[Infra] CircleCI config cleanup and consolidation

[yuneng-berri]

Relevant issues

Summary

Problem

The CircleCI config had grown to 3,601 lines with significant duplication and drift:

• The uv installer block (curl | sha256 | sh, 6 lines) was copy-pasted in 43 places, with the version string and SHA256 hardcoded in every copy.
• The same docker run ... postgres:14 + wait_for_service block was copy-pasted in 11 places.
• 8 machine-executor jobs downloaded Miniconda just to get a Python interpreter, then uv sync'd into that environment.
• Docker image references were unpinned (tagged only, e.g. cimg/python:3.12).
• The mypy_linting job duplicated a check that GitHub Actions' test-linting.yml already runs.
• Several jobs had redundant Install curl steps even though curl is already on the base image.
• Cache keys included {{ checksum ".circleci/config.yml" }}, which busts the cache on every unrelated config edit.
• Two copy-paste residues with 6× duplicated branch-filter entries.

Fix

Five commits, one per change class, so review is navigable even though the PR is large:

1. Clean up unused jobs and pin docker images by digest — delete mypy_linting + 3× Install curl + dedup one filter block. Append @sha256:<digest> to every cimg/* and postgres:14 reference so upstream tag moves can't silently change what runs.
2. Add install_uv reusable command and migrate all call sites — one command defines uv 0.10.9 + SHA256 in one place. All 43 inline install blocks replaced with - install_uv.
3. Add start_postgres reusable command and migrate call sites — parameterized on db_name (default circle_test, override to litellm_test for the helm job). All 11 inline docker run + wait_for_service pairs collapsed into - start_postgres.
4. Standardize default Python to 3.12 and remove miniconda — 26 jobs moved from cimg/python:3.11 to cimg/python:3.12; one incidental 3.13.1 and one historical 3.9 image similarly consolidated. installing_litellm_on_python_3_13 keeps 3.13.1 as its explicit compat matrix. Machine-executor jobs drop the miniconda install entirely and use uv sync --python 3.12, which auto-downloads a python-build-standalone interpreter when needed.
5. Cleanup remaining inconsistencies — fix a second 6× duplicated filter block, delete an empty Install Semgrep run step, bump the remaining ubuntu-2204:2023.10.1 machine images to 2024.04.1 (already used by build_docker_database_image), remove the legacy version: 2 inside workflows:, drop config.yml checksum from cache keys, and add partial-restore fallbacks for graceful cache degradation.

Changes

Net −677 lines (3,601 → 2,934). Two new reusable commands, one uv install definition instead of 43, one postgres-start definition instead of 11, one Python default instead of five.

Testing

Behavioral surface is unchanged: same jobs run the same tests on the same triggers. The mechanical changes are covered by running the full CCI pipeline on this PR.

First-run watchpoints:

• Machine-executor jobs that previously used miniconda for Python 3.10 now call uv sync --python 3.12, which downloads a python-build-standalone interpreter on first use. Expect a ~3–5s one-time download per cold cache.
• proxy_build_from_pip_tests retains Python 3.13 via uv sync --python 3.13 (was conda create python=3.13).
• Cache keys changed — expect cold caches on the first run after merge.
• One site previously used a bespoke pg_isready loop instead of wait_for_service; now goes through the shared TCP probe path. Functionally equivalent for test ordering.

Type

🚄 Infrastructure
🧹 Refactoring

[greptile-apps]

Greptile Summary

This PR consolidates the CircleCI config from 3,601 to 2,934 lines by introducing two reusable commands (install_uv and start_postgres), pinning all Docker image references by SHA256 digest, standardizing Python to 3.12, removing miniconda from machine-executor jobs, and eliminating the duplicate mypy_linting job and copy-paste filter blocks. The behavioral surface is unchanged — same jobs run the same tests on the same branch triggers.

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style/cleanup observations that do not block correctness.

The PR is a purely mechanical infrastructure refactor with no logic changes to application code. All comments are P2: a pre-existing cache path mismatch in two router jobs, and a Python version downgrade for the assistants API job that the author has explicitly acknowledged as intentional. No security issues, no data-path changes, and no test regressions are introduced.

.circleci/config.yml — specifically the litellm_router_testing/litellm_router_unit_testing cache path and the litellm_assistants_api_testing Python downgrade.

Important Files Changed

Filename	Overview
.circleci/config.yml	Large infrastructure cleanup: adds reusable install_uv and start_postgres commands, pins all Docker images by SHA256 digest, standardizes Python to 3.12, removes miniconda, drops mypy_linting job, improves cache keys, and removes duplicate filter entries — net −677 lines

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    subgraph commands["Reusable Commands (new)"]
        IU["install_uv\ncurl install.sh → sha256sum check\n→ UV_NO_MODIFY_PATH sh\n→ $BASH_ENV PATH"]
        SP["start_postgres\ndocker run postgres:14@sha256\n→ wait_for_service tcp://localhost:5432"]
    end

    subgraph docker_jobs["Docker Executor Jobs"]
        DJ["43 jobs\ncimg/python:3.12@sha256\nor 3.13.1@sha256 (compat matrix)"]
    end

    subgraph machine_jobs["Machine Executor Jobs"]
        MJ["8 jobs\nubuntu-2204:2024.04.1\nuv sync --python 3.12/3.13\n(no miniconda)"]
    end

    subgraph cache["Cache Keys"]
        CK["v*-deps-checksum uv.lock\n+ partial fallback v*-deps-\n(config.yml removed from key)"]
    end

    IU --> DJ
    IU --> MJ
    SP --> MJ
    CK --> DJ
    CK --> MJ

Loading

Comments Outside Diff (1)

1. .circleci/config.yml, line 462-475 (link)

   Cache path mismatch in router testing jobs

   litellm_router_testing and litellm_router_unit_testing both persist save_cache: paths: /home/circleci/.pyenv, but dependency installation now uses uv sync --frozen --python 3.12, which writes packages to .venv (project root) and ~/.cache/uv, not ~/.pyenv. The cached path is irrelevant to uv, so these jobs will always perform a cold install. This was a pre-existing issue that the PR left unaddressed; the fix would be to save ./.venv or ~/.cache/uv instead.

_{Reviews (1): Last reviewed commit: "[Infra] CCI config cleanup — dead step, ..." | Re-trigger Greptile}

[greptile-apps]

Silent Python version downgrade for assistants API tests

litellm_assistants_api_testing was previously pinned to cimg/python:3.13.1 and is now running on cimg/python:3.12. If any test in this job exercised Python-version-specific behavior (type narrowing, asyncio changes, exception group syntax, etc.), those assertions now run one minor version back without a corresponding installing_litellm_on_python_3_13 equivalent. The PR description labels this change "incidental," but it is a downgrade, not an upgrade — worth confirming the assistants API test suite has no 3.13-specific expectations.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!