Merge pull request #24663 from BerriAI/litellm_test_branch_03_26_2026_p1

Add zizmor to ci/cd

.github/workflows/auto_update_price_and_context_window.yml

@@ -5,12 +5,18 @@ on:
     - cron: "0 0 * * 0" # Run every Sundays at midnight
     #- cron: "0 0 * * *" # Run daily at midnight
 
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   auto_update_price_and_context_window:
     if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
       - name: Install Dependencies
         run: |
           pip install 'aiohttp==3.13.3'

.github/workflows/check_duplicate_issues.yml

@@ -33,6 +33,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
         if: github.event.action == 'opened'

.github/workflows/codeql.yml

@@ -39,6 +39,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@ebcb5b36ded6beda4ceefea6a8bc4cc885255bb3 # v3

.github/workflows/codspeed.yml

@@ -26,6 +26,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/create_daily_staging_branch.yml

@@ -9,12 +9,15 @@ jobs:
   create-staging-branch:
     if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create daily staging branch
         env:
@@ -46,12 +49,15 @@ jobs:
   create-internal-dev-branch:
     if: github.repository == 'BerriAI/litellm'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create internal dev branch
         env:

.github/workflows/helm_unit_test.yml

@@ -6,12 +6,17 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unit-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Helm 3.11.1
         uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1

.github/workflows/issue-keyword-labeler.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Scan for provider keywords
         id: scan

.github/workflows/llm-translation-testing.yml

@@ -11,6 +11,9 @@ on:
     tags:
       - "v*-rc*" # Triggers on release candidate tags like v1.0.0-rc1
 
+permissions:
+  contents: read
+
 jobs:
   run-llm-translation-tests:
     runs-on: ubuntu-latest
@@ -20,6 +23,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.inputs.release_candidate_tag || github.ref }}
 
       - name: Set up Python
@@ -33,8 +37,8 @@ jobs:
           poetry config virtualenvs.create true
           poetry config virtualenvs.in-project true
 
-      - name: Cache Poetry dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
+      - name: Restore Poetry dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
         with:
           path: |
             ~/.cache/pypoetry
@@ -60,11 +64,12 @@ jobs:
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
           AZURE_API_VERSION: ${{ secrets.AZURE_API_VERSION }}
-          # Add other API keys as needed
+          RC_TAG: ${{ github.event.inputs.release_candidate_tag || github.ref_name }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
           python .github/workflows/run_llm_translation_tests.py \
-            --tag "${{ github.event.inputs.release_candidate_tag || github.ref_name }}" \
-            --commit "${{ github.sha }}" \
+            --tag "$RC_TAG" \
+            --commit "$COMMIT_SHA" \
             || true  # Continue even if tests fail
 
       - name: Display test summary

.github/workflows/read_pyproject_version.yml

@@ -5,6 +5,9 @@ on:
     branches:
       - main # Change this to the default branch of your repository
 
+permissions:
+  contents: read
+
 jobs:
   read-version:
     runs-on: ubuntu-latest
@@ -12,6 +15,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Read version from pyproject.toml
         id: read-version

.github/workflows/run_observatory_tests.yml

@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate tag input
         env:
@@ -49,11 +51,12 @@ jobs:
           TAG: ${{ inputs.tag }}
           AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }}
           AZURE_API_BASE: ${{ secrets.AZURE_API_BASE }}
+          WORKSPACE: ${{ github.workspace }}
         run: |
           docker run -d \
             --name litellm-rc \
             -p 4000:4000 \
-            -v "${{ github.workspace }}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
+            -v "${WORKSPACE}/.github/observatory/litellm_config.yaml:/app/config.yaml" \
             -e LITELLM_MASTER_KEY="${LITELLM_MASTER_KEY}" \
             -e AZURE_API_KEY="${AZURE_API_KEY}" \
             -e AZURE_API_BASE="${AZURE_API_BASE}" \
@@ -104,11 +107,11 @@ jobs:
 
       - name: Verify tunnel connectivity
         run: |
-          echo "Testing tunnel at ${{ env.TUNNEL_URL }}..."
+          echo "Testing tunnel at ${TUNNEL_URL}..."
           # Quick tunnels need time for DNS propagation; retry to avoid
           # transient NXDOMAIN (curl exit code 6) on first attempt.
           for i in $(seq 1 10); do
-            if curl -sf "${{ env.TUNNEL_URL }}/health/liveliness" > /dev/null 2>&1; then
+            if curl -sf "${TUNNEL_URL}/health/liveliness" > /dev/null 2>&1; then
               echo "Tunnel is working (attempt $i)"
               exit 0
             fi
@@ -222,5 +225,5 @@ jobs:
       - name: Cleanup
         if: always()
         run: |
-          kill "${{ env.CLOUDFLARED_PID }}" 2>/dev/null || true
+          kill "$CLOUDFLARED_PID" 2>/dev/null || true
           docker rm -f litellm-rc 2>/dev/null || true

.github/workflows/scan_duplicate_issues.yml

@@ -24,6 +24,7 @@ jobs:
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: .github/scripts
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/stale.yml

@@ -5,6 +5,10 @@ on:
     - cron: "0 0 * * *" # Runs daily at midnight UTC
   workflow_dispatch:
 
+permissions:
+  issues: write
+  pull-requests: write
+
 jobs:
   stale:
     if: github.repository == 'BerriAI/litellm'

.github/workflows/test-linting.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -14,6 +17,7 @@ jobs:
         with:
           fetch-depth: 0
           clean: true
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -87,6 +91,7 @@ jobs:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/test-litellm-matrix.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 # Cancel in-progress runs for the same PR
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -118,6 +121,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/test-litellm-ui-build.yml

@@ -17,6 +17,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0

.github/workflows/test-litellm.yml

@@ -8,6 +8,9 @@ on:
   # pull_request:
   #   branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -15,6 +18,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Thank You Message
         run: |

.github/workflows/test-mcp.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -11,6 +14,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Thank You Message
         run: |

.github/workflows/test-model-map.yaml

@@ -4,11 +4,16 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   validate-model-prices-json:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Validate model_prices_and_context_window.json
         run: |

.github/workflows/test-proxy-e2e-azure-batches.yml

@@ -9,6 +9,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   proxy_e2e_azure_batches_tests:
     runs-on: ubuntu-latest
@@ -31,6 +34,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/test_server_root_path.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12