[Infra] Migrate more CI jobs from CircleCI to GitHub Actions

[yuneng-berri]

Relevant issues

Depends on BerriAI/litellm-docs#7 — that PR adds 6 env-var entries to config_settings.md that `documentation_tests/test_env_keys.py` validates against. Merge the docs PR first; this PR's `documentation_test_env_keys` step will pass once the updated litellm-docs is live.

Summary

Problem

Several CircleCI jobs run work that doesn't require Docker-in-Docker or a proxy container — pure Python lints, custom semgrep rules, and documentation validation. They can run in GitHub Actions instead, with `actions/cache` amortization across runs and no cross-CI duplication.

Fix

Two CircleCI jobs migrated to GitHub Actions; one (the install compat job) was initially migrated but reverted when it turned out its tests make live outbound calls — see "Reverted" below.

1. `check_code_and_doc_quality` → new `.github/workflows/test-code-quality.yml`:
   • 21 `tests/code_coverage_tests/*.py` scripts (project-specific lints)
   • 3 `tests/documentation_tests/*.py` scripts (env-keys, router-settings, api-docs validation)
   • The docs scripts read `docs/my-website/docs/proxy/config_settings.md`. Since documentation has moved to `BerriAI/litellm-docs`, the GHA workflow checks out that repo and symlinks `docs/my-website` to the checkout so the existing hardcoded paths resolve without modifying the scripts.
   • `ruff check`, `from litellm import *` import-safety, and `test_circular_imports.py` were already run by `test-linting.yml` — no new work needed.
2. `semgrep` → new `.github/workflows/test-semgrep.yml`. Same custom rules (`.semgrep/rules`), same pinned semgrep 1.157.0.

Reverted during this PR

Initially migrated `installing_litellm_on_python` + `installing_litellm_on_python_3_13` to a new GHA matrix job, but those jobs run `tests/local_testing/test_basic_python_version.py` which starts a proxy and makes a live outbound call to OpenAI. That worked on CircleCI because its environment inherits the project's configured API keys. Those jobs stay on CircleCI for now.

Changes

• New: `.github/workflows/test-code-quality.yml` — 24 check steps, `uv.lock` cache, litellm-docs checkout wired in.
• New: `.github/workflows/test-semgrep.yml`.
• Modified: `.circleci/config.yml` — `check_code_and_doc_quality` and `semgrep` jobs + workflow refs removed.

Testing

Each GHA workflow runs on every PR under the same branch-filter set as the CCI jobs they replace (`main`, `litellm_internal_staging`, `litellm_oss_branch`, `litellm_**`). The scripts themselves are unchanged.

The documentation_tests scripts now validate against BerriAI/litellm-docs instead of the stale local `docs/my-website/` copy. The stale copy will be removed in a follow-up PR.

Type

🚄 Infrastructure

[greptile-apps]

Greptile Summary

This PR migrates two CircleCI jobs (check_code_and_doc_quality and semgrep) to GitHub Actions and cleans up their CCI workflow references. The new workflows are well-structured — actions are pinned by SHA, uv caching is wired in for the quality job, and the symlink approach for resolving litellm-docs paths is correct.

One discrepancy: the PR description also claims installing_litellm_on_python (3.12 and 3.13) are migrated to a new test-install-litellm.yml, but that file is absent from the diff — those CCI jobs are still active and unchanged (the 3.13 job is merely reordered within the file).

Confidence Score: 5/5

Safe to merge — the two jobs being replaced are fully represented in the new GHA workflows, and CCI is cleaned up correctly.

All remaining findings are P2. The pull_request-only trigger is a minor coverage gap that is common practice and does not introduce a regression since PRs are the primary gatekeeping mechanism. The description/scope mismatch for test-install-litellm.yml is cosmetic — no CCI coverage is actually dropped.

Both new GHA workflow files share the same missing push trigger; worth aligning in a follow-up if post-merge coverage on main is desired.

Important Files Changed

Filename	Overview
.github/workflows/test-code-quality.yml	New workflow migrating 21 code-coverage scripts and 3 documentation-test scripts from CircleCI; symlink trick for litellm-docs is sound, but the workflow only triggers on pull_request (not push to main), diverging from the original CCI push-based coverage.
.github/workflows/test-semgrep.yml	Minimal, correct semgrep workflow pinned to semgrep==1.157.0 with the same custom-rules config; same pull_request-only trigger gap as test-code-quality.yml.
.circleci/config.yml	Removes semgrep and check_code_and_doc_quality job definitions and their workflow references; installing_litellm_on_python_3_13 is reordered (not removed) — CCI install jobs remain active.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    PR[Pull Request / Push to main] --> GHA_TRIGGER{GitHub Actions\ntrigger}
    PR --> CCI_TRIGGER{CircleCI\ntrigger}

    GHA_TRIGGER -->|pull_request only| CQ[test-code-quality.yml\n21 code coverage scripts\n3 documentation tests]
    GHA_TRIGGER -->|pull_request only| SG[test-semgrep.yml\nsemgrep==1.157.0\n.semgrep/rules]

    CCI_TRIGGER -->|push main + litellm_**| INSTALL[installing_litellm_on_python\nPython 3.12 still in CCI]
    CCI_TRIGGER -->|push main + litellm_**| INSTALL313[installing_litellm_on_python_3_13\nPython 3.13 still in CCI]
    CCI_TRIGGER -->|push main + litellm_**| OTHER[other integration tests\nAPI key jobs etc.]

    CQ --> DOCS_CHECKOUT[Checkout BerriAI/litellm-docs\nsymlink docs/my-website]
    DOCS_CHECKOUT --> DOC_TESTS[test_env_keys\ntest_router_settings\ntest_api_docs]

Loading

_{Reviews (3): Last reviewed commit: "[Infra] Move non-API-key CCI jobs to Git..." | Re-trigger Greptile}

[greptile-apps]

Cross-repo checkout may fail for fork PRs if litellm-docs is private

actions/checkout without an explicit token uses the job's GITHUB_TOKEN, which is scoped to the current repository only. If BerriAI/litellm-docs is a private repository, this step will fail with a 403 for every PR — including those opened by team members — because GITHUB_TOKEN does not grant cross-repo access. Add a PAT (or a fine-grained token stored as a secret) via the token: parameter, or confirm the repo is public so anonymous clone works without credentials.

      - name: Checkout litellm-docs (for documentation_tests)
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          repository: BerriAI/litellm-docs
          path: _litellm_docs_checkout
          persist-credentials: false
          token: ${{ secrets.LITELLM_DOCS_READ_TOKEN }}  # needed if repo is private

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!