"
+        required: false
+        type: boolean
+        default: false
+      dist:
+        description: "pytest-xdist distribution mode (loadscope|load|worksteal|loadfile|no)"
+        required: false
+        type: string
+        default: "loadscope"
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: false
+        type: string
+        default: "run"
+
+permissions:
+  contents: read
+
+# The postgres service container below is spawned per-job on localhost and
+# destroyed with the job. Nothing outside the runner can reach it. The
+# user/password/database here are not secrets — they're bootstrap values
+# for a throwaway container — so we hardcode them instead of attaching
+# every matrix shard to a GHA environment just to read three "secrets"
+# (which also produces a "temporarily deployed to …" notification on the
+# PR timeline per shard per push).
+jobs:
+  run:
+    name: Run tests
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ inputs.timeout-minutes }}
+
+    services:
+      postgres:
+        image: postgres@sha256:705a5d5b5836f3fcba0d02c4d281e6a7dd9ed2dd4078640f08a1e1e9896e097d # postgres:14
+        env:
+          POSTGRES_USER: litellm
+          POSTGRES_PASSWORD: litellm
+          POSTGRES_DB: litellm_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-services-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-services-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run Prisma migrations
+        if: ${{ inputs.enable-postgres }}
+        env:
+          DATABASE_URL: "postgresql://litellm:litellm@localhost:5432/litellm_test"
+        run: |
+          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
+
+      - name: Run tests
+        env:
+          TEST_PATH: ${{ inputs.test-path }}
+          MAX_FAILURES: ${{ inputs.max-failures }}
+          WORKERS: ${{ inputs.workers }}
+          RERUNS: ${{ inputs.reruns }}
+          DIST: ${{ inputs.dist }}
+          DATABASE_URL: ${{ inputs.enable-postgres && 'postgresql://litellm:litellm@localhost:5432/litellm_test' || '' }}
+        run: |
+          if [ "${WORKERS}" = "0" ]; then
+            uv run --no-sync pytest ${TEST_PATH:?} \
+              --tb=short -vv \
+              --maxfail="${MAX_FAILURES}" \
+              --reruns "${RERUNS}" \
+              --reruns-delay 1 \
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
+          else
+            uv run --no-sync pytest ${TEST_PATH:?} \
+              --tb=short -vv \
+              --maxfail="${MAX_FAILURES}" \
+              -n "${WORKERS}" \
+              --reruns "${RERUNS}" \
+              --reruns-delay 1 \
+              --dist="${DIST}" \
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
+          fi
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/auto_update_price_and_context_window.yml

@@ -18,18 +18,15 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
       - name: Update JSON Data
         run: |
-          uv run --frozen --with 'aiohttp==3.13.3' python ".github/scripts/auto_update_price_and_context_window_file.py"
-      - name: Regenerate JSON Schema
-        run: |
-          uv run --frozen python ci_cd/generate_model_prices_schema.py
+          uv run --frozen --with 'aiohttp==3.13.3' python ".github/workflows/auto_update_price_and_context_window_file.py"
       - name: Create Pull Request
         run: |
-          git add model_prices_and_context_window.json model_prices_and_context_window.schema.json
+          git add model_prices_and_context_window.json 
           git commit -m "Update model_prices_and_context_window.json file: $(date +'%Y-%m-%d')" 
           gh pr create --title "Update model_prices_and_context_window.json file" \
             --body "Automated update for model_prices_and_context_window.json" \

.github/workflows/check-schema-sync.yml

@@ -10,10 +10,6 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   check-sync:
     name: Verify schema.prisma copies match root

.github/workflows/check-ui-api-types.yml

@@ -1,136 +0,0 @@
-name: Check UI API Types Sync
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  check-sync:
-    name: Verify schema.d.ts matches the proxy OpenAPI spec
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-          fetch-depth: 2
-
-      - name: Detect changes that can affect the generated types
-        id: changes
-        run: |
-          set -euo pipefail
-          if ! base="$(git rev-parse --verify --quiet HEAD^2 >/dev/null && git rev-parse HEAD^1)"; then
-            echo "Not a pull request merge commit, running the full check."
-            echo "relevant=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          files="$(git diff --name-only "$base" HEAD)"
-          if grep -Eq '^(litellm/(proxy|types)/|ui/litellm-dashboard/(src/lib/http/schema\.d\.ts|scripts/gen-api-types\.mjs|package(-lock)?\.json)$|\.github/workflows/check-ui-api-types\.yml$)' <<< "$files"; then
-            echo "relevant=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "No proxy, types or generator changes in this pull request, nothing to verify."
-            echo "relevant=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Set up Python
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install backend dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        run: .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.relevant == 'true'
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.relevant == 'true'
-        run: uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Regenerate the lazy OpenAPI snapshot
-        if: steps.changes.outputs.relevant == 'true'
-        run: uv run --no-sync python -m litellm.proxy._lazy_openapi_snapshot
-
-      - name: Fail if the lazy OpenAPI snapshot is stale
-        if: steps.changes.outputs.relevant == 'true'
-        run: |
-          if ! git diff --exit-code -- litellm/proxy/_lazy_openapi_snapshot.json; then
-            echo "::error file=litellm/proxy/_lazy_openapi_snapshot.json::The lazy OpenAPI snapshot is out of sync with the lazily loaded routes."
-            echo ""
-            echo "A lazily loaded route or model changed without regenerating the snapshot that /openapi.json serves for unloaded features."
-            echo "To fix, run from the repo root:"
-            echo "  uv run python -m litellm.proxy._lazy_openapi_snapshot"
-            echo "then run npm run gen:api from ui/litellm-dashboard and commit both files."
-            exit 1
-          fi
-          echo "_lazy_openapi_snapshot.json is in sync with the lazily loaded routes."
-
-      - name: Set up Node.js
-        if: steps.changes.outputs.relevant == 'true'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dashboard dependencies
-        if: steps.changes.outputs.relevant == 'true'
-        working-directory: ui/litellm-dashboard
-        run: npm ci
-
-      - name: Regenerate types from the live spec
-        if: steps.changes.outputs.relevant == 'true'
-        working-directory: ui/litellm-dashboard
-        env:
-          LITELLM_PYTHON: "uv run --no-sync python"
-        run: npm run gen:api
-
-      - name: Fail if types are stale
-        if: steps.changes.outputs.relevant == 'true'
-        run: |
-          if ! git diff --exit-code -- ui/litellm-dashboard/src/lib/http/schema.d.ts; then
-            echo "::error file=ui/litellm-dashboard/src/lib/http/schema.d.ts::Generated API types are out of sync with the proxy OpenAPI spec."
-            echo ""
-            echo "A backend route or model changed without regenerating the dashboard types."
-            echo "To fix, run from ui/litellm-dashboard:"
-            echo "  npm run gen:api"
-            echo "then commit the updated src/lib/http/schema.d.ts."
-            exit 1
-          fi
-          echo "schema.d.ts is in sync with the proxy OpenAPI spec."

.github/workflows/ci-coverage.yml

@@ -1,51 +0,0 @@
-name: "CI Coverage"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-  push:
-    branches:
-      - main
-      - litellm_internal_staging
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  assert-ci-coverage:
-    name: assert-ci-coverage
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Assert every test file and Dockerfile is invoked by a job
-        run: |
-          python -m pip install "pyyaml==6.0.3"
-          python .github/scripts/assert_ci_coverage.py
-
-      # The census asks whether a job names a file; this asks whether that job's -k
-      # then throws it back out. A file both globbed and deselected everywhere runs
-      # nowhere while counting as covered, which is how the caching suite went unrun.
-      - name: Assert no -k expression deselects a file from every job that globs it
-        run: python .github/scripts/assert_ci_coverage.py --slices
-
-      - name: Assert .github/workflows/ holds only workflows, correctly named
-        run: python .github/scripts/assert_workflow_dir_hygiene.py

.github/workflows/close_low_quality_prs.yml

@@ -1,92 +0,0 @@
-name: Close Low-Quality PRs
-
-# Auto-close any open PR (including drafts, regardless of age) authored by an
-# external OSS contributor that Greptile reviewed with a confidence score
-# below 4/5. Closures are explained in a comment that tells the contributor
-# to push fixes and open a fresh PR (since OSS authors cannot reopen a PR
-# closed by a bot/maintainer) or comment `@agent-shin reconsider` to have
-# Agent Shin re-evaluate.
-#
-# Manual one-off run:
-#   gh workflow run "Close Low-Quality PRs" -f close=true
-#
-# Dry-run preview (no PRs are touched):
-#   gh workflow run "Close Low-Quality PRs" -f close=false
-
-on:
-  schedule:
-    # Daily at 09:00 UTC. Pairs well with the stale-issue workflow at midnight.
-    - cron: "0 9 * * *"
-  workflow_dispatch:
-    inputs:
-      close:
-        description: "Actually close matching PRs (false = dry run)."
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "true"
-          - "false"
-      min_age_days:
-        description: "Minimum PR age in days (default 0 = no age filter)."
-        required: false
-        default: "0"
-      min_score:
-        description: "Greptile score below which a PR is closed (1-5)."
-        required: false
-        default: "4"
-      limit:
-        description: "Maximum number of PRs to close in a single run."
-        required: false
-        default: "25"
-
-permissions:
-  contents: read
-  pull-requests: write
-  issues: write
-
-jobs:
-  close-low-quality-prs:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout triage script
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          sparse-checkout: .github/scripts
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Run low-quality PR closer
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Scheduled runs are ALWAYS dry-run, even when AGENT_SHIN_ENABLED is
-          # "true", so the team can QA the closer's verdicts in step summaries
-          # before any contributor sees a PR closed. Real closures only happen
-          # on manual workflow_dispatch with close=true (and the variable set).
-          CLOSE_FLAG: ${{ github.event.inputs.close || 'false' }}
-          AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}
-          MIN_AGE_DAYS: ${{ github.event.inputs.min_age_days || '0' }}
-          MIN_SCORE: ${{ github.event.inputs.min_score || '4' }}
-          LIMIT: ${{ github.event.inputs.limit || '25' }}
-        run: |
-          set -euo pipefail
-          ARGS=(
-            --repo "${{ github.repository }}"
-            --min-age-days "${MIN_AGE_DAYS}"
-            --min-score "${MIN_SCORE}"
-            --limit "${LIMIT}"
-          )
-          if [ "${AGENT_SHIN_ENABLED:-false}" != "true" ]; then
-            echo "::notice::AGENT_SHIN_ENABLED is not 'true' -> forcing dry-run regardless of close input."
-          elif [ "${GITHUB_EVENT_NAME:-}" = "workflow_dispatch" ] && [ "${CLOSE_FLAG}" = "true" ]; then
-            ARGS+=(--close)
-            echo "::notice::Running in close-on-fail mode."
-          else
-            echo "::notice::AGENT_SHIN_ENABLED is true but this trigger is dry-run (scheduled event or close=false)."
-          fi
-          python3 .github/scripts/close_low_quality_prs.py "${ARGS[@]}"

.github/workflows/codeql.yml

@@ -43,41 +43,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
+        uses: github/codeql-action/analyze@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3
         with:
           category: "/language:${{ matrix.language }}"
-          output: sarif-results
-          upload: failure-only
-
-      # py/weak-sensitive-data-hashing (CWE-328) fires on the OCI signing call at
-      # litellm/llms/oci/common_utils.py, which hashes the HTTP request body to
-      # produce the x-content-sha256 header required by the OCI HTTP signing spec —
-      # a content-integrity hash, not a password or secret hash. SHA-256 is mandated
-      # by Oracle for this header; see
-      # https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm
-      # The `usedforsecurity=False` flag on the hashlib.sha256 call already declares
-      # non-security intent, but CodeQL's taint flow still re-fires when callers
-      # further up the stack are modified. The suppression is scoped to this one
-      # file/rule pair via SARIF post-filtering so every other callsite of
-      # py/weak-sensitive-data-hashing in the repository continues to be analyzed.
-      - name: Filter SARIF (OCI sha256)
-        if: matrix.language == 'python'
-        uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1
-        with:
-          patterns: |
-            -litellm/llms/oci/common_utils.py:py/weak-sensitive-data-hashing
-          input: sarif-results/python.sarif
-          output: sarif-results/python.sarif
-
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3.34.1
-        with:
-          sarif_file: sarif-results
-          category: "/language:${{ matrix.language }}"

.github/workflows/codspeed.yml

@@ -4,25 +4,9 @@ on:
   push:
     branches:
       - main
-      - litellm_internal_staging
-    paths:
-      - "litellm/**"
-      - "tests/benchmarks/**"
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/workflows/codspeed.yml"
-      - ".github/actions/setup-uv-with-retries/**"
   pull_request:
     branches:
       - main
-      - litellm_internal_staging
-    paths:
-      - "litellm/**"
-      - "tests/benchmarks/**"
-      - "pyproject.toml"
-      - "uv.lock"
-      - ".github/workflows/codspeed.yml"
-      - ".github/actions/setup-uv-with-retries/**"
   # Allow CodSpeed to trigger backtest performance analysis
   # in order to generate initial data
   workflow_dispatch:
@@ -37,8 +21,8 @@ concurrency:
 
 jobs:
   benchmarks:
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
@@ -51,7 +35,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
@@ -64,8 +48,6 @@ jobs:
             uv run --frozen --no-default-groups
             --with pytest==8.3.5
             --with pytest-codspeed==4.3.0
-            --with "mcp>=1.26.0,<2.0"
-            --with "a2a-sdk>=1.1.0,<2.0"
             pytest
             -p pytest_codspeed.plugin
             tests/benchmarks/

.github/workflows/conventional-commits.yml

@@ -1,50 +0,0 @@
-name: Conventional PR Title
-
-# Squash-merge replaces the merge commit subject with the PR title, so
-# enforcing Conventional Commits at the PR-title level is what actually gates
-# the commits that land on the default branch. The local commit-msg hook
-# (.githooks/commit-msg) is a best-effort assist; this workflow is the gate.
-#
-# See https://www.conventionalcommits.org/en/v1.0.0/
-
-on:
-  pull_request:
-    types: [opened, edited, reopened, synchronize, labeled, unlabeled]
-
-permissions:
-  pull-requests: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  lint-pr-title:
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check title against Conventional Commits
-        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          # Must mirror the type list in .githooks/commit-msg.
-          types: |
-            feat
-            fix
-            docs
-            style
-            refactor
-            perf
-            test
-            build
-            ci
-            chore
-            revert
-          requireScope: false
-          subjectPattern: ^(?![A-Z]).+$
-          subjectPatternError: |
-            The subject "{subject}" must start with a lowercase character.
-          # Allow merges/reverts that GitHub generates automatically.
-          ignoreLabels: |
-            ignore-semantic-pull-request

.github/workflows/create-release-branch.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, 1.84.0.post1; legacy v1.83.10-stable still accepted) — branch will be named release/<tag>"
+        description: "Release tag (e.g. v1.83.0-stable) — branch will be named release/<tag>"
         required: true
         type: string
       commit_hash:
@@ -14,7 +14,7 @@ on:
   workflow_call:
     inputs:
       tag:
-        description: "Release tag (e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, 1.84.0.post1; legacy v1.83.10-stable still accepted)"
+        description: "Release tag"
         required: true
         type: string
       commit_hash:
@@ -40,8 +40,8 @@ jobs:
             echo "::error::commit_hash must be a full 40-character commit SHA"
             exit 1
           fi
-          if ! echo "${TAG}" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+'; then
-            echo "::error::tag must start with X.Y.Z (optional leading v), e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, or v1.83.10-stable"
+          if ! echo "${TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "::error::tag must start with vX.Y.Z"
             exit 1
           fi
 
@@ -63,28 +63,3 @@ jobs:
               sha: commitHash,
             });
             core.info(`Created branch ${branchName} at ${commitHash}`);
-
-      - name: Create stable line branch
-        env:
-          TAG: ${{ inputs.tag }}
-          COMMIT_HASH: ${{ inputs.commit_hash }}
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-        with:
-          script: |
-            const tag = process.env.TAG;
-            const commitHash = process.env.COMMIT_HASH;
-
-            const match = tag.match(/^v?(\d+)\.(\d+)\.0$/);
-            if (!match) {
-              core.info(`Tag ${tag} is not the X.Y.0 stable opener; skipping stable line branch`);
-              return;
-            }
-            const lineBranch = `stable/${match[1]}.${match[2]}.x`;
-
-            await github.rest.git.createRef({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: `refs/heads/${lineBranch}`,
-              sha: commitHash,
-            });
-            core.info(`Created branch ${lineBranch} at ${commitHash}`);

.github/workflows/create-release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       tag:
-        description: "Release tag (e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, 1.84.0-dev.2, 1.84.0.post1; legacy v1.83.10-stable still accepted)"
+        description: "Release tag (e.g. v1.83.0-stable)"
         required: true
         type: string
       commit_hash:
@@ -30,8 +30,8 @@ jobs:
             echo "::error::commit_hash must be a full 40-character commit SHA"
             exit 1
           fi
-          if ! echo "${TAG}" | grep -qE '^v?[0-9]+\.[0-9]+\.[0-9]+'; then
-            echo "::error::tag must start with X.Y.Z (optional leading v), e.g. 1.84.0, 1.84.0rc1, 1.84.0.dev42, or v1.83.10-stable"
+          if ! echo "${TAG}" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+'; then
+            echo "::error::tag must start with vX.Y.Z"
             exit 1
           fi
 
@@ -45,29 +45,6 @@ jobs:
             const tag = process.env.TAG;
             const commitHash = process.env.COMMIT_HASH;
 
-            // Mark RC / dev / nightly / alpha / beta tags as GitHub pre-releases.
-            // Accept both PEP 440 (`.dev`) and SemVer (`-dev`) separators so tags
-            // like `1.84.0.dev2` and `1.84.0-dev.2` are both detected.
-            // PEP 440 post-releases (e.g. `1.84.0.post1`) and legacy `-stable[.patch.N]`
-            // are stable maintenance releases, not pre-releases.
-            const isPrerelease = /(?:rc|nightly|alpha|beta|[-.]dev)/i.test(tag);
-
-            // A stable release should only claim the repo "latest" badge when its
-            // version is >= the current latest. Otherwise a backport (e.g. 1.84.6)
-            // would steal "latest" from a newer line (e.g. 1.88.1).
-            const versionKey = (rawTag) => {
-              const m = String(rawTag).match(/^v?(\d+)\.(\d+)\.(\d+)/);
-              if (!m) return null;
-              const maintenance = String(rawTag).match(/(?:\.post|\.patch\.)(\d+)/i);
-              return [Number(m[1]), Number(m[2]), Number(m[3]), maintenance ? Number(maintenance[1]) : 0];
-            };
-            const isAtLeast = (a, b) => {
-              for (let i = 0; i < a.length; i++) {
-                if (a[i] !== b[i]) return a[i] > b[i];
-              }
-              return true;
-            };
-
             const cosignSection = [
               `## Verify Docker Image Signature`,
               ``,
@@ -106,47 +83,13 @@ jobs:
             ].join('\n');
 
             try {
-              let makeLatest = "false";
-              const newVersion = versionKey(tag);
-              if (!isPrerelease && newVersion) {
-                let latestVersion = null;
-                try {
-                  const latest = await github.rest.repos.getLatestRelease({
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                  });
-                  latestVersion = versionKey(latest.data.tag_name);
-                } catch (error) {
-                  if (error.status !== 404) throw error;
-                }
-                makeLatest = (!latestVersion || isAtLeast(newVersion, latestVersion)) ? "true" : "false";
-              }
-
-              try {
-                await github.rest.git.createRef({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  ref: `refs/tags/${tag}`,
-                  sha: commitHash,
-                });
-              } catch (error) {
-                if (error.status !== 422) throw error;
-                const existing = await github.rest.git.getRef({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  ref: `tags/${tag}`,
-                });
-                if (existing.data.object.sha !== commitHash) {
-                  throw new Error(`Tag ${tag} already exists at ${existing.data.object.sha}, expected ${commitHash}`);
-                }
-              }
-
               const response = await github.rest.repos.createRelease({
                 draft: true,
                 generate_release_notes: true,
+                target_commitish: commitHash,
                 name: tag,
                 owner: context.repo.owner,
-                prerelease: isPrerelease,
+                prerelease: false,
                 repo: context.repo.repo,
                 tag_name: tag,
               });
@@ -156,21 +99,10 @@ jobs:
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 release_id: response.data.id,
-                tag_name: tag,
                 body: updatedBody,
                 draft: false,
               });
 
-              if (!isPrerelease) {
-                await github.rest.repos.updateRelease({
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  release_id: response.data.id,
-                  tag_name: tag,
-                  make_latest: makeLatest,
-                });
-              }
-
             } catch (error) {
               core.setFailed(error.message);
             }

.github/workflows/create_daily_oss_agent_shin_branch.yml

@@ -1,28 +0,0 @@
-name: Create Daily oss-agent-shin Branch
-
-on:
-  schedule:
-    - cron: "0 0 * * *" # Runs every day at midnight UTC
-  workflow_dispatch: # Allow manual trigger
-
-jobs:
-  create-oss-agent-shin-branch:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    steps:
-      - name: Create daily oss-agent-shin branch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          BRANCH_NAME="litellm_oss_agent_shin_$(date +'%m_%d_%Y')"
-          echo "Creating branch: $BRANCH_NAME"
-          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
-            echo "Branch $BRANCH_NAME already exists. Skipping creation."
-            exit 0
-          fi
-          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
-          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
-          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"

.github/workflows/create_daily_staging_branch.yml

@@ -13,19 +13,38 @@ jobs:
       contents: write
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
       - name: Create daily staging branch
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          # Configure Git user
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Generate branch name with MM_DD_YYYY format
           BRANCH_NAME="litellm_oss_staging_$(date +'%m_%d_%Y')"
           echo "Creating branch: $BRANCH_NAME"
-          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
+
+          # Fetch all branches
+          git fetch --all
+
+          # Check if the branch already exists
+          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
             echo "Branch $BRANCH_NAME already exists. Skipping creation."
-            exit 0
+          else
+            echo "Creating new branch: $BRANCH_NAME"
+            # Create the new branch from main
+            git checkout -b $BRANCH_NAME origin/main
+            # Push the new branch
+            git push origin $BRANCH_NAME
+            echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi
-          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
-          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
-          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"
 
   create-internal-dev-branch:
     if: github.repository == 'BerriAI/litellm'
@@ -34,16 +53,35 @@ jobs:
       contents: write
 
     steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
       - name: Create internal dev branch
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          # Configure Git user
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Generate branch name with MM_DD_YYYY format
           BRANCH_NAME="litellm_internal_dev_$(date +'%m_%d_%Y')"
           echo "Creating branch: $BRANCH_NAME"
-          if gh api "repos/${{ github.repository }}/git/ref/heads/$BRANCH_NAME" --silent 2>/dev/null; then
+
+          # Fetch all branches
+          git fetch --all
+
+          # Check if the branch already exists
+          if git show-ref --verify --quiet refs/remotes/origin/$BRANCH_NAME; then
             echo "Branch $BRANCH_NAME already exists. Skipping creation."
-            exit 0
+          else
+            echo "Creating new branch: $BRANCH_NAME"
+            # Create the new branch from main
+            git checkout -b $BRANCH_NAME origin/main
+            # Push the new branch
+            git push origin $BRANCH_NAME
+            echo "Successfully created and pushed branch: $BRANCH_NAME"
           fi
-          MAIN_SHA=$(gh api "repos/${{ github.repository }}/git/ref/heads/main" --jq '.object.sha')
-          gh api "repos/${{ github.repository }}/git/refs" -f ref="refs/heads/$BRANCH_NAME" -f sha="$MAIN_SHA" --silent
-          echo "Successfully created branch: $BRANCH_NAME at $MAIN_SHA"

.github/workflows/e2e_record_replay.yml

@@ -1,237 +0,0 @@
-name: "E2E Record and Replay"
-
-on:
-  schedule:
-    - cron: "0 8 * * 6"
-    - cron: "0 8 * * 1-5"
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: "record (hits real providers and publishes a fresh bundle) or replay (bundle only, zero provider egress)"
-        type: choice
-        options:
-          - record
-          - replay
-        default: record
-
-permissions:
-  contents: read
-
-jobs:
-  record:
-    name: "Record the e2e suite against real providers"
-    if: >-
-      (github.event_name != 'schedule' || github.repository == 'BerriAI/litellm') &&
-      (github.event.schedule == '0 8 * * 6' ||
-       (github.event_name == 'workflow_dispatch' && github.event.inputs.mode == 'record'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    services:
-      postgres:
-        image: postgres:16.6
-        env:
-          POSTGRES_USER: llmproxy
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U llmproxy"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-    env:
-      DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-      LITELLM_MASTER_KEY: sk-e2e-record-replay
-      LITELLM_LOCAL_MODEL_COST_MAP: "True"
-      OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Start the proxy
-        run: |
-          nohup uv run --no-sync litellm --config tests/e2e/gateway/record_replay_ci_config.yml --port 4000 > proxy.log 2>&1 &
-          for _ in $(seq 1 90); do
-            if curl -fs http://localhost:4000/health/liveliness > /dev/null; then
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "proxy never became live"
-          tail -n 100 proxy.log
-          exit 1
-
-      - name: Record the replayable e2e lane
-        env:
-          E2E_FIXTURE_MODE: record
-        run: |
-          uv run --no-sync pytest tests/e2e -m replayable --reruns 0 -v --tb=short -rA
-
-      - name: Pack the fixture bundle
-        run: |
-          .github/scripts/e2e_pack_fixture_bundle.sh tests/e2e/.fixtures "${RUNNER_TEMP}/bundle/e2e-fixtures.tar.gz"
-
-      - name: Publish the fixture bundle
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: e2e-fixtures-bundle
-          path: |
-            ${{ runner.temp }}/bundle/e2e-fixtures.tar.gz
-            ${{ runner.temp }}/bundle/e2e-fixtures.tar.gz.sha256
-          if-no-files-found: error
-          retention-days: 30
-
-      - name: Show proxy log on failure
-        if: failure()
-        run: tail -n 300 proxy.log
-
-  replay:
-    name: "Replay the e2e suite from the pinned bundle with zero egress"
-    if: >-
-      (github.event_name != 'schedule' || github.repository == 'BerriAI/litellm') &&
-      (github.event.schedule == '0 8 * * 1-5' ||
-       (github.event_name == 'workflow_dispatch' && github.event.inputs.mode == 'replay'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      actions: read
-    services:
-      postgres:
-        image: postgres:16.6
-        env:
-          POSTGRES_USER: llmproxy
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd "pg_isready -U llmproxy"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 10
-    env:
-      DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-      LITELLM_MASTER_KEY: sk-e2e-record-replay
-      LITELLM_LOCAL_MODEL_COST_MAP: "True"
-      GH_TOKEN: ${{ github.token }}
-      OPENAI_API_KEY: sk-replay-must-never-reach-a-provider
-      ANTHROPIC_API_KEY: sk-ant-replay-must-never-reach-a-provider
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra proxy
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Fetch the pinned fixture bundle by digest
-        env:
-          BASE_BRANCH: ${{ github.ref_name }}
-        run: |
-          .github/scripts/e2e_fetch_fixture_bundle.sh \
-            "${GITHUB_REPOSITORY}" \
-            e2e-fixtures-bundle \
-            "${BASE_BRANCH}" \
-            tests/e2e/.fixtures
-
-      - name: Start the proxy
-        run: |
-          nohup uv run --no-sync litellm --config tests/e2e/gateway/record_replay_ci_config.yml --port 4000 > proxy.log 2>&1 &
-          for _ in $(seq 1 90); do
-            if curl -fs http://localhost:4000/health/liveliness > /dev/null; then
-              exit 0
-            fi
-            sleep 2
-          done
-          echo "proxy never became live"
-          tail -n 100 proxy.log
-          exit 1
-
-      - name: Start the egress sentinel
-        run: |
-          # shellcheck disable=SC2024  # the log redirect is deliberately the runner user's, so a later non-sudo cat can read it
-          sudo python3 .github/scripts/e2e_egress_sentinel.py serve \
-            --host api.openai.com \
-            --host api.anthropic.com \
-            --hits-file "${RUNNER_TEMP}/egress-hits.jsonl" \
-            --ready-file "${RUNNER_TEMP}/egress-ready" \
-            --pid-file "${RUNNER_TEMP}/egress.pid" \
-            > "${RUNNER_TEMP}/egress-sentinel.log" 2>&1 &
-          for _ in $(seq 1 30); do
-            if [[ -f "${RUNNER_TEMP}/egress-ready" ]]; then
-              cat "${RUNNER_TEMP}/egress-sentinel.log"
-              exit 0
-            fi
-            sleep 1
-          done
-          echo "egress sentinel never became ready"
-          cat "${RUNNER_TEMP}/egress-sentinel.log"
-          exit 1
-
-      - name: Replay the replayable e2e lane
-        env:
-          E2E_FIXTURE_MODE: replay
-        run: |
-          uv run --no-sync pytest tests/e2e -m replayable --reruns 0 -v --tb=short -rA
-
-      - name: Stop the egress sentinel and assert zero provider egress
-        if: always()
-        run: |
-          if [[ -f "${RUNNER_TEMP}/egress.pid" ]]; then
-            sudo kill -TERM "$(cat "${RUNNER_TEMP}/egress.pid")" 2>/dev/null || true
-            sleep 2
-          fi
-          python3 .github/scripts/e2e_egress_sentinel.py assert-empty --hits-file "${RUNNER_TEMP}/egress-hits.jsonl"
-
-      - name: Show proxy log on failure
-        if: failure()
-        run: tail -n 300 proxy.log

.github/workflows/guard-fork-dependencies.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
     paths:
       - "uv.lock"
@@ -15,10 +15,6 @@ on:
 
 permissions: {}
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   guard:
     name: Block fork dependency changes

.github/workflows/guard-main-branch.yml

@@ -31,12 +31,12 @@ jobs:
           echo "PR head repo: $HEAD_REPO"
           echo "PR head branch: $HEAD_REF"
           if [ "$HEAD_REPO" != "$BASE_REPO" ]; then
-            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against 'litellm_internal_staging' instead."
+            echo "::error::PRs to main must originate from the canonical repository ($BASE_REPO), not a fork ($HEAD_REPO). External contributors should open PRs against the 'litellm_oss_branch' branch instead."
             exit 1
           fi
           if [ "$HEAD_REF" = "litellm_internal_staging" ] || [[ "$HEAD_REF" == litellm_hotfix_?* ]]; then
             echo "Allowed source branch."
             exit 0
           fi
-          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_internal_staging' instead."
+          echo "::error::PRs to main must originate from 'litellm_internal_staging' or a 'litellm_hotfix_*' branch. Got: '$HEAD_REF'. If this is a contribution, retarget the PR against 'litellm_oss_branch' instead."
           exit 1

.github/workflows/helm_unit_test.yml

@@ -9,10 +9,6 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   unit-test:
     runs-on: ubuntu-latest
@@ -27,28 +23,19 @@ jobs:
         with:
           version: "3.11.1"
 
-      - name: Download and verify Helm Unit Test Plugin
-        run: |
-          curl -fsSLo "$RUNNER_TEMP/helm-unittest.tgz" https://github.com/helm-unittest/helm-unittest/releases/download/v0.8.2/helm-unittest-linux-amd64-0.8.2.tgz
-          echo "56ab3091e6fa52a7c92ee951def9bed957f295d9ce98483aed404e748d7b3a94  $RUNNER_TEMP/helm-unittest.tgz" | sha256sum -c -
-
       - name: Install Helm Unit Test Plugin
         run: |
+          helm plugin install https://github.com/helm-unittest/helm-unittest --version v0.4.4
+      - name: Verify Helm Unit Test Plugin integrity
+        run: |
+          EXPECTED_SHA="e251ba198448629678ff2168e1a469249d998155"
           PLUGIN_DIR="$(helm env HELM_PLUGINS)/helm-unittest"
-          mkdir -p "$PLUGIN_DIR"
-          tar -xzf "$RUNNER_TEMP/helm-unittest.tgz" -C "$PLUGIN_DIR"
-          helm plugin list
+          ACTUAL_SHA="$(git -C "$PLUGIN_DIR" rev-parse HEAD)"
+          if [ "$ACTUAL_SHA" != "$EXPECTED_SHA" ]; then
+            echo "::error::Helm unittest plugin checksum mismatch! Expected $EXPECTED_SHA but got $ACTUAL_SHA"
+            exit 1
+          fi
+          echo "Helm unittest plugin integrity verified: $ACTUAL_SHA"
 
       - name: Run unit tests
-        run: |
-          for chart in helm/litellm-helm helm/litellm; do
-            declared="$(grep -h '^suite:' "$chart"/tests/*.yaml | wc -l | tr -d '[:space:]')"
-            output="$(mktemp)"
-            helm unittest -f 'tests/*.yaml' "$chart" | tee "$output"
-            executed="$(sed -n 's/^Test Suites:.*[[:space:]]\([0-9][0-9]*\) total$/\1/p' "$output")"
-            if [ "$declared" != "$executed" ]; then
-              echo "::error::$chart declares $declared test suites but helm-unittest ran $executed. Suites are being skipped silently, so their assertions never execute."
-              exit 1
-            fi
-            echo "$chart: all $declared declared test suites ran"
-          done
+        run: helm unittest -f 'tests/*.yaml' deploy/charts/litellm-helm

.github/workflows/image-scan.yml

@@ -1,247 +0,0 @@
-name: Image Scan
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_branch
-      - "litellm_**"
-    paths:
-      - Dockerfile
-      - docker/Dockerfile.non_root
-      - migrations/Dockerfile
-      - migrations/run.py
-      - gateway/Dockerfile
-      - gateway/main.py
-      - backend/Dockerfile
-      - backend/main.py
-      - docker/component_entrypoint.sh
-      - docker/entrypoint.sh
-      - litellm/proxy/prisma_migration.py
-      - litellm-proxy-extras/**
-      - tests/proxy_migration_tests/**
-      - uv.lock
-      - ui/litellm-dashboard/package-lock.json
-      - ui/Dockerfile
-      - ui/nginx.conf
-      - .github/workflows/image-scan.yml
-  schedule:
-    - cron: "41 6 * * *"
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  image-scan:
-    name: image-scan
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Download Grype v0.114.0
-        run: |
-          curl -fsSL --retry 3 -o "$RUNNER_TEMP/grype.tar.gz" \
-            https://github.com/anchore/grype/releases/download/v0.114.0/grype_0.114.0_linux_amd64.tar.gz
-          echo "edda0968d8827daab01d32b3cd7de192ae0915005e7bbfcfef9e68e79bc43343  $RUNNER_TEMP/grype.tar.gz" | sha256sum -c -
-          tar xzf "$RUNNER_TEMP/grype.tar.gz" -C "$RUNNER_TEMP" grype
-          chmod +x "$RUNNER_TEMP/grype"
-
-      # Dockerfile.non_root is the rootless variant we ship. The other
-      # Dockerfiles share the same wolfi base and apk set, so OS-layer coverage
-      # is the same; matrix-scan if those variants ever diverge.
-      - name: Build runtime image
-        run: docker build -f docker/Dockerfile.non_root -t litellm-image-scan:${{ github.sha }} .
-
-      # The prisma bake must migrate a fresh DB with no egress as an arbitrary
-      # non-root uid (OpenShift restricted-v2 / air-gapped / readOnlyRootFilesystem).
-      # `docker run` as the default uid with network hides a broken bake because
-      # the migration entrypoint exits 0 even when it applied nothing; asserting
-      # the schema was created is what catches it.
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify offline migration as a non-root uid
-        env:
-          LITELLM_IMAGE: litellm-image-scan:${{ github.sha }}
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
-
-      # Scans the whole shipped artifact: OS/apk plus every language package
-      # baked into the image, including ones no lockfile declares (e.g. prisma's
-      # vendored node engine) that osv-scan cannot see. osv-scan stays the fast
-      # source-level gate; this is the customer's-eye-view backstop. Credential-
-      # free OSS, run as a pinned, checksum-verified binary; no GitHub Action
-      # dependency and no vendor SaaS callout.
-      - name: Scan image for fixable HIGH/CRITICAL CVEs
-        env:
-          GRYPE_MATCH_PYTHON_USING_CPES: "true"
-        run: |
-          "$RUNNER_TEMP/grype" litellm-image-scan:${{ github.sha }} \
-            --only-fixed \
-            --fail-on high \
-            --output table
-
-  runtime-image:
-    name: runtime-image
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Build runtime image
-        run: docker build -f Dockerfile -t litellm-runtime-scan:${{ github.sha }} .
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify offline migration as a non-root uid
-        env:
-          LITELLM_IMAGE: litellm-runtime-scan:${{ github.sha }}
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
-
-  migrations-image:
-    name: migrations-image
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Build migrations image
-        run: docker build -f migrations/Dockerfile -t litellm-migrations-scan:${{ github.sha }} .
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify offline migration as a non-root uid
-        env:
-          LITELLM_IMAGE: litellm-migrations-scan:${{ github.sha }}
-          LITELLM_MIGRATION_INTERPRETER: python3
-          LITELLM_MIGRATION_SCRIPT: /app/run.py
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_offline_image_migration.py -v
-
-  gateway-image:
-    name: gateway-image
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Build gateway image
-        run: docker build -f gateway/Dockerfile -t litellm-gateway-scan:${{ github.sha }} .
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify the gateway serves offline as a non-root uid
-        env:
-          LITELLM_IMAGE: litellm-gateway-scan:${{ github.sha }}
-          LITELLM_COMPONENT_PORT: "4000"
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v
-
-  ui-image:
-    name: ui-image
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Build UI image
-        run: docker build -f ui/Dockerfile -t litellm-ui-scan:${{ github.sha }} .
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify the UI serves offline as an arbitrary uid with a read-only root fs
-        env:
-          LITELLM_IMAGE: litellm-ui-scan:${{ github.sha }}
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_ui_image_serves_offline.py -v
-
-  backend-image:
-    name: backend-image
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'pull_request' ||
-      github.event.pull_request.head.repo.full_name == github.repository
-    timeout-minutes: 30
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Build backend image
-        run: docker build -f backend/Dockerfile -t litellm-backend-scan:${{ github.sha }} .
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Verify the backend serves offline as a non-root uid
-        env:
-          LITELLM_IMAGE: litellm-backend-scan:${{ github.sha }}
-          LITELLM_COMPONENT_PORT: "4001"
-        run: |
-          python -m pip install "pytest==9.0.3"
-          python -m pytest tests/proxy_migration_tests/test_component_image_serves_offline.py -v

.github/workflows/llm-translation-testing.yml

@@ -0,0 +1,92 @@
+name: LLM Translation Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_candidate_tag:
+        description: "Release candidate tag/version"
+        required: true
+        type: string
+  push:
+    tags:
+      - "v*-rc*" # Triggers on release candidate tags like v1.0.0-rc1
+
+permissions:
+  contents: read
+
+jobs:
+  run-llm-translation-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.inputs.release_candidate_tag || github.ref }}
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Restore uv dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen
+
+      - name: Create test results directory
+        run: mkdir -p test-results
+
+      - name: Run LLM Translation Tests
+        env:
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          COHERE_API_KEY: ${{ secrets.COHERE_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
+          AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
+          AZURE_API_VERSION: ${{ secrets.AZURE_API_VERSION }}
+          RC_TAG: ${{ github.event.inputs.release_candidate_tag || github.ref_name }}
+          COMMIT_SHA: ${{ github.sha }}
+        run: |
+          python .github/workflows/run_llm_translation_tests.py \
+            --tag "$RC_TAG" \
+            --commit "$COMMIT_SHA" \
+            || true  # Continue even if tests fail
+
+      - name: Display test summary
+        if: always()
+        run: |
+          if [ -f "test-results/llm_translation_report.md" ]; then
+            echo "Test report generated successfully!"
+            echo "Artifact will contain:"
+            echo "- test-results/junit.xml (JUnit XML results)"
+            echo "- test-results/llm_translation_report.md (Beautiful markdown report)"
+          else
+            echo "Warning: Test report was not generated"
+          fi
+
+      - name: Upload test artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with:
+          name: LLM-Translation-Artifact-${{ github.event.inputs.release_candidate_tag || github.ref_name }}
+          path: test-results/
+          retention-days: 30

.github/workflows/mutation-test.yml

@@ -1,145 +0,0 @@
-name: "Mutation Test (manual)"
-
-# Manually-triggered mutation testing. Runs mutmut against the scope
-# configured in [tool.mutmut] in pyproject.toml (currently the
-# litellm/proxy/management_endpoints/ folder). Intended cadence is roughly
-# weekly — clicked from the Actions tab when someone wants a fresh report.
-#
-# Uploads a structured `mutation-report.md` (Meta ACH-style: original +
-# mutated function with `# MUTANT START`/`# MUTANT END` delimiters + the
-# existing tests + a task instruction) as a workflow artifact. Failures
-# do not block anything because nothing depends on this workflow.
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: mutation-test-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  mutation:
-    name: Run mutmut
-    runs-on: ubuntu-latest
-    # Whole-folder mutation against ~15 files / ~7.5k LOC can take hours.
-    # 350 minutes is just under the GitHub-hosted job cap of 360 minutes.
-    timeout-minutes: 350
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router --extra saml
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      # mutmut 3.x runs tests inside a `mutants/` sandbox where it injects
-      # mutation trampolines. uv installs the project as editable by default,
-      # which puts the original source dir on sys.path via a .pth file and
-      # shadows the sandbox copy — so tests would never exercise the mutated
-      # code. Reinstalling non-editable removes the .pth shadow.
-      - name: Reinstall litellm non-editable (so mutants/ is not shadowed)
-        run: |
-          uv pip uninstall litellm
-          uv pip install . --no-deps
-
-      # pytest-retry's pytest_configure hook crashes with
-      # `INTERNALERROR: no option named 'filtered_exceptions'` when invoked
-      # via mutmut's in-process pytest.main() call. The entry-point name
-      # doesn't normalize cleanly with `-p no:<name>`, so just remove the
-      # package outright. Reruns are wrong for mutation testing anyway —
-      # rerunning a "failed" mutant test would mask which mutants are killed.
-      - name: Remove pytest plugins that conflict with mutmut
-        run: |
-          uv pip uninstall pytest-retry || true
-
-      # Ends before the job's own deadline so a run that outlasts the budget is
-      # still followed by the report and upload steps. mutmut saves after every
-      # mutant result, to mutants/<source path>.meta, so an interrupted run
-      # still scores the mutants it finished and export-cicd-stats can read
-      # them; a cancelled job skips those steps and publishes nothing at all.
-      - name: Run mutmut
-        timeout-minutes: 300
-        env:
-          # Make the mutants/ sandbox win over site-packages on sys.path so the
-          # trampolined files are imported instead of the installed copy.
-          PYTHONPATH: ${{ github.workspace }}/mutants
-          # Without this mutmut finds no covered lines and generates 0 mutants.
-          # See the file itself for why.
-          COVERAGE_RCFILE: ${{ github.workspace }}/.github/mutmut-coverage.rc
-        run: |
-          set -o pipefail
-          mkdir -p mutants
-          uv run --no-sync --with mutmut==3.5.0 mutmut run 2>&1 | tee mutmut-run.log
-
-      # Generate the structured report. The script embeds the enclosing
-      # function source for each survivor (via Python AST) and includes the
-      # existing test files, so an LLM agent has enough context to write
-      # killing tests without further file lookups. Modeled on Meta's ACH
-      # prompt template (arXiv 2501.12862).
-      - name: Generate detailed mutation report
-        if: always()
-        run: |
-          set +e
-          uv run --no-sync --with mutmut==3.5.0 mutmut export-cicd-stats > /dev/null 2>&1
-          uv run --no-sync --with mutmut==3.5.0 mutmut results > mutmut-results.txt 2>&1
-          uv run --no-sync python scripts/mutation_report.py
-          # The full report can be very long for big test files; the run-page
-          # summary cuts off at 1 MB. Append the head of the report (summary
-          # + survivor list) and link out to the artifact for the full body.
-          {
-            head -c 900000 mutation-report.md
-            echo ""
-            echo ""
-            echo "_Full report (with embedded function bodies and test files) is in the workflow artifact._"
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload mutmut artifacts
-        if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: mutmut-${{ github.run_id }}-${{ github.run_attempt }}
-          path: |
-            mutation-report.md
-            mutmut-results.txt
-            mutmut-run.log
-            mutants/mutmut-stats.json
-            mutants/mutmut-cicd-stats.json
-            mutants/**/*.meta
-            mutants/litellm/proxy/management_endpoints/**/*.py
-          if-no-files-found: warn
-          retention-days: 14

.github/workflows/osv-scan.yml

@@ -1,44 +0,0 @@
-name: OSV Scan
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-  schedule:
-    - cron: "23 6 * * *"
-  workflow_dispatch:
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  osv-scan:
-    name: osv-scan
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Download osv-scanner v2.3.8
-        run: |
-          curl -fsSL --retry 3 -o "$RUNNER_TEMP/osv-scanner" \
-            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
-          echo "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc  $RUNNER_TEMP/osv-scanner" | sha256sum -c -
-          chmod +x "$RUNNER_TEMP/osv-scanner"
-
-      - name: Scan lockfiles
-        run: |
-          "$RUNNER_TEMP/osv-scanner" scan source \
-            --config osv-scanner.toml \
-            -L uv.lock \
-            -L ui/litellm-dashboard/package-lock.json

.github/workflows/publish-basedpyright-base-counts.yml

@@ -1,66 +0,0 @@
-name: Publish basedpyright base counts
-
-# Every commit on litellm_internal_staging is some branch's future merge-base.
-# Publishing its per-rule basedpyright counts as an artifact lets
-# scripts/type_check_gate.py download them in seconds instead of paying a
-# 60-110s second basedpyright pass on every fresh worktree or moved merge-base.
-# No concurrency group on purpose: runs must never cancel each other, because
-# every sha's artifact matters (any of them can become a merge-base).
-
-on:
-  push:
-    branches:
-      - litellm_internal_staging
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Ref to compute and publish base counts for"
-        required: false
-        default: litellm_internal_staging
-
-permissions:
-  contents: read
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          ref: ${{ inputs.ref || github.sha }}
-          clean: true
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      # The gate provisions its own measurement env (.venv-typecheck: a frozen
-      # uv sync of its canonical dependency groups plus a generated Prisma
-      # client), so no install step here can drift from what local runs measure.
-      - name: Emit basedpyright counts for HEAD
-        run: |
-          python scripts/type_check_gate.py --emit-counts-dir "$RUNNER_TEMP/basedpyright-counts"
-          counts_file=$(ls "$RUNNER_TEMP"/basedpyright-counts/basedpyright-counts-*.json)
-          echo "COUNTS_ARTIFACT_NAME=$(basename "$counts_file" .json)" >> "$GITHUB_ENV"
-
-      - name: Upload counts artifact
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: ${{ env.COUNTS_ARTIFACT_NAME }}
-          path: ${{ runner.temp }}/basedpyright-counts/
-          if-no-files-found: error

.github/workflows/publish_to_pypi.yml

@@ -0,0 +1,153 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+
+jobs:
+  preflight-checks:
+    name: Preflight Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    # No environment — read-only checks, no approval needed
+    outputs:
+      needs_publish: ${{ steps.check-litellm.outputs.needs_publish }}
+      version: ${{ steps.check-litellm.outputs.version }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Check litellm version on PyPI
+        id: check-litellm
+        run: |
+          VERSION=$(python - <<'PY'
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              print(tomllib.load(f)["project"]["version"])
+          PY
+          )
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Checking if litellm $VERSION exists on PyPI..."
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm/$VERSION/json")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "litellm $VERSION already exists on PyPI. Skipping publish."
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "litellm $VERSION not found on PyPI. Publish needed."
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sanity check proxy-extras version
+        run: |
+          # Read pinned version from project optional dependencies
+          PYPROJECT_VERSION=$(python3 - <<'PY'
+          import sys
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"]
+
+          version = None
+          for requirement in proxy_requirements:
+              normalized = requirement.split(";", 1)[0].strip()
+              if not normalized.startswith("litellm-proxy-extras"):
+                  continue
+              parts = normalized.split("==", 1)
+              if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras":
+                  candidate = parts[1].strip()
+                  if candidate:
+                      version = candidate
+                      break
+
+          if version is None:
+              print(
+                  "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy",
+                  file=sys.stderr,
+              )
+              sys.exit(1)
+
+          print(version)
+          PY
+          )
+          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
+
+          # Check that the pinned version exists on PyPI
+          echo "Checking if litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$PYPROJECT_VERSION/json")
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "::error::litellm-proxy-extras $PYPROJECT_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            exit 1
+          fi
+          echo "litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI. Sanity check passed."
+
+  publish-litellm:
+    name: Publish litellm to PyPI
+    needs: preflight-checks
+    if: needs.preflight-checks.outputs.needs_publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    environment: pypi-publish
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
+      - name: Copy model prices backup
+        run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
+
+      - name: Build package
+        run: |
+          rm -rf build dist
+          uv build
+
+      - name: Verify build artifacts
+        env:
+          EXPECTED_VERSION: ${{ needs.preflight-checks.outputs.version }}
+        run: |
+          echo "Contents of dist/:"
+          ls -la dist/
+          # Ensure we have both sdist and wheel
+          ls dist/*.tar.gz
+          ls dist/*.whl
+          # Verify built version matches expected
+          ls dist/ | grep -q "litellm-${EXPECTED_VERSION}" || {
+            echo "::error::Built artifacts do not match expected version $EXPECTED_VERSION"
+            ls dist/
+            exit 1
+          }
+
+      - name: Validate package metadata
+        run: |
+          uv tool run --from 'twine==6.2.0' twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/read_pyproject_version.yml

@@ -0,0 +1,28 @@
+name: Read Version from pyproject.toml
+
+on:
+  push:
+    branches:
+      - main # Change this to the default branch of your repository
+
+permissions:
+  contents: read
+
+jobs:
+  read-version:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Read version from pyproject.toml
+        id: read-version
+        run: |
+          version=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          printf "LITELLM_VERSION=%s" "$version" >> $GITHUB_ENV
+
+      - name: Display version
+        run: echo "Current version is $LITELLM_VERSION"

.github/workflows/results_stats.csv

@@ -0,0 +1,27 @@
+Date,"Ben 
+Ashley",Tom Brooks,Jimmy Cooney,"Sue 
+Daniels",Berlinda Fong,Terry Jones,Angelina Little,Linda Smith
+10/1,FALSE,TRUE,TRUE,TRUE,TRUE,TRUE,FALSE,TRUE
+10/2,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/3,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/4,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/5,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/6,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/7,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/8,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/9,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/10,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/11,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/12,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/13,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/14,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/15,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/16,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/17,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/18,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/19,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/20,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/21,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/22,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+10/23,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE,FALSE
+Total,0,1,1,1,1,1,0,1

.github/workflows/run_observatory_tests.yml

@@ -0,0 +1,229 @@
+name: Run Observatory Tests
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Docker image tag to test (e.g. v1.61.0.rc1)"
+        required: true
+        type: string
+      commit_hash:
+        description: "Commit hash (defaults to HEAD of current branch)"
+        required: false
+        type: string
+  workflow_call:
+    inputs:
+      tag:
+        description: "Docker image tag to test"
+        required: true
+        type: string
+      commit_hash:
+        description: "Commit hash of the release"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+env:
+  LITELLM_MASTER_KEY: ${{ secrets.LITELLM_MASTER_KEY_STAGING }}
+
+jobs:
+  observatory-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Validate tag input
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+            echo "Invalid tag format: $TAG (expected vX.Y.Z...)"
+            exit 1
+          fi
+
+      - name: Start LiteLLM container
+        env:
+          TAG: ${{ inputs.tag }}
+          AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
+          AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
+          WORKSPACE: ${{ github.workspace }}
+        run: |
+          docker run -d \
+            --name litellm-rc \
+            -p 4000:4000 \
+            -v "${WORKSPACE}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
+            -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \
+            -e AZURE_API_KEY="${AZURE_API_KEY}" \
+            -e AZURE_API_BASE="${AZURE_API_BASE}" \
+            "litellm/litellm:${TAG}" \
+            --config /app/config.yaml --port 4000
+
+      - name: Wait for LiteLLM health check
+        run: |
+          echo "Waiting for LiteLLM to be ready..."
+          for i in $(seq 1 30); do
+            if curl -s -f http://localhost:4000/health/liveliness > /dev/null 2>&1; then
+              echo "LiteLLM is healthy"
+              exit 0
+            fi
+            echo "Attempt $i/30 - not ready yet, waiting 10s..."
+            sleep 10
+          done
+          echo "LiteLLM failed to start within 5 minutes"
+          docker logs litellm-rc
+          exit 1
+
+      - name: Start cloudflared tunnel
+        run: |
+          # Install cloudflared (pinned version + checksum)
+          curl -sL https://github.com/cloudflare/cloudflared/releases/download/2025.2.1/cloudflared-linux-amd64 -o /usr/local/bin/cloudflared
+          echo "afdfadd1ef552e66bffc35246fe30a9bd578356d2d386de95585ccfc432472b8  /usr/local/bin/cloudflared" | sha256sum -c -
+          chmod +x /usr/local/bin/cloudflared
+
+          # Start a quick tunnel (no account needed) and capture the URL
+          cloudflared tunnel --url http://localhost:4000 --no-autoupdate > /tmp/cloudflared.log 2>&1 &
+          CLOUDFLARED_PID=$!
+          echo "CLOUDFLARED_PID=$CLOUDFLARED_PID" >> $GITHUB_ENV
+
+          # Wait for tunnel URL to appear in logs
+          echo "Waiting for tunnel URL..."
+          for i in $(seq 1 30); do
+            TUNNEL_URL=$(grep -oP 'https://[a-z0-9-]+\.trycloudflare\.com' /tmp/cloudflared.log | head -1 || true)
+            if [ -n "$TUNNEL_URL" ]; then
+              echo "Tunnel URL: $TUNNEL_URL"
+              echo "TUNNEL_URL=$TUNNEL_URL" >> $GITHUB_ENV
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "Failed to get tunnel URL"
+          cat /tmp/cloudflared.log
+          exit 1
+
+      - name: Verify tunnel connectivity
+        run: |
+          echo "Testing tunnel at ${TUNNEL_URL}..."
+          # Quick tunnels need time for DNS propagation; retry to avoid
+          # transient NXDOMAIN (curl exit code 6) on first attempt.
+          for i in $(seq 1 10); do
+            if curl -sf "${TUNNEL_URL}/health/liveliness" > /dev/null 2>&1; then
+              echo "Tunnel is working (attempt $i)"
+              exit 0
+            fi
+            echo "Attempt $i/10 - tunnel not routable yet, waiting 5s..."
+            sleep 5
+          done
+          echo "Tunnel failed to become reachable after 50s"
+          cat /tmp/cloudflared.log
+          exit 1
+
+      - name: Trigger observatory test run
+        id: trigger
+        env:
+          OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }}
+          OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }}
+        run: |
+          PAYLOAD=$(jq -n \
+            --arg url "${TUNNEL_URL}" \
+            --arg key "${LITELLM_MASTER_KEY}" \
+            '{
+              deployment_url: $url,
+              api_key: $key,
+              test_suite: "TestOAIAzureRelease",
+              models: ["gpt-4o-mini", "gpt-4o"]
+            }')
+          RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${OBSERVATORY_URL}/run-test" \
+            -H "Content-Type: application/json" \
+            -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}" \
+            -d "$PAYLOAD")
+          HTTP_CODE=$(echo "$RESPONSE" | tail -1)
+          BODY=$(echo "$RESPONSE" | head -n -1)
+          echo "Response ($HTTP_CODE): $BODY"
+          if [ "$HTTP_CODE" -ge 400 ]; then
+            echo "Failed to trigger test run"
+            exit 1
+          fi
+
+          # Extract request_id for polling this specific run
+          REQUEST_ID=$(echo "$BODY" | jq -r '.results.request_id')
+          if [ -z "$REQUEST_ID" ] || [ "$REQUEST_ID" = "null" ]; then
+            echo "Failed to extract request_id from response"
+            exit 1
+          fi
+          echo "Request ID: $REQUEST_ID"
+          echo "request_id=$REQUEST_ID" >> $GITHUB_OUTPUT
+
+      - name: Poll for test completion
+        id: poll
+        env:
+          OBSERVATORY_URL: ${{ secrets.OBSERVATORY_URL }}
+          OBSERVATORY_API_KEY: ${{ secrets.OBSERVATORY_API_KEY }}
+          REQUEST_ID: ${{ steps.trigger.outputs.request_id }}
+        run: |
+          TIMEOUT=900  # 15 minutes
+          INTERVAL=30
+          ELAPSED=0
+          while [ $ELAPSED -lt $TIMEOUT ]; do
+            STATUS=$(curl -s "${OBSERVATORY_URL}/run-status/${REQUEST_ID}" \
+              -H "X-LiteLLM-Observatory-API-Key: ${OBSERVATORY_API_KEY}")
+            RUN_STATUS=$(echo "$STATUS" | jq -r '.status')
+            echo "Run status (${ELAPSED}s elapsed): $RUN_STATUS"
+
+            if [ "$RUN_STATUS" = "completed" ] || [ "$RUN_STATUS" = "failed" ]; then
+              echo "Test finished with status: $RUN_STATUS"
+              echo "$STATUS" > /tmp/observatory_result.json
+              exit 0
+            fi
+
+            sleep $INTERVAL
+            ELAPSED=$((ELAPSED + INTERVAL))
+          done
+          echo "Timed out waiting for test to complete after ${TIMEOUT}s"
+          exit 1
+
+      - name: Verify test results
+        run: |
+          RESULT=$(cat /tmp/observatory_result.json)
+          echo "Full result: $RESULT"
+
+          STATUS=$(echo "$RESULT" | jq -r '.status')
+          TEST_PASSED=$(echo "$RESULT" | jq -r '.result.test_passed // false')
+          FAILURE_RATE=$(echo "$RESULT" | jq -r '.result.failure_rate // "N/A"')
+          ERROR=$(echo "$RESULT" | jq -r '.error // empty')
+
+          echo "Status: $STATUS"
+          echo "Test passed: $TEST_PASSED"
+          echo "Failure rate: $FAILURE_RATE"
+
+          if [ -n "$ERROR" ]; then
+            echo "Error: $ERROR"
+          fi
+
+          if [ "$STATUS" = "failed" ]; then
+            echo "Test run failed"
+            exit 1
+          fi
+
+          if [ "$TEST_PASSED" != "true" ]; then
+            echo "Tests did not pass (failure rate: $FAILURE_RATE)"
+            exit 1
+          fi
+
+          echo "All tests passed!"
+
+      - name: Print LiteLLM logs on failure
+        if: failure()
+        run: |
+          docker logs litellm-rc 2>/dev/null || true
+          cat /tmp/cloudflared.log 2>/dev/null || true
+
+      - name: Cleanup
+        if: always()
+        run: |
+          kill "$CLOUDFLARED_PID" 2>/dev/null || true
+          docker rm -f litellm-rc 2>/dev/null || true

.github/workflows/scan_duplicate_issues.yml

@@ -0,0 +1,48 @@
+name: Scan Duplicate Issues (One-Time)
+
+on:
+  workflow_dispatch:
+    inputs:
+      threshold:
+        description: "Similarity threshold (0-1)"
+        required: false
+        default: "0.85"
+      close:
+        description: "Actually close duplicates (false = dry run)"
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      contents: read
+    steps:
+      - name: Checkout scripts
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          sparse-checkout: .github/scripts
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Scan for duplicate issues
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          INPUT_THRESHOLD: ${{ inputs.threshold }}
+          INPUT_CLOSE: ${{ inputs.close }}
+        run: |
+          CLOSE_FLAG=""
+          if [ "$INPUT_CLOSE" = "true" ]; then
+            CLOSE_FLAG="--close"
+          fi
+          python3 .github/scripts/close_duplicate_issues.py \
+            --scan \
+            --repo ${{ github.repository }} \
+            --threshold "$INPUT_THRESHOLD" \
+            $CLOSE_FLAG

.github/workflows/sync-together-ai-models.yml

@@ -1,68 +0,0 @@
-name: Sync Together AI model registry
-
-on:
-  schedule:
-    - cron: "30 6 * * *"
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  sync_together_ai_models:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          ref: litellm_internal_staging
-          persist-credentials: false
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-      - name: Look for an already-open sync PR
-        id: existing
-        run: |
-          open_pr="$(gh pr list --repo "$GITHUB_REPOSITORY" --state open --limit 1000 --json headRefName \
-            --jq '[.[].headRefName | select(startswith("litellm_together_registry_sync_"))] | first // empty')"
-          echo "open_pr=$open_pr" >> "$GITHUB_OUTPUT"
-          if [ -n "$open_pr" ]; then
-            echo "An open sync PR already exists on branch $open_pr; skipping this run."
-          fi
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-      - name: Run the sync
-        if: steps.existing.outputs.open_pr == ''
-        run: |
-          uv run --frozen python scripts/sync_together_ai_models.py --write --pr-body-file "$RUNNER_TEMP/pr_body.md"
-        env:
-          TOGETHER_API_KEY: ${{ secrets.TOGETHER_API_KEY }}
-      - name: Regenerate the JSON schema
-        if: steps.existing.outputs.open_pr == ''
-        run: |
-          uv run --frozen python ci_cd/generate_model_prices_schema.py
-      - name: Create a pull request when the registry changed
-        if: steps.existing.outputs.open_pr == ''
-        run: |
-          if git diff --quiet; then
-            echo "Registry already in sync; no PR needed."
-            exit 0
-          fi
-          branch="litellm_together_registry_sync_$(date +'%Y-%m-%d')"
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git checkout -b "$branch"
-          git add model_prices_and_context_window.json \
-            litellm/model_prices_and_context_window_backup.json \
-            model_prices_and_context_window.schema.json
-          git commit -m "feat(models): sync together_ai model registry $(date +'%Y-%m-%d')"
-          gh auth setup-git
-          git push origin "$branch"
-          gh pr create --title "feat(models): sync together_ai model registry" \
-            --body-file "$RUNNER_TEMP/pr_body.md" \
-            --head "$branch" \
-            --base litellm_internal_staging
-        env:
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}

.github/workflows/test-code-quality.yml

@@ -5,19 +5,15 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
-  push:
-    branches:
-      - main
-      - litellm_internal_staging
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   code-quality:
@@ -42,7 +38,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
@@ -56,9 +52,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-uv-
 
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
         run: uv sync --frozen --all-groups --all-extras
 
@@ -68,12 +61,6 @@ jobs:
       - name: check_provider_folders_documented
         run: uv run --no-sync python ./tests/code_coverage_tests/check_provider_folders_documented.py
 
-      - name: check_prisma_binary_cache
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_prisma_binary_cache.py
-
-      - name: check_workflow_startup_safety
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_workflow_startup_safety.py
-
       - name: router_code_coverage
         run: uv run --no-sync python ./tests/code_coverage_tests/router_code_coverage.py
 
@@ -128,12 +115,6 @@ jobs:
       - name: check_fastuuid_usage
         run: uv run --no-sync python ./tests/code_coverage_tests/check_fastuuid_usage.py
 
-      - name: check_e2e_no_raw_requests
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_e2e_no_raw_requests.py
-
-      - name: check_migrations_no_data_rewrites
-        run: uv run --no-sync python ./tests/code_coverage_tests/check_migrations_no_data_rewrites.py
-
       - name: memory_test
         run: uv run --no-sync python ./tests/code_coverage_tests/memory_test.py
 

.github/workflows/test-linting.yml

@@ -5,123 +5,54 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   lint:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
-    # actions: read lets scripts/type_check_gate.py download the base-counts
-    # artifact published by publish-basedpyright-base-counts.yml instead of
-    # re-running basedpyright over the merge-base tree.
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: read
+    timeout-minutes: 5
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        # Check out the PR head, not the default refs/pull/N/merge: the merge ref
-        # folds in newer base commits, which the diff-based gates (ruff delta,
-        # Any-discipline) would otherwise blame on this branch.
         with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 1
+          fetch-depth: 0
           clean: true
           persist-credentials: false
 
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-
-      - name: Fetch gate base (merge-base with target branch)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          MERGE_BASE=$(retry gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$MERGE_BASE"
-          retry git fetch --no-tags --depth=1 origin "$MERGE_BASE"
-          echo "GATE_BASE_SHA=$MERGE_BASE" >> "$GITHUB_ENV"
-
       - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-lint-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-lint-
-
       - name: Clean Python cache
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           find . -type d -name "__pycache__" -exec rm -rf {} + || true
           find . -name "*.pyc" -delete || true
 
       - name: Check uv.lock is up to date
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           uv lock --check || (echo "❌ uv.lock is out of sync with pyproject.toml. Run 'uv lock' locally and commit the result." && exit 1)
 
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
         run: |
-          uv sync --frozen --group proxy-dev --group e2e-dev
+          uv sync --frozen
 
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-prisma-binaries
-
-      # basedpyright resolves Prisma's generated client (litellm/proxy/schema.prisma)
-      # only after `prisma generate` writes prisma/client.py et al. Without this the
-      # DB wrappers typed against the generated client would degrade to Unknown.
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
+      - name: Check Black formatting
         run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Check ruff format
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          git diff --name-only --diff-filter=ACMR "$GATE_BASE_SHA" HEAD -- 'litellm/**/*.py' | grep -v '^litellm/enterprise/' > "$RUNNER_TEMP/ruff_format_files.txt" || true
-          if [ ! -s "$RUNNER_TEMP/ruff_format_files.txt" ]; then
-            echo "No changed litellm Python files to check with ruff format."
-            exit 0
-          fi
-          xargs uv run --no-sync ruff format --check --exclude '/enterprise/' < "$RUNNER_TEMP/ruff_format_files.txt"
+          cd litellm
+          uv run --no-sync black --check --exclude '/enterprise/' .
+          cd ..
 
       - name: Debug - Check file state
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           echo "Current branch:"
           git branch --show-current
@@ -131,99 +62,31 @@ jobs:
           head -50 litellm/litellm_core_utils/custom_logger_registry.py | tail -10
 
       - name: Run Ruff linting
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           cd litellm
           uv run --no-sync ruff check .
           cd ..
 
-      - name: Run Ruff linting (test tree)
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync ruff check --config ruff-tests.toml tests
-
-      - name: Check strict-rule budget (delta vs base)
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync python scripts/ruff_strict_gate.py --base "$GATE_BASE_SHA"
-
-      - name: Check type-discipline budget (mutable collections / casts / type guards / kwargs / unexplained suppressions, delta vs base)
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync python scripts/type_discipline_gate.py --base "$GATE_BASE_SHA"
-
-      - name: Check test-quality budget (zero-assert / mock-echo tests, sys.path.insert, raw env writes, litellm global mutation, credential-gated skips, conftest snapshot inventory, delta vs base)
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          uv run --no-sync python scripts/test_quality_gate.py --base "$GATE_BASE_SHA"
-
       - name: Print OpenAI version
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           uv run --no-sync python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
 
-      - name: Check basedpyright budget (delta vs base)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          GH_TOKEN: ${{ github.token }}
+      - name: Run MyPy type checking
         run: |
-          uv run --no-sync python scripts/type_check_gate.py --base "$GATE_BASE_SHA"
-
-      - name: Check tests/e2e basedpyright (zero errors)
-        if: steps.changes.outputs.decision != 'skip'
-        run: |
-          if git diff --name-only --diff-filter=ACMRD "$GATE_BASE_SHA" HEAD -- 'tests/e2e/**/*.py' | grep -q .; then
-            uv run --no-sync basedpyright tests/e2e
-          else
-            echo "No changed tests/e2e Python files; skipping."
-          fi
+          cd litellm
+          uv run --no-sync mypy .
+          cd ..
 
       - name: Check for circular imports
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           cd litellm
           uv run --no-sync python ../tests/documentation_tests/test_circular_imports.py
           cd ..
 
       - name: Check import safety
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           uv run --no-sync python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
 
-  # Intentionally NON-GATING. This job turns red when a *-budget.json ceiling is
-  # raised (or a rule/budget is dropped) so a loosening is obvious in review, but it
-  # must be kept OUT of the branch-protection required-checks list so a justified
-  # bump can still be merged by a human who has seen and accepted the red.
-  budget-ratchet:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Fetch ratchet base
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-          retry git fetch --no-tags --depth=1 origin "$BASE_SHA"
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Ratchet check (budgets may only decrease; non-gating)
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          python scripts/budget_ratchet_check.py --base "$BASE_SHA"
-
   secret-scan:
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -233,7 +96,7 @@ jobs:
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
-          fetch-depth: 1
+          fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Python
@@ -242,21 +105,19 @@ jobs:
           python-version: "3.12"
 
       - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
       - name: Run secret scan test
         run: |
-          uv run --no-project --with 'pytest==9.0.2' pytest tests/code_coverage_tests/test_no_hardcoded_secrets.py -v
+          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v
 
       - name: Run ggshield secret scan
         env:
           GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
         run: |
           if [ -n "$GITGUARDIAN_API_KEY" ]; then
-            retry() { "$@" || { sleep 15; "$@"; } || { sleep 30; "$@"; }; }
-            retry git fetch --no-tags --unshallow origin
             uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
           else
             echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"

.github/workflows/test-litellm-ui-build.yml

@@ -1,20 +1,15 @@
 name: UI Build Check
 permissions:
   contents: read
-  pull-requests: read
 
 on:
   pull_request:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   build-ui:
     runs-on: ubuntu-latest
@@ -29,24 +24,15 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-        with:
-          category: ui
-
       - name: Setup Node.js
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0
         with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
+          node-version: "20"
           cache: "npm"
           cache-dependency-path: ui/litellm-dashboard/package-lock.json
 
       - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
         run: npm ci
 
       - name: Build
-        if: steps.changes.outputs.decision != 'skip'
         run: npm run build

.github/workflows/test-litellm-ui-lint.yml

@@ -1,107 +0,0 @@
-name: UI Lint
-permissions:
-  contents: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  frontend-lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 8
-    defaults:
-      run:
-        working-directory: ui/litellm-dashboard
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Collect changed files
-        id: changed
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          # base.sha is the base branch tip from when the PR was opened, while
-          # actions/checkout leaves HEAD on a merge of the PR into the *current*
-          # base tip. "$BASE_SHA"...HEAD therefore spans every base-branch commit
-          # landed since, so a PR that touches no UI file still gets linted
-          # against hundreds of other people's files. Diff the PR head against its
-          # own merge base instead, which is exactly what this PR changed.
-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$merge_base"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-          : > "$RUNNER_TEMP/prettier_files.txt"
-          : > "$RUNNER_TEMP/eslint_files.txt"
-          while IFS= read -r f; do
-            [ -f "$f" ] || continue
-            case "$f" in
-              *.js | *.jsx | *.ts | *.tsx | *.mjs | *.cjs)
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt"
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/eslint_files.txt" ;;
-              *.json | *.css | *.scss | *.md | *.mdx | *.yml | *.yaml | *.html)
-                printf '%s\n' "$f" >> "$RUNNER_TEMP/prettier_files.txt" ;;
-            esac
-          done < <(git diff --name-only --diff-filter=ACMR --relative "$merge_base" "$HEAD_SHA" -- .)
-          if [ -s "$RUNNER_TEMP/prettier_files.txt" ] || [ -s "$RUNNER_TEMP/eslint_files.txt" ]; then
-            echo "has_files=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_files=false" >> "$GITHUB_OUTPUT"
-            echo "No lintable UI files changed in this PR; nothing to check."
-          fi
-
-      - name: Setup Node.js
-        if: steps.changed.outputs.has_files == 'true'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dependencies
-        if: steps.changed.outputs.has_files == 'true'
-        run: npm ci
-
-      - name: Lint changed files (prettier + eslint)
-        if: steps.changed.outputs.has_files == 'true'
-        run: |
-          prettier_files=()
-          eslint_files=()
-          while IFS= read -r f; do prettier_files+=("$f"); done < "$RUNNER_TEMP/prettier_files.txt"
-          while IFS= read -r f; do eslint_files+=("$f"); done < "$RUNNER_TEMP/eslint_files.txt"
-          status=0
-          if [ ${#prettier_files[@]} -gt 0 ]; then
-            echo "::group::Prettier (${#prettier_files[@]} files)"
-            npx prettier --check "${prettier_files[@]}" || { status=1; echo "::error::Unformatted files. Fix with: npm run format"; }
-            echo "::endgroup::"
-          fi
-          if [ ${#eslint_files[@]} -gt 0 ]; then
-            echo "::group::ESLint (${#eslint_files[@]} files)"
-            npx eslint --no-warn-ignored --pass-on-unpruned-suppressions "${eslint_files[@]}" || status=1
-            echo "::endgroup::"
-          fi
-          exit $status
-
-      - name: Check lint budgets
-        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
-        run: |
-          npx eslint . -f json -o "$RUNNER_TEMP/lint-report.json" || true
-          node scripts/check-lint-budgets.mjs "$RUNNER_TEMP/lint-report.json" eslint-budgets.json
-
-      - name: Check for dead code (knip)
-        if: ${{ !cancelled() && steps.changed.outputs.has_files == 'true' }}
-        run: npm run knip:ci

.github/workflows/test-litellm-ui-unit.yml

@@ -1,97 +0,0 @@
-name: UI Unit Tests
-permissions:
-  contents: read
-  pull-requests: read
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-  push:
-    branches:
-      - litellm_internal_staging
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  ui-unit-tests:
-    runs-on: ubuntu-latest-16-cores
-    timeout-minutes: 20
-    defaults:
-      run:
-        working-directory: ui/litellm-dashboard
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-        with:
-          category: ui
-
-      - name: Setup Node.js
-        if: steps.changes.outputs.decision != 'skip'
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
-        with:
-          node-version-file: ui/litellm-dashboard/.nvmrc
-          cache: "npm"
-          cache-dependency-path: ui/litellm-dashboard/package-lock.json
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        run: npm ci
-
-      - name: Run UI type tests (Vitest)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          CI: "true"
-        run: npm run test:types
-
-      - name: Run UI unit tests (Vitest)
-        if: steps.changes.outputs.decision != 'skip'
-        env:
-          CI: "true"
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          full_suite() { npm run test -- --run --pool forks --poolOptions.forks.maxForks=14; }
-
-          if [ -z "$BASE_SHA" ]; then
-            echo "Push to $GITHUB_REF_NAME: running the full suite"
-            full_suite
-            exit 0
-          fi
-
-          merge_base=$(gh api "repos/${{ github.repository }}/compare/${BASE_SHA}...${HEAD_SHA}?per_page=1" --jq '.merge_base_commit.sha')
-          test -n "$merge_base"
-          git fetch --no-tags --depth=1 origin "$merge_base" "$HEAD_SHA"
-          changed_files=()
-          while IFS= read -r f; do
-            changed_files+=("$f")
-          done < <(git diff --name-only --relative "$merge_base" "$HEAD_SHA" -- .)
-          if [ ${#changed_files[@]} -eq 0 ]; then
-            echo "No UI files changed in this PR; skipping unit tests."
-            exit 0
-          fi
-
-          scope=$(printf '%s\n' "${changed_files[@]}" | bash "$GITHUB_WORKSPACE/.github/scripts/select_ui_test_scope.sh")
-          if [ "$scope" != related ]; then
-            echo "Pull request: ${#changed_files[@]} changed UI files reach outside src/, so related would miss their dependents; running the full suite"
-            full_suite
-            exit 0
-          fi
-
-          echo "Pull request: running tests related to ${#changed_files[@]} changed UI files"
-          npm run test -- related "${changed_files[@]}" --run --passWithNoTests \
-            --pool forks --poolOptions.forks.maxForks=14

.github/workflows/test-litellm.yml

@@ -0,0 +1,45 @@
+name: LiteLLM Mock Tests (folder - tests/test_litellm)
+
+# DEPRECATED: This workflow is replaced by test-litellm-matrix.yml which runs
+# the same tests in parallel across 10 jobs for faster CI times.
+# Kept for manual debugging only.
+on:
+  workflow_dispatch: # Manual trigger only
+  # pull_request:
+  #   branches: [ main ]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Thank You Message
+        run: |
+          echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
+          echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Install dependencies
+        run: |
+          uv lock --check
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+      - name: Run tests
+        run: |
+          uv run --no-sync pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50

.github/workflows/test-mcp.yml

@@ -5,16 +5,11 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
 
 permissions:
   contents: read
-  pull-requests: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   test:
@@ -26,38 +21,26 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-
       - name: Thank You Message
         run: |
           echo "### 🙏 Thank you for contributing to LiteLLM!" >> $GITHUB_STEP_SUMMARY
           echo "Your PR is being tested now. We appreciate your help in making LiteLLM better!" >> $GITHUB_STEP_SUMMARY
 
       - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           uv lock --check
-          .github/scripts/uv_sync_with_retries.sh --frozen --group proxy-dev --extra proxy --extra semantic-router
+          uv sync --frozen --group proxy-dev --extra proxy --extra semantic-router
 
       - name: Run MCP tests
-        if: steps.changes.outputs.decision != 'skip'
         run: |
-          uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=./litellm --cov=./enterprise/litellm_enterprise --cov-report=xml --durations=5
+          uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5

.github/workflows/test-model-map.yaml

@@ -0,0 +1,24 @@
+name: Validate model_prices_and_context_window.json
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-model-prices-json:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Validate model_prices_and_context_window.json
+        run: |
+          jq empty model_prices_and_context_window.json

.github/workflows/test-model-map.yml

@@ -1,37 +0,0 @@
-name: Validate model_prices_and_context_window.json
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  validate-model-prices-json:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Validate model_prices_and_context_window.json
-        run: |
-          jq empty model_prices_and_context_window.json
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Check model_prices_and_context_window.schema.json is in sync
-        run: |
-          uv run --frozen python ci_cd/generate_model_prices_schema.py --check

.github/workflows/test-postgres.yml

@@ -1,145 +0,0 @@
-name: "Postgres Tests"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-  push:
-    branches:
-      - main
-      - litellm_internal_staging
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-jobs:
-  postgres:
-    name: ${{ matrix.shard }}
-    runs-on: ubuntu-latest
-    timeout-minutes: ${{ matrix.job-timeout-minutes }}
-    permissions:
-      contents: read
-
-    services:
-      postgres:
-        image: postgres:16@sha256:e17e86066e5ef83e0952a9347f5c792b7ece00972e2aa787a6986f471b3dd3d5
-        env:
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_DB: litellm_test
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 10
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - shard: proxy-behavior
-            test-path: "tests/proxy_behavior"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 25
-            job-timeout-minutes: 50
-
-          - shard: proxy-security
-            test-path: "tests/proxy_security_tests"
-            seed: db-push
-            workers: 0
-            timeout-minutes: 15
-            job-timeout-minutes: 40
-
-          - shard: schema-migration
-            test-path: "tests/proxy_migration_tests"
-            seed: none
-            workers: 0
-            timeout-minutes: 20
-            job-timeout-minutes: 45
-
-    env:
-      DATABASE_URL: "postgresql://postgres:postgres@localhost:5432/litellm_test"
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        timeout-minutes: 3
-        with:
-          persist-credentials: false
-
-      - name: Detect relevant changes
-        id: changes
-        timeout-minutes: 2
-        uses: ./.github/actions/detect-changes
-
-      - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-postgres-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-postgres-
-
-      - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 12
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --all-groups --all-extras
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 3
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: 5
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Seed database schema
-        if: steps.changes.outputs.decision != 'skip' && matrix.seed != 'none'
-        timeout-minutes: 10
-        run: |
-          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
-
-      - name: Run tests
-        if: steps.changes.outputs.decision != 'skip'
-        timeout-minutes: ${{ matrix.timeout-minutes }}
-        env:
-          TEST_PATH: ${{ matrix.test-path }}
-          WORKERS: ${{ matrix.workers }}
-        run: |
-          if [ "${WORKERS}" = "0" ]; then
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10
-          else
-            uv run --no-sync pytest ${TEST_PATH:?} -vv --tb=short --durations=10 -n "${WORKERS}"
-          fi

.github/workflows/test-rust.yml

@@ -1,71 +0,0 @@
-name: LiteLLM Rust
-
-on:
-  push:
-    paths:
-      - "litellm-rust/**"
-      - ".github/workflows/test-rust.yml"
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-    paths:
-      - "litellm-rust/**"
-      - ".github/workflows/test-rust.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  rust-checks:
-    name: rustfmt, clippy, test
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    defaults:
-      run:
-        working-directory: litellm-rust
-    env:
-      CARGO_TERM_COLOR: always
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Rust
-        run: |
-          rustup toolchain install stable --profile minimal --component clippy,rustfmt
-          rustup default stable
-
-      - name: Cache Cargo registry and target
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            litellm-rust/target
-          key: ${{ runner.os }}-cargo-${{ hashFiles('litellm-rust/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-
-
-      - name: Check Rust formatting
-        run: cargo fmt --check
-
-      - name: Run Clippy
-        run: cargo clippy --workspace --all-targets --locked -- -D warnings
-
-      - name: Run Clippy with Bedrock auth
-        run: cargo clippy -p litellm-core --all-targets --features bedrock-auth --locked -- -D warnings
-
-      - name: Run Rust tests
-        run: cargo test --workspace --locked
-
-      - name: Run core tests with Bedrock auth
-        run: cargo test -p litellm-core --features bedrock-auth --locked

.github/workflows/test-semgrep.yml

@@ -5,7 +5,7 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
 
 permissions:
@@ -31,7 +31,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 

.github/workflows/test-terraform-modules.yml

@@ -1,54 +0,0 @@
-name: Terraform Modules
-
-on:
-  push:
-    paths:
-      - "terraform/litellm/aws/**"
-      - ".github/workflows/test-terraform-modules.yml"
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-    paths:
-      - "terraform/litellm/aws/**"
-      - ".github/workflows/test-terraform-modules.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  aws-module:
-    name: fmt, validate, test (aws)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: terraform/litellm/aws
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
-        with:
-          terraform_version: 1.13.3
-          terraform_wrapper: false
-
-      - name: fmt
-        run: terraform fmt -recursive -check -diff
-
-      - name: init
-        run: terraform init -backend=false -input=false
-
-      - name: validate
-        run: terraform validate
-
-      # Plan-only, mock_provider-backed: no AWS credentials, no API calls.
-      - name: test
-        run: terraform test

.github/workflows/test-terraform-provider.yml

@@ -1,117 +0,0 @@
-name: Terraform Provider
-
-on:
-  push:
-    paths:
-      - "terraform/provider/**"
-      - ".github/workflows/test-terraform-provider.yml"
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-    paths:
-      - "terraform/provider/**"
-      - "litellm/proxy/**"
-      - ".github/workflows/test-terraform-provider.yml"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  provider-checks:
-    name: gofmt, vet, build, test
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    defaults:
-      run:
-        working-directory: terraform/provider
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version-file: terraform/provider/go.mod
-          cache: true
-          cache-dependency-path: terraform/provider/go.sum
-
-      - name: gofmt
-        run: |
-          UNFORMATTED=$(gofmt -l .)
-          if [ -n "${UNFORMATTED}" ]; then
-            echo "::error::gofmt required for: ${UNFORMATTED}"
-            exit 1
-          fi
-
-      - name: go vet
-        run: go vet ./...
-
-      - name: Build
-        run: go build ./...
-
-      - name: Test
-        run: go test -timeout 120s ./...
-
-  endpoint-drift:
-    name: Provider endpoints vs proxy OpenAPI schema
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up uv
-        uses: ./.github/actions/setup-uv-with-retries
-        with:
-          version: "0.10.9"
-
-      - name: Cache uv dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
-        with:
-          path: |
-            ~/.cache/uv
-            .venv
-          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-uv-
-
-      - name: Cache the Rust build
-        uses: ./.github/actions/cache-cargo-build
-
-      - name: Install dependencies
-        run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
-
-      - name: Cache Prisma binaries
-        uses: ./.github/actions/cache-prisma-binaries
-
-      - name: Generate Prisma client
-        run: |
-          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Generate proxy OpenAPI schema
-        run: |
-          uv run --no-sync python terraform/provider/tools/dump_openapi.py "${RUNNER_TEMP}/openapi.json"
-
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version-file: terraform/provider/go.mod
-          cache: true
-          cache-dependency-path: terraform/provider/go.sum
-
-      - name: Audit provider endpoints against the schema
-        working-directory: terraform/provider
-        run: go run ./tools/endpointaudit -provider-dir ./litellm -spec "${RUNNER_TEMP}/openapi.json"

.github/workflows/test-unit-caching-redis.yml

@@ -0,0 +1,38 @@
+name: "Unit Tests: Caching (Redis)"
+
+# Uses cloud Redis credentials — only runs on trusted branches, not PRs.
+# This prevents external PRs from accessing Redis credentials.
+on:
+  push:
+    branches: [main, "litellm_*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  caching-redis:
+    uses: ./.github/workflows/_test-unit-services-base.yml
+    with:
+      # Redis-only tests that do NOT require provider API keys.
+      # Tests needing API keys (test_caching.py, test_caching_ssl.py, test_prometheus_service.py,
+      # test_router_caching.py) are in Phase 3 integration workflows.
+      test-path: >-
+        tests/local_testing/test_dual_cache.py
+        tests/local_testing/test_redis_batch_optimizations.py
+        tests/local_testing/test_router_utils.py
+      workers: 2
+      reruns: 2
+      timeout-minutes: 20
+      enable-redis: true
+      enable-postgres: false
+    secrets:
+      REDIS_HOST: ${{ secrets.REDIS_HOST }}
+      REDIS_PORT: ${{ secrets.REDIS_PORT }}
+      REDIS_PASSWORD: ${{ secrets.REDIS_PASSWORD }}
+      DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
+      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}

.github/workflows/test-unit-core-utils.yml

@@ -0,0 +1,27 @@
+name: "Unit Tests: Core Utilities"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  core-utils:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/litellm_core_utils"
+      workers: 2
+      reruns: 1
+      artifact-name: core-utils

.github/workflows/test-unit-documentation.yml

@@ -5,39 +5,27 @@ on:
     branches:
       - main
       - litellm_internal_staging
-      - litellm_oss_staging
+      - litellm_oss_branch
       - "litellm_**"
-  push:
-    branches:
-      - main
-      - litellm_internal_staging
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   documentation:
     runs-on: ubuntu-latest
     timeout-minutes: 10
-    permissions:
-      contents: read
-      pull-requests: read
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
 
-      - name: Detect relevant changes
-        id: changes
-        uses: ./.github/actions/detect-changes
-
       - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
-        if: steps.changes.outputs.decision != 'skip'
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           repository: BerriAI/litellm-docs
@@ -45,19 +33,16 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        if: steps.changes.outputs.decision != 'skip'
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Set up uv
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/setup-uv-with-retries
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           version: "0.10.9"
 
       - name: Cache uv dependencies
-        if: steps.changes.outputs.decision != 'skip'
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
@@ -67,27 +52,18 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-uv-
 
-      - name: Cache the Rust build
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-cargo-build
-
       - name: Install dependencies
-        if: steps.changes.outputs.decision != 'skip'
         run: |
-          .github/scripts/uv_sync_with_retries.sh --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
-
-      - name: Cache Prisma binaries
-        if: steps.changes.outputs.decision != 'skip'
-        uses: ./.github/actions/cache-prisma-binaries
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
 
       - name: Generate Prisma client
-        if: steps.changes.outputs.decision != 'skip'
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
         run: |
           uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
 
       # Run the same documentation tests that CircleCI ran (as direct Python scripts)
       - name: Run documentation validation tests
-        if: steps.changes.outputs.decision != 'skip'
         run: |
           uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
           uv run --no-sync python ./tests/documentation_tests/test_router_settings.py

.github/workflows/test-unit-enterprise-routing.yml

@@ -0,0 +1,31 @@
+name: "Unit Tests: Enterprise, Google GenAI & Routing"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  enterprise-routing:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/enterprise
+        tests/test_litellm/google_genai
+        tests/test_litellm/router_utils
+        tests/test_litellm/router_strategy
+      workers: 2
+      reruns: 2
+      artifact-name: enterprise-routing

.github/workflows/test-unit-integrations.yml

@@ -0,0 +1,27 @@
+name: "Unit Tests: Integrations (Callbacks & Logging)"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  integrations:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/integrations"
+      workers: 2
+      reruns: 3
+      artifact-name: integrations

.github/workflows/test-unit-llm-providers.yml

@@ -0,0 +1,43 @@
+name: "Unit Tests: LLM Provider Transformations"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vertex-ai:
+    name: Vertex AI
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/llms/vertex_ai"
+      workers: 1
+      reruns: 2
+      artifact-name: llm-vertex-ai
+
+  other-providers:
+    name: All Other Providers
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
+      workers: 2
+      reruns: 2
+      artifact-name: llm-other-providers

.github/workflows/test-unit-misc.yml

@@ -0,0 +1,38 @@
+name: "Unit Tests: MCP, Secrets, Containers & Misc"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  misc:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/secret_managers
+        tests/test_litellm/a2a_protocol
+        tests/test_litellm/anthropic_interface
+        tests/test_litellm/completion_extras
+        tests/test_litellm/containers
+        tests/test_litellm/experimental_mcp_client
+        tests/test_litellm/images
+        tests/test_litellm/interactions
+        tests/test_litellm/passthrough
+        tests/test_litellm/vector_stores
+        tests/test_litellm/test_*.py
+      workers: 2
+      reruns: 2
+      artifact-name: misc

.github/workflows/test-unit-proxy-auth.yml

@@ -0,0 +1,27 @@
+name: "Unit Tests: Proxy Auth & Key Management"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-auth:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-auth

.github/workflows/test-unit-proxy-db.yml

@@ -1,23 +1,16 @@
 name: "Unit Tests: Proxy DB Operations"
 
+# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
 on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
   push:
-    branches:
-      - main
-      - litellm_internal_staging
+    branches: [main, "litellm_**"]
 
 permissions:
   contents: read
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 # Semantic matrix: each shard groups tests by concern (auth, server, logging, …)
 # rather than alphabetical letter ranges. Adding a new test file means adding it
@@ -28,10 +21,6 @@ concurrency:
 #     Most of a shard's time is pytest plugin load + xdist worker imports +
 #     pytest-cov instrumentation, not the tests themselves. Keeping per-shard
 #     work low and matching worker count to runner cores is what controls it.
-#   * `timeout` bounds the pytest step only. Checkout, dependency install, and
-#     Prisma client generation draw on a separate allowance in the base
-#     workflow, so slow setup shows up as a slow job rather than as a
-#     cancelled shard whose tests were passing.
 #   * workers: 4 matches the 4-core ubuntu-latest runner. -n 8 on 4 cores
 #     oversubscribes 2x and workers fight for CPU during their cold-start
 #     imports (measured ~441% CPU for -n 8 locally, i.e. ~55% effective).
@@ -41,11 +30,15 @@ concurrency:
 #     xdist balances its 188 parametrized cases across workers instead of
 #     pinning the whole file to one worker (the default --dist=loadscope
 #     behavior for single-file targets).
+#   * test_db_schema_migration.py is isolated because one test in it
+#     (test_aaaasschema_migration_check) takes ~170s — by itself it
+#     determines the shard's wall-clock floor.
 jobs:
-  # Fast guard — fails the workflow when a test directory or file inside a sharded
-  # tree is claimed by no shard. The semantic-shard design has no catch-all bucket,
-  # so an unassigned child runs nowhere; assert_ci_coverage.py holds the tree list
-  # and reads the same test-path keys the coverage census does.
+  # Fast guard — fails the workflow if a test_*.py file under
+  # tests/proxy_unit_tests/ is not referenced by any matrix entry below.
+  # The semantic-shard design (no catch-all "remaining" bucket) relies on
+  # every test file being explicitly assigned; this guard prevents a new
+  # file from silently dropping out of CI.
   assert-shard-coverage:
     runs-on: ubuntu-latest
     timeout-minutes: 2
@@ -55,8 +48,31 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           persist-credentials: false
-      - name: Assert every test directory and file is claimed by a shard
-        run: python3 .github/scripts/assert_ci_coverage.py --shards
+      - name: Assert every test_*.py is in a matrix shard
+        run: |
+          python3 - <<'PY'
+          import pathlib, sys, yaml
+          wf = yaml.safe_load(open(".github/workflows/test-unit-proxy-db.yml"))
+          matrix = wf["jobs"]["proxy-db"]["strategy"]["matrix"]["include"]
+          referenced = set()
+          for entry in matrix:
+              for token in entry["test-path"].split():
+                  if token.startswith("tests/proxy_unit_tests/"):
+                      referenced.add(pathlib.PurePosixPath(token).name)
+          actual = {p.name for p in pathlib.Path("tests/proxy_unit_tests").iterdir()
+                    if p.name.startswith("test_") and (p.suffix == ".py" or p.is_dir())
+                    and p.name != "test_configs"}
+          orphans = sorted(actual - referenced)
+          if orphans:
+              print("ERROR: the following files/dirs under tests/proxy_unit_tests/")
+              print("       are not assigned to any shard in test-unit-proxy-db.yml:")
+              for o in orphans:
+                  print(f"  - {o}")
+              print()
+              print("Add each to whichever semantic shard it belongs to.")
+              sys.exit(1)
+          print(f"OK: all {len(actual)} files assigned to a shard.")
+          PY
 
   proxy-db:
     needs: assert-shard-coverage
@@ -84,7 +100,6 @@ jobs:
             test-path: >-
               tests/proxy_unit_tests/test_auth_checks.py
               tests/proxy_unit_tests/test_user_api_key_auth.py
-              tests/proxy_unit_tests/test_deprecated_key_grace_period.py
             workers: 4
             dist: loadscope
             timeout: 15
@@ -111,6 +126,8 @@ jobs:
             test-path: >-
               tests/proxy_unit_tests/test_proxy_server.py
               tests/proxy_unit_tests/test_proxy_server_keys.py
+              tests/proxy_unit_tests/test_proxy_server_caching.py
+              tests/proxy_unit_tests/test_proxy_server_langfuse.py
               tests/proxy_unit_tests/test_proxy_server_spend.py
               tests/proxy_unit_tests/test_aproxy_startup.py
             workers: 4
@@ -124,8 +141,6 @@ jobs:
               tests/proxy_unit_tests/test_server_root_path.py
               tests/proxy_unit_tests/test_proxy_pass_user_config.py
               tests/proxy_unit_tests/test_proxy_token_counter.py
-              tests/proxy_unit_tests/test_request_size_limit_middleware.py
-              tests/proxy_unit_tests/test_multipart_bypass_repro.py
             workers: 4
             dist: loadscope
             timeout: 15
@@ -148,6 +163,18 @@ jobs:
             dist: loadscope
             timeout: 15
 
+          # ---- db-and-spend: isolate the 170s schema-migration test ----
+          # test_db_schema_migration.py has exactly one test, and that test
+          # is mostly waiting on `prisma migrate deploy` / `prisma migrate
+          # diff` subprocesses (~170s). It does no CPU-bound Python work
+          # inside the test. Running with workers=0 (serial, no xdist)
+          # skips the 4-worker cold-start cost we'd otherwise pay for a
+          # single test, saving ~4 minutes of wall-clock.
+          - test-group: schema-migration
+            test-path: "tests/proxy_unit_tests/test_db_schema_migration.py"
+            workers: 0
+            dist: loadscope
+            timeout: 15
           - test-group: db-and-spend
             test-path: >-
               tests/proxy_unit_tests/test_prisma_client_backoff_retry.py
@@ -185,10 +212,8 @@ jobs:
               tests/proxy_unit_tests/test_models_fallback_endpoint.py
               tests/proxy_unit_tests/test_google_endpoint_routing.py
               tests/proxy_unit_tests/test_google_gemini_proxy_request.py
-              tests/proxy_unit_tests/test_gemini_agents_endpoints.py
               tests/proxy_unit_tests/test_get_favicon.py
               tests/proxy_unit_tests/test_get_image.py
-              tests/proxy_unit_tests/test_reducto_ocr_route.py
               tests/proxy_unit_tests/test_ui_path_detection.py
               tests/proxy_unit_tests/test_prompt_test_endpoint.py
               tests/proxy_unit_tests/test_check_batch_cost.py
@@ -202,11 +227,12 @@ jobs:
             workers: 4
             dist: loadscope
             timeout: 15
-    uses: ./.github/workflows/_test-unit-base.yml
+    uses: ./.github/workflows/_test-unit-services-base.yml
     with:
       test-path: ${{ matrix.test-path }}
       workers: ${{ matrix.workers }}
       reruns: 2
       timeout-minutes: ${{ matrix.timeout }}
+      enable-postgres: true
       dist: ${{ matrix.dist }}
       artifact-name: proxy-db-${{ matrix.test-group }}

.github/workflows/test-unit-proxy-endpoints.yml

@@ -0,0 +1,44 @@
+name: "Unit Tests: Proxy API Endpoints"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-endpoints:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/proxy/management_endpoints
+        tests/test_litellm/proxy/guardrails
+        tests/test_litellm/proxy/management_helpers
+        tests/test_litellm/proxy/anthropic_endpoints
+        tests/test_litellm/proxy/google_endpoints
+        tests/test_litellm/proxy/openai_files_endpoint
+        tests/test_litellm/proxy/response_api_endpoints
+        tests/test_litellm/proxy/image_endpoints
+        tests/test_litellm/proxy/vector_store_endpoints
+        tests/test_litellm/proxy/agent_endpoints
+        tests/test_litellm/proxy/discovery_endpoints
+        tests/test_litellm/proxy/health_endpoints
+        tests/test_litellm/proxy/public_endpoints
+        tests/test_litellm/proxy/prompts
+        tests/test_litellm/proxy/rag_endpoints
+        tests/test_litellm/proxy/realtime_endpoints
+        tests/test_litellm/proxy/ui_crud_endpoints
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-endpoints

.github/workflows/test-unit-proxy-infra.yml

@@ -0,0 +1,35 @@
+name: "Unit Tests: Proxy Infrastructure"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proxy-infra:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: >-
+        tests/test_litellm/proxy/db
+        tests/test_litellm/proxy/middleware
+        tests/test_litellm/proxy/spend_tracking
+        tests/test_litellm/proxy/pass_through_endpoints
+        tests/test_litellm/proxy/_experimental
+        tests/test_litellm/proxy/experimental
+        tests/test_litellm/proxy/common_utils
+        tests/test_litellm/proxy/test_*.py
+      workers: 2
+      reruns: 2
+      artifact-name: proxy-infra

.github/workflows/test-unit-proxy-legacy.yml

@@ -0,0 +1,93 @@
+name: "Unit Tests: Proxy Legacy Tests"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        test-group:
+          - name: "auth-and-jwt"
+            path: "tests/proxy_unit_tests/test_[a-j]*.py"
+          - name: "key-generation"
+            path: "tests/proxy_unit_tests/test_[k-o]*.py"
+          - name: "proxy-config"
+            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
+          - name: "proxy-server"
+            path: "tests/proxy_unit_tests/test_proxy_server.py"
+          - name: "proxy-server-extras"
+            path: "tests/proxy_unit_tests/test_proxy_server_*.py tests/proxy_unit_tests/test_proxy_setting_guardrails.py"
+          - name: "proxy-utils"
+            path: "tests/proxy_unit_tests/test_proxy_utils.py"
+          - name: "proxy-token-counter"
+            path: "tests/proxy_unit_tests/test_proxy_token_counter.py"
+          - name: "proxy-response-and-misc"
+            path: "tests/proxy_unit_tests/test_[r-t]*.py"
+          - name: "proxy-user-auth-and-spend"
+            path: "tests/proxy_unit_tests/test_[u-z]*.py"
+
+    name: ${{ matrix.test-group.name }}
+
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
+      - name: Cache uv dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cache/uv
+            .venv
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-uv-
+
+      - name: Install dependencies
+        run: |
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
+
+      - name: Generate Prisma client
+        env:
+          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
+        run: |
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma
+
+      - name: Run tests - ${{ matrix.test-group.name }}
+        env:
+          TEST_PATH: ${{ matrix.test-group.path }}
+        run: |
+          uv run --no-sync pytest ${TEST_PATH} \
+            --tb=short -vv \
+            --maxfail=10 \
+            -n 2 \
+            --reruns 1 \
+            --reruns-delay 1 \
+            --dist=loadscope \
+            --durations=20

.github/workflows/test-unit-responses-caching-types.yml

@@ -0,0 +1,27 @@
+name: "Unit Tests: Responses, Caching & Types"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  responses-caching-types:
+    uses: ./.github/workflows/_test-unit-base.yml
+    with:
+      test-path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
+      workers: 2
+      reruns: 2
+      artifact-name: responses-caching-types

.github/workflows/test-unit-security.yml

@@ -0,0 +1,28 @@
+name: "Unit Tests: Security"
+
+# Kept push-only (was previously required by DATABASE_URL secret scoping;
+# now the postgres credentials are ephemeral localhost values but the
+# push-trigger stays to match the proxy-db workflow cadence).
+on:
+  push:
+    branches: [main, "litellm_**"]
+
+permissions:
+  contents: read
+  id-token: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  security:
+    uses: ./.github/workflows/_test-unit-services-base.yml
+    with:
+      test-path: "tests/proxy_security_tests/"
+      workers: 1
+      reruns: 2
+      timeout-minutes: 20
+      enable-postgres: true
+      artifact-name: security

.github/workflows/test-unit.yml

@@ -1,250 +0,0 @@
-name: "Unit Tests"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - litellm_internal_staging
-      - litellm_oss_staging
-      - "litellm_**"
-  push:
-    branches:
-      - main
-      - litellm_internal_staging
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-# One caller for every tests/test_litellm shard, replacing the nine thin workflow
-# files that each wrapped a single call to _test-unit-base.yml. Adding a shard is
-# now one matrix entry rather than a new file.
-#
-# `name` is the shard id and nothing else, so each check reports as
-# "<shard> / Run tests" exactly as it did when the shard had its own file. Those
-# strings are the branch ruleset's required contexts, so they are load-bearing:
-# renaming an entry renames a required check and the ruleset stops matching it.
-#
-# Every entry states its timeouts even when they equal the base workflow's
-# defaults. An absent matrix key renders as an empty string, which is not a
-# number, so a partially-specified entry would fail the call rather than fall
-# back to the default.
-#
-# tests/proxy_unit_tests keeps its own caller (test-unit-proxy-db.yml): it is
-# already a matrix and carries a shard-coverage guard that reads that file by
-# name. Folding it in here is a follow-up, together with generalising that guard
-# into assert_ci_coverage.py.
-jobs:
-  unit:
-    name: ${{ matrix.shard }}
-    permissions:
-      contents: read
-      id-token: write
-      pull-requests: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - shard: core-utils
-            artifact-name: core-utils
-            test-path: "tests/test_litellm/litellm_core_utils"
-            workers: 2
-            reruns: 1
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: enterprise-routing
-            artifact-name: enterprise-routing
-            test-path: >-
-              tests/test_litellm/enterprise
-              tests/test_litellm/google_genai
-              tests/test_litellm/router_utils
-              tests/test_litellm/router_strategy
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: integrations
-            artifact-name: integrations
-            test-path: "tests/test_litellm/integrations"
-            workers: 2
-            reruns: 3
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: Vertex AI
-            artifact-name: llm-vertex-ai
-            test-path: "tests/test_litellm/llms/vertex_ai"
-            workers: 1
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: All Other Providers
-            artifact-name: llm-other-providers
-            test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: misc
-            artifact-name: misc
-            test-path: >-
-              tests/test_litellm/batches
-              tests/test_litellm/secret_managers
-              tests/test_litellm/a2a_protocol
-              tests/test_litellm/anthropic_interface
-              tests/test_litellm/completion_extras
-              tests/test_litellm/compression
-              tests/test_litellm/containers
-              tests/test_litellm/experimental_mcp_client
-              tests/test_litellm/models
-              tests/test_litellm/repositories
-              tests/test_litellm/images
-              tests/test_litellm/interactions
-              tests/test_litellm/ocr
-              tests/test_litellm/passthrough
-              tests/test_litellm/rag
-              tests/test_litellm/realtime_api
-              tests/test_litellm/rerank_api
-              tests/test_litellm/rust_bridge
-              tests/test_litellm/sandbox
-              tests/test_litellm/test_router
-              tests/test_litellm/vector_stores
-              tests/test_litellm/videos
-              tests/test_litellm/test_*.py
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: proxy-auth
-            artifact-name: proxy-auth
-            test-path: >-
-              tests/test_litellm/proxy/auth
-              tests/test_litellm/proxy/hooks
-              tests/test_litellm/proxy/policy_engine
-              tests/test_litellm/proxy/client
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: proxy-endpoints
-            artifact-name: proxy-endpoints
-            test-path: >-
-              tests/test_litellm/proxy/analytics_endpoints
-              tests/test_litellm/proxy/management_endpoints
-              tests/test_litellm/proxy/memory
-              tests/test_litellm/proxy/guardrails
-              tests/test_litellm/proxy/management_helpers
-              tests/test_litellm/proxy/anthropic_endpoints
-              tests/test_litellm/proxy/google_endpoints
-              tests/test_litellm/proxy/openai_files_endpoint
-              tests/test_litellm/proxy/batches_endpoints
-              tests/test_litellm/proxy/fine_tuning_endpoints
-              tests/test_litellm/proxy/vector_store_files_endpoints
-              tests/test_litellm/proxy/video_endpoints
-              tests/test_litellm/proxy/response_api_endpoints
-              tests/test_litellm/proxy/image_endpoints
-              tests/test_litellm/proxy/ocr_endpoints
-              tests/test_litellm/proxy/vector_store_endpoints
-              tests/test_litellm/proxy/agent_endpoints
-              tests/test_litellm/proxy/a2a
-              tests/test_litellm/proxy/credential_endpoints
-              tests/test_litellm/proxy/discovery_endpoints
-              tests/test_litellm/proxy/health_endpoints
-              tests/test_litellm/proxy/shutdown
-              tests/test_litellm/proxy/public_endpoints
-              tests/test_litellm/proxy/prompts
-              tests/test_litellm/proxy/rag_endpoints
-              tests/test_litellm/proxy/rerank_endpoints
-              tests/test_litellm/proxy/realtime_endpoints
-              tests/test_litellm/proxy/ui_crud_endpoints
-              tests/test_litellm/proxy/config_resolvers
-              tests/test_litellm/proxy/utils
-            workers: 4
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: proxy-server
-            artifact-name: proxy-server
-            test-path: "tests/test_litellm/proxy/proxy_server"
-            workers: 4
-            reruns: 2
-            timeout-minutes: 60
-            job-timeout-minutes: 100
-
-          - shard: proxy-infra
-            artifact-name: proxy-infra
-            test-path: >-
-              tests/test_litellm/proxy/db
-              tests/test_litellm/proxy/middleware
-              tests/test_litellm/proxy/spend_tracking
-              tests/test_litellm/proxy/pass_through_endpoints
-              tests/test_litellm/proxy/_experimental
-              tests/test_litellm/proxy/experimental
-              tests/test_litellm/proxy/common_utils
-              tests/test_litellm/proxy/enterprise_billing
-              tests/test_litellm/proxy/types_utils
-              tests/test_litellm/proxy/logging_endpoints
-              tests/test_litellm/proxy/test_*.py
-            workers: 4
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: caching-local
-            artifact-name: caching-local
-            test-path: >-
-              tests/local_testing/test_cache_preset_key.py
-              tests/local_testing/test_caching_handler.py
-              tests/local_testing/test_prompt_caching.py
-              tests/local_testing/test_responses_stream_cache_keys.py
-              tests/local_testing/test_unit_test_caching.py
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: proxy-extras
-            artifact-name: proxy-extras
-            test-path: "tests/litellm-proxy-extras"
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: enterprise-package
-            artifact-name: enterprise-package
-            test-path: "tests/enterprise"
-            workers: 4
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-
-          - shard: responses-caching-types
-            artifact-name: responses-caching-types
-            test-path: >-
-              tests/test_litellm/responses
-              tests/test_litellm/caching
-              tests/test_litellm/types
-            workers: 2
-            reruns: 2
-            timeout-minutes: 20
-            job-timeout-minutes: 60
-    uses: ./.github/workflows/_test-unit-base.yml
-    with:
-      test-path: ${{ matrix.test-path }}
-      workers: ${{ matrix.workers }}
-      reruns: ${{ matrix.reruns }}
-      timeout-minutes: ${{ matrix.timeout-minutes }}
-      job-timeout-minutes: ${{ matrix.job-timeout-minutes }}
-      artifact-name: ${{ matrix.artifact-name }}

.github/workflows/test_server_root_path.yml

@@ -0,0 +1,108 @@
+name: Test Proxy SERVER_ROOT_PATH Routing
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+
+jobs:
+  test-server-root-path:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    strategy:
+      matrix:
+        root_path: ["/api/v1", "/llmproxy"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
+          sudo apt-get clean
+          df -h /
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12
+
+      - name: Build Docker image
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 #v6.14
+        with:
+          context: .
+          file: ./docker/Dockerfile.non_root
+          tags: litellm-test:${{ github.sha }}
+          load: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Start LiteLLM container with SERVER_ROOT_PATH
+        run: |
+          docker run -d \
+            --name litellm-test \
+            -p 4000:4000 \
+            -e SERVER_ROOT_PATH="${{ matrix.root_path }}" \
+            -e LITELLM_MASTER_KEY="sk-1234" \
+            litellm-test:${{ github.sha }} \
+            --detailed_debug
+
+      - name: Wait for container to be healthy
+        run: |
+          echo "Waiting for LiteLLM to start..."
+          max_attempts=30
+          attempt=0
+
+          while [ $attempt -lt $max_attempts ]; do
+            if docker logs litellm-test 2>&1 | grep -q "Uvicorn running"; then
+              echo "LiteLLM started successfully"
+              break
+            fi
+            attempt=$((attempt + 1))
+            echo "Attempt $attempt/$max_attempts - waiting for server to start..."
+            sleep 2
+          done
+
+          if [ $attempt -eq $max_attempts ]; then
+            echo "Server failed to start within timeout"
+            docker logs litellm-test
+            exit 1
+          fi
+
+          sleep 5
+
+      - name: Show container logs
+        if: always()
+        run: docker logs litellm-test
+
+      - name: Test UI endpoint with root path
+        run: |
+          ROOT_PATH="${{ matrix.root_path }}"
+          echo "Testing UI at: http://localhost:4000${ROOT_PATH}/ui/"
+
+          for i in 1 2 3; do
+            content=$(curl -sL --max-time 5 -H "Authorization: Bearer sk-1234" "http://localhost:4000${ROOT_PATH}/ui/")
+            if echo "$content" | grep -q -E "(html|<!DOCTYPE|<head|<body)"; then
+              echo "UI page contains valid HTML content"
+              exit 0
+            fi
+            echo "Attempt $i/3 - no valid HTML, retrying in 5s..."
+            sleep 5
+          done
+          echo "UI page does not contain expected HTML content"
+          echo "Response: $content"
+          docker logs litellm-test
+          exit 1
+
+      - name: Cleanup
+        if: always()
+        run: |
+          docker stop litellm-test || true
+          docker rm litellm-test || true

.github/workflows/triage_issue_with_llm.yml

@@ -1,96 +0,0 @@
-name: Agent Shin — Issue triage
-
-# LLM-as-judge triage for external GitHub issues.
-#
-# DRY-RUN BY DEFAULT. See .github/workflows/triage_pr_with_llm.yml for the
-# enablement procedure — same repo variable (`AGENT_SHIN_ENABLED=true`)
-# unlocks the PR and issue triage flows together.
-
-on:
-  issues:
-    types: [opened, reopened]
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Issue number to triage manually."
-        required: true
-      close:
-        description: "If true and AGENT_SHIN_ENABLED=true, actually close on fail."
-        required: false
-        default: "false"
-        type: choice
-        options:
-          - "true"
-          - "false"
-
-permissions:
-  contents: read
-  issues: write
-
-jobs:
-  triage:
-    if: github.repository == 'BerriAI/litellm'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout triage script
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          sparse-checkout: .github/scripts
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Install LLM client
-        run: pip install --no-cache-dir --require-hashes -r .github/scripts/triage-requirements.txt
-
-      - name: Run Agent Shin
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Only expose the LLM key when the bot is enabled or a collaborator
-          # triggers it manually, so an external user can't force paid LLM
-          # calls by churning issues while the bot is still in dry-run.
-          # The Python script calls the LLM whenever this var is set
-          # (regardless of `--close`); stripping `--close` doesn't suppress
-          # the API call, only the destructive side effects.
-          OPENAI_API_KEY: ${{ (vars.AGENT_SHIN_ENABLED == 'true' || github.event_name == 'workflow_dispatch') && secrets.OPENAI_API_KEY || '' }}
-          OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
-          TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
-          AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}
-          DISPATCH_CLOSE: ${{ github.event.inputs.close }}
-          ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue_number }}
-        run: |
-          set -euo pipefail
-          ARGS=(--repo "${{ github.repository }}" --issue "${ISSUE_NUMBER}")
-          # Fail-safe gating: only the EXACT string "true" enables the
-          # destructive --close path. The workflow_dispatch input is a
-          # `choice` dropdown of "true"/"false" so the UI is constrained,
-          # but the API (`gh workflow run -f close=...`) accepts any
-          # string, and a `!= "false"` check would treat "True", "yes",
-          # "1", "TRUE", typos, and accidental whitespace as enabling
-          # closure. Mirror the Greptile closer's `= "true"` pattern.
-          if [ "${AGENT_SHIN_ENABLED:-false}" = "true" ] && [ "${DISPATCH_CLOSE:-false}" = "true" ]; then
-            ARGS+=(--close)
-            echo "::notice::Agent Shin is ENABLED and running in close-on-fail mode."
-          elif [ "${AGENT_SHIN_ENABLED:-false}" = "true" ]; then
-            echo "::notice::Agent Shin is ENABLED but this trigger is dry-run (workflow_dispatch close != 'true')."
-          else
-            echo "::notice::Agent Shin is in DRY-RUN mode (AGENT_SHIN_ENABLED is not 'true'). No comments will be posted; no issues will be closed."
-          fi
-          # Automatic `issues` events stay dry-run regardless until the team
-          # explicitly invokes workflow_dispatch with close=true.
-          if [ "${GITHUB_EVENT_NAME:-}" = "issues" ]; then
-            # filter out --close rather than substituting to "" (which would
-            # leave an empty positional arg that argparse rejects)
-            FILTERED=()
-            for arg in "${ARGS[@]}"; do
-              if [ "${arg}" != "--close" ]; then
-                FILTERED+=("${arg}")
-              fi
-            done
-            ARGS=("${FILTERED[@]}")
-            echo "::notice::issues trigger -> forcing dry-run."
-          fi
-          python3 .github/scripts/triage_with_llm.py "${ARGS[@]}"

.github/workflows/triage_reconsider.yml

@@ -1,172 +0,0 @@
-name: Agent Shin — reconsider
-
-# Comment-trigger workflow: when the PR/issue author (or an internal
-# collaborator) comments `@agent-shin reconsider` on a CLOSED PR/issue,
-# Agent Shin re-runs LLM-judge triage on the current title+body and:
-#
-#   - on PASS:  posts a "re-evaluated and reopened" comment + reopens.
-#   - on FAIL:  posts a "still missing X" comment and leaves it closed,
-#               so the contributor can iterate again.
-#
-# This exists because GitHub does NOT let an external (non-write-access)
-# OSS contributor reopen a PR/issue closed by a bot or maintainer. Without
-# this comment trigger, a contributor whose PR Agent Shin auto-closed
-# would have no path back into the review queue except opening a fresh PR
-# (which loses the original PR's history). The bot, on the other hand,
-# has write access via GH_TOKEN and can reopen on their behalf.
-#
-# DRY-RUN BY DEFAULT — gated on `vars.AGENT_SHIN_ENABLED == 'true'` just
-# like the other Agent Shin workflows. The workflow also gates on the
-# commenter being either the PR/issue author or an internal collaborator
-# (OWNER/MEMBER/COLLABORATOR) so random commenters cannot DOS the LLM
-# judge or force a reopen.
-
-on:
-  issue_comment:
-    types: [created]
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  reconsider:
-    if: |
-      github.repository == 'BerriAI/litellm'
-      && contains(github.event.comment.body, '@agent-shin reconsider')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Authorize commenter
-        # Only the PR/issue author OR an internal collaborator may trigger
-        # a reconsider. Outside random commenters could otherwise spam the
-        # phrase to burn LLM budget or, if a fail-open bug were ever
-        # introduced, force a reopen on someone else's behalf.
-        #
-        # We expose the authorization decision as a step output and gate
-        # every subsequent (potentially destructive) step on it. A `run:`
-        # step with `exit 0` would NOT stop the job — only `if:` gating
-        # on a known-true output is safe here.
-        id: auth
-        env:
-          COMMENTER: ${{ github.event.comment.user.login }}
-          AUTHOR: ${{ github.event.issue.user.login }}
-          ASSOCIATION: ${{ github.event.comment.author_association }}
-        run: |
-          set -euo pipefail
-          if [ "${COMMENTER}" = "${AUTHOR}" ]; then
-            echo "::notice::Authorized: commenter is the PR/issue author."
-            echo "authorized=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          case "${ASSOCIATION}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "::notice::Authorized: commenter is an internal collaborator (${ASSOCIATION})."
-              echo "authorized=true" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "::notice::Commenter '${COMMENTER}' (${ASSOCIATION}) is not authorized to trigger reconsider; skipping subsequent steps."
-              echo "authorized=false" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
-
-      - name: React 👀 to acknowledge the reconsider
-        # Add an eyes reaction to the triggering comment the moment we accept
-        # it, so the contributor gets instant feedback that the bot saw their
-        # `@agent-shin reconsider` before the slower triage steps run. Gated on
-        # AGENT_SHIN_ENABLED so dry-run leaves no visible trace. Best-effort:
-        # a reactions API hiccup must never fail the actual reconsider.
-        if: steps.auth.outputs.authorized == 'true' && vars.AGENT_SHIN_ENABLED == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST \
-            -H "Accept: application/vnd.github+json" \
-            "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" \
-            -f content=eyes \
-            || echo "::warning::failed to add 👀 reaction (non-fatal)"
-
-      - name: Checkout triage script
-        if: steps.auth.outputs.authorized == 'true'
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          sparse-checkout: .github/scripts
-          persist-credentials: false
-
-      - name: Set up Python
-        if: steps.auth.outputs.authorized == 'true'
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Install LLM client
-        if: steps.auth.outputs.authorized == 'true'
-        run: pip install --no-cache-dir --require-hashes -r .github/scripts/triage-requirements.txt
-
-      - name: Run Agent Shin reconsider
-        if: steps.auth.outputs.authorized == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # Only expose the LLM key when the bot is enabled, so a PR/issue
-          # author can't force paid LLM calls by spamming `@agent-shin
-          # reconsider` while the bot is still in dry-run. The Python script
-          # calls the LLM whenever this var is set (regardless of `--close`);
-          # stripping `--close` doesn't suppress the API call, only the
-          # destructive side effects. Mirror the gating used by every other
-          # Agent Shin workflow (triage_pr_with_llm.yml, review_gate.yml, ...).
-          OPENAI_API_KEY: ${{ vars.AGENT_SHIN_ENABLED == 'true' && secrets.OPENAI_API_KEY || '' }}
-          OPENAI_BASE_URL: ${{ vars.OPENAI_BASE_URL }}
-          TRIAGE_MODEL: ${{ vars.TRIAGE_MODEL }}
-          AGENT_SHIN_ENABLED: ${{ vars.AGENT_SHIN_ENABLED }}
-          # `issue_comment` events fire for both issues and PR comments.
-          # `issue.pull_request` is set iff this is a PR comment, so we use
-          # its presence to decide whether to invoke `--pr N` or `--issue N`.
-          IS_PR: ${{ github.event.issue.pull_request != null }}
-          NUMBER: ${{ github.event.issue.number }}
-        run: |
-          set -euo pipefail
-          if [ "${IS_PR}" = "true" ]; then
-            ARGS=(--repo "${{ github.repository }}" --pr "${NUMBER}" --reconsider)
-          else
-            ARGS=(--repo "${{ github.repository }}" --issue "${NUMBER}" --reconsider)
-          fi
-          # Reconsider's destructive actions (post comment + reopen) are
-          # gated on `--close`, mirroring the regular triage workflows.
-          # When AGENT_SHIN_ENABLED is not the EXACT string "true", we
-          # still run the script so its verdict + would-X action lands in
-          # the step summary for QA — but without `--close`, the script
-          # returns `would-reopen` / `would-reconsider-still-failing`
-          # instead of touching GitHub state.
-          #
-          # Use the positive `= "true"` gate (not `!= "true" -> exit`) so
-          # the workflow guardrails in
-          # tests/test_litellm/test_github_triage_workflows.py see the
-          # canonical fail-safe enable pattern. Unknown values like
-          # "True", "yes", "1", or typos fall through to the dry-run
-          # branch, which is the safe default.
-          if [ "${AGENT_SHIN_ENABLED:-false}" = "true" ]; then
-            ARGS+=(--close)
-            echo "::notice::Agent Shin reconsider ENABLED — running real triage (close=true)."
-          else
-            echo "::notice::AGENT_SHIN_ENABLED is not 'true' -> reconsider stays in dry-run (no comment, no reopen)."
-          fi
-          python3 .github/scripts/triage_with_llm.py "${ARGS[@]}"
-
-      - name: React 👍 when the reconsider finishes
-        # Once the reconsider run has completed successfully, add a thumbs-up so
-        # the contributor sees the bot is done (the 👀 stays, signalling
-        # seen -> handled). `success()` keeps this from firing if the run
-        # errored, and the AGENT_SHIN_ENABLED gate keeps dry-run inert.
-        if: success() && steps.auth.outputs.authorized == 'true' && vars.AGENT_SHIN_ENABLED == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          COMMENT_ID: ${{ github.event.comment.id }}
-        run: |
-          set -euo pipefail
-          gh api --method POST \
-            -H "Accept: application/vnd.github+json" \
-            "repos/${{ github.repository }}/issues/comments/${COMMENT_ID}/reactions" \
-            -f content=+1 \
-            || echo "::warning::failed to add 👍 reaction (non-fatal)"