[Infra] Migrate PyPI publishing from CircleCI to GitHub Actions OIDC

- Add .github/workflows/publish_to_pypi.yml with OIDC trusted publisher - Remove publish_to_pypi job from .circleci/config.yml - Zero long-lived tokens, all actions SHA-pinned, build deps version-pinned
2026-08-02 00:22:06 +00:00 · 2026-03-26 19:02:14 -07:00
parent 8f425ec3ff
commit ba8455a3be
2 changed files with 136 additions and 143 deletions
@@ -3543,93 +3543,6 @@ jobs:
      - codecov/upload:
          file: ./coverage.xml

-  publish_to_pypi:
-    docker:
-      - image: cimg/python:3.8
-    working_directory: ~/project
-
-    environment:
-      TWINE_USERNAME: __token__
-
-    steps:
-      - checkout
-
-      - run:
-          name: Copy model_prices_and_context_window File to model_prices_and_context_window_backup
-          command: |
-            cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
-
-      - run:
-          name: Checkout code
-          command: git checkout $CIRCLE_SHA1
-
-      # Check if setup.py is modified and publish to PyPI
-      - run:
-          name: PyPI publish
-          command: |
-            echo "Install TOML package."
-            python -m pip install toml
-            VERSION=$(python -c "import toml; print(toml.load('pyproject.toml')['tool']['poetry']['version'])")
-            PACKAGE_NAME=$(python -c "import toml; print(toml.load('pyproject.toml')['tool']['poetry']['name'])")
-            if ! pip show -v $PACKAGE_NAME | grep -q "Version: ${VERSION}"; then
-                echo "pyproject.toml modified"
-                echo -e "[pypi]\nusername = $PYPI_PUBLISH_USERNAME\npassword = $PYPI_PUBLISH_PASSWORD" > ~/.pypirc
-                python -m pip install --upgrade pip
-                pip install build
-                pip install wheel
-                pip install --upgrade twine setuptools
-                rm -rf build dist
-
-                echo "Building package"
-                python -m build
-
-                echo "Twine upload to dist"
-                echo "Contents of dist directory:"
-                ls dist/
-                twine upload --verbose dist/*
-            else
-                echo "Version ${VERSION} of package is already published on PyPI."
-                
-                # Check if corresponding Docker nightly image exists
-                NIGHTLY_TAG="v${VERSION}-nightly"
-                echo "Checking for Docker nightly image: litellm/litellm:${NIGHTLY_TAG}"
-                
-                # Check Docker Hub for the nightly image
-                if curl -s "https://hub.docker.com/v2/repositories/litellm/litellm/tags/${NIGHTLY_TAG}" | grep -q "name"; then
-                    echo "Docker nightly image ${NIGHTLY_TAG} exists. This release was already completed successfully."
-                    echo "Skipping PyPI publish and continuing to ensure Docker images are up to date."
-                    circleci step halt
-                else
-                    echo "ERROR: PyPI package ${VERSION} exists but Docker nightly image ${NIGHTLY_TAG} does not exist!"
-                    echo "This indicates an incomplete release. Please investigate."
-                    exit 1
-                fi
-            fi
-      - run:
-          name: Trigger Github Action for new Docker Container + Trigger Load Testing
-          command: |
-            echo "Install TOML package."
-            python3 -m pip install toml
-            VERSION=$(python3 -c "import toml; print(toml.load('pyproject.toml')['tool']['poetry']['version'])")
-            echo "LiteLLM Version ${VERSION}"
-
-            # Determine which branch to use for Docker build
-            if [[ "$CIRCLE_BRANCH" =~ ^litellm_release_day_.* ]]; then
-              BUILD_BRANCH="$CIRCLE_BRANCH"
-              echo "Using release branch: $BUILD_BRANCH"
-            else
-              BUILD_BRANCH="main"
-              echo "Using default branch: $BUILD_BRANCH"
-            fi
-
-            curl -X POST \
-              -H "Accept: application/vnd.github.v3+json" \
-              -H "Authorization: Bearer $GITHUB_TOKEN" \
-              "https://api.github.com/repos/BerriAI/litellm/actions/workflows/ghcr_deploy.yml/dispatches" \
-              -d "{\"ref\":\"${BUILD_BRANCH}\", \"inputs\":{\"tag\":\"v${VERSION}-nightly\", \"commit_hash\":\"$CIRCLE_SHA1\"}}"
-            echo "triggering load testing server for version ${VERSION} and commit ${CIRCLE_SHA1}"
-            curl -X POST "https://proxyloadtester-production.up.railway.app/start/load/test?version=${VERSION}&commit_hash=${CIRCLE_SHA1}&release_type=nightly"
-
  publish_proxy_extras:
    docker:
      - image: cimg/python:3.8
@@ -4489,59 +4402,3 @@ workflows:
              only:
                - main
                - /litellm_release_day_.*/
-      - publish_to_pypi:
-          requires:
-            - mypy_linting
-            - semgrep
-            - local_testing_part1
-            - local_testing_part2
-            - build_and_test
-            - e2e_openai_endpoints
-            - test_bad_database_url
-            - llm_translation_testing
-            - realtime_translation_testing
-            - mcp_testing
-            - agent_testing
-            - google_generate_content_endpoint_testing
-            - llm_responses_api_testing
-            - ocr_testing
-            - search_testing
-            - litellm_mapped_tests_proxy_part1
-            - litellm_mapped_tests_proxy_part2
-            - litellm_mapped_tests_llms
-            - litellm_mapped_tests_core
-            - litellm_mapped_tests_mcps
-            - litellm_mapped_tests_integrations
-            - litellm_mapped_tests_litellm_core_utils
-            - litellm_mapped_enterprise_tests
-            - batches_testing
-            - litellm_utils_testing
-            - pass_through_unit_testing
-            - image_gen_testing
-            - logging_testing
-            - audio_testing
-            - litellm_router_testing
-            - litellm_router_unit_testing
-            - caching_unit_tests
-            - langfuse_logging_unit_tests
-            - litellm_assistants_api_testing
-            - auth_ui_unit_tests
-            - ui_unit_tests
-            - db_migration_disable_update_check
-            - e2e_ui_testing_chromium
-            - e2e_ui_testing_firefox
-            - litellm_proxy_unit_testing_key_generation
-            - litellm_proxy_unit_testing_part1
-            - litellm_proxy_unit_testing_part2
-            - litellm_security_tests
-            - installing_litellm_on_python
-            - installing_litellm_on_python_3_13
-            - proxy_logging_guardrails_model_info_tests
-            - proxy_spend_accuracy_tests
-            - proxy_multi_instance_tests
-            - proxy_store_model_in_db_tests
-            - proxy_build_from_pip_tests
-            - proxy_pass_through_endpoint_tests
-            - check_code_and_doc_quality
-            - publish_proxy_extras
-            - guardrails_testing
@@ -0,0 +1,136 @@
+name: Publish to PyPI
+
+on:
+  workflow_dispatch:
+
+jobs:
+  preflight-checks:
+    name: Preflight Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    # No environment — read-only checks, no approval needed
+    outputs:
+      needs_publish: ${{ steps.check-litellm.outputs.needs_publish }}
+      version: ${{ steps.check-litellm.outputs.version }}
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Check litellm version on PyPI
+        id: check-litellm
+        run: |
+          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Checking if litellm $VERSION exists on PyPI..."
+
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm/$VERSION/json")
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "litellm $VERSION already exists on PyPI. Skipping publish."
+            echo "needs_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "litellm $VERSION not found on PyPI. Publish needed."
+            echo "needs_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Sanity check proxy-extras version
+        run: |
+          # Read pinned version from requirements.txt
+          REQ_VERSION=$(grep -oP 'litellm-proxy-extras==\K[0-9.]+' requirements.txt)
+          if [ -z "$REQ_VERSION" ]; then
+            echo "::error::Could not find litellm-proxy-extras version in requirements.txt"
+            exit 1
+          fi
+          echo "requirements.txt pins litellm-proxy-extras==$REQ_VERSION"
+
+          # Read pinned version from pyproject.toml dependency
+          PYPROJECT_VERSION=$(python3 -c "
+          import re
+          with open('pyproject.toml') as f:
+              content = f.read()
+          match = re.search(r'litellm-proxy-extras\s*=\s*\{version\s*=\s*\"([^\"]+)\"', content)
+          if match:
+              print(match.group(1).lstrip('^~>='))
+          else:
+              import sys
+              print('::error::Could not find litellm-proxy-extras dependency in pyproject.toml', file=sys.stderr)
+              sys.exit(1)
+          ")
+          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"
+
+          # Check that both pinned versions match
+          if [ "$REQ_VERSION" != "$PYPROJECT_VERSION" ]; then
+            echo "::error::Version mismatch: requirements.txt has $REQ_VERSION but pyproject.toml has $PYPROJECT_VERSION"
+            exit 1
+          fi
+
+          # Check that the pinned version exists on PyPI
+          echo "Checking if litellm-proxy-extras $REQ_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$REQ_VERSION/json")
+          if [ "$HTTP_STATUS" != "200" ]; then
+            echo "::error::litellm-proxy-extras $REQ_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            exit 1
+          fi
+          echo "litellm-proxy-extras $REQ_VERSION exists on PyPI. Sanity check passed."
+
+  publish-litellm:
+    name: Publish litellm to PyPI
+    needs: preflight-checks
+    if: needs.preflight-checks.outputs.needs_publish == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      id-token: write
+      contents: read
+    environment: pypi-publish
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+
+      - name: Copy model prices backup
+        run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json
+
+      - name: Install build tools
+        run: python -m pip install --upgrade pip build==1.4.2
+
+      - name: Build package
+        run: |
+          rm -rf build dist
+          python -m build
+
+      - name: Verify build artifacts
+        env:
+          EXPECTED_VERSION: ${{ needs.preflight-checks.outputs.version }}
+        run: |
+          echo "Contents of dist/:"
+          ls -la dist/
+          # Ensure we have both sdist and wheel
+          ls dist/*.tar.gz
+          ls dist/*.whl
+          # Verify built version matches expected
+          ls dist/ | grep -q "litellm-${EXPECTED_VERSION}" || {
+            echo "::error::Built artifacts do not match expected version $EXPECTED_VERSION"
+            ls dist/
+            exit 1
+          }
+
+      - name: Validate package metadata
+        run: |
+          pip install twine==6.2.0
+          twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0