ci(zizmor): also run on litellm_internal_staging

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests (N/A; this only widens a GitHub Actions trigger filter, there is no application code path to unit test)
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

CI (LiteLLM team)

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

The zizmor workflow triggered only on main, so pull requests targeting litellm_internal_staging (the branch nearly all internal development goes through) were never analyzed. This adds litellm_internal_staging to both the push and pull_request branch filters

To confirm the workflow still runs cleanly under the new config, I temporarily added this feature branch to the push filter, pushed, and got a green run, then removed the temporary entry so the final diff only adds litellm_internal_staging. The verification run, all steps green including the zizmor step: https://github.com/BerriAI/litellm/actions/runs/27789888213

Note for reviewers: for pull_request events GitHub reads the trigger config from the base branch, so this starts covering staging-targeted PRs only once it is merged into litellm_internal_staging; it does not retroactively run on already-open PRs

Type

🚄 Infrastructure

Changes

Adds litellm_internal_staging to the push and pull_request branch filters in .github/workflows/zizmor.yml so the GitHub Actions analysis runs on the primary integration branch, not just main

[greptile-apps]

Greptile Summary

This PR widens the trigger filters in the zizmor GitHub Actions Security Analysis workflow to include litellm_internal_staging alongside main, so security analysis runs on both the primary integration branch and the release branch.

• Adds litellm_internal_staging to both the push and pull_request branch filters in .github/workflows/zizmor.yml — no application code is touched.
• The rest of the workflow (pinned action SHAs, minimal permissions, persist-credentials: false, timeout) is unchanged and remains well-configured.

Confidence Score: 5/5

Safe to merge — the change is a two-line addition to a CI trigger filter with no effect on application code.

Only one workflow file is modified, and the change simply adds a branch name to two existing filter lists. The workflow itself already follows GitHub Actions hardening best practices (pinned SHA references, minimal scoped permissions, persist-credentials: false). There is no application code, no logic change, and no new attack surface introduced.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/zizmor.yml	Adds litellm_internal_staging to the push and pull_request branch filters so the zizmor security-analysis workflow also runs on the primary integration branch.

_{Reviews (1): Last reviewed commit: "ci(zizmor): also run on litellm_internal..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!