mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-29 06:33:28 +00:00
93cfc5265e
* ci(zizmor): run zizmor 1.31.1 without ignores and own the workflow zizmor-action has no input for --no-ignores, so the workflow now installs the zizmor 1.31.1 release binary directly, pinned by SHA-256 like grype in image-scan.yml, and runs it with --no-ignores and --no-config. Inline `zizmor: ignore` comments and config-file ignores no longer hide findings. Behavior otherwise matches the old action defaults (regular persona, online audits with the job token, medium and above, GitHub annotations) Adds a CODEOWNERS entry for .github/workflows/zizmor.yml * ci: run spend-logs-guard and cost-map-guard on pull_request Both guards ran on pull_request_target behind a zizmor ignore comment. They now run on pull_request and check out the base commit by sha, so the guard scripts still come from the base branch while the PR's head is only fetched and diffed. The zizmor ignore comments are gone |
||
|---|---|---|
| .. | ||
| actions | ||
| assets/scaledown | ||
| codeql | ||
| e2e-stack | ||
| ISSUE_TEMPLATE | ||
| observatory | ||
| prompts | ||
| PULL_REQUEST_TEMPLATE | ||
| screenshots | ||
| scripts | ||
| workflows | ||
| ci-coverage-allowlist.yml | ||
| CODEOWNERS | ||
| dependabot.yaml | ||
| deploy-on-aws.png | ||
| deploy-on-gcp.png | ||
| deploy-to-aws.png | ||
| FUNDING.yml | ||
| issue-labels.json | ||
| mutmut-coverage.rc | ||
| template.yaml | ||
