ci(zizmor): gate PRs on medium+ findings and clear existing ones

[yuneng-berri]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

This PR changes GitHub Actions workflow configuration only, with no application code, so there are no unit tests to add and make test-unit is not the relevant check. Verification is the zizmor run shown below plus the branch CI run

CI (LiteLLM team)

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

The zizmor job today uploads findings to code scanning and always exits green, so it cannot block anything. This makes it gate instead, then clears the findings that were already open so the gate passes. Verified locally with the exact engine the action runs (zizmor 1.24.1, regular persona, medium threshold)

$ zizmor --persona regular --min-severity medium .github/workflows
No findings to report. Good job! (138 suppressed)
exit code: 0

The gate still blocks a fundamentally insecure trigger, so it keeps real signal:

$ zizmor --persona regular --min-severity medium <pull_request_target workflow>
error[dangerous-triggers]: use of fundamentally insecure workflow trigger
4 findings (3 suppressed): 0 informational, 0 low, 0 medium, 1 high
exit code: 14

Type

🚄 Infrastructure

Changes

The zizmor check runs with advanced-security: false, min-severity: medium and annotations: true, so it fails on any finding at medium or above and surfaces them as inline PR annotations. The security-events: write and actions: read permissions are dropped since nothing is uploaded anymore, leaving only contents: read. Once this lands, the check can be promoted to a required check for merges into litellm_internal_staging

The engine is pinned to zizmor 1.24.1 through zizmor-action v0.5.6 (SHA pinned), so runs are deterministic rather than tracking whatever the action's bundled latest resolves to. 1.24.1 also scopes the secrets-outside-env audit to the auditor persona, so env-mapped secrets in the triage and helper workflows are no longer reported at the regular persona this check uses

To make the gate pass, the previously open findings are cleared. Mismatched action pin version comments are corrected to the exact tag each SHA resolves to (# v3 to # v3.34.1 for the CodeQL actions, # v5.0 to # v5.0.0 for setup-node, and the buildx and build-push comments in the server-root-path workflow). The proxy endpoints workflow no longer grants id-token: write and pull-requests: write at the workflow level; those move to the two jobs that actually call the reusable test workflow. The server-root-path docker build is marked push: false and no longer reads or writes the shared type=gha build cache, which removes the only writer of that cache from an untrusted pull_request context

No application code changes; this is workflow configuration only

[greptile-apps]

Greptile Summary

This PR hardens GitHub Actions security by converting the zizmor workflow scanner from a passive reporter into a blocking gate, and fixes several least-privilege and cache-poisoning issues flagged by it.

• zizmor now blocks PRs: Upgrades the action to v0.5.6 (SHA-pinned), pins the engine to 1.24.1, and sets advanced-security: false + min-severity: medium so any medium-or-higher finding fails the job instead of silently uploading a SARIF report. Unused security-events: write and actions: read permissions are dropped.
• Least-privilege for proxy-endpoints: id-token: write and pull-requests: write move from workflow-level to per-job permissions, so future jobs added to that workflow start with contents: read only.
• Cache-poisoning fix for server-root-path: The pull_request-triggered Docker build drops cache-from/cache-to: type=gha, preventing an untrusted fork from writing into the shared build cache; push: false is also made explicit.

Confidence Score: 5/5

Workflow-only changes that tighten permissions and fix a cache-poisoning exposure; no application code is touched.

All six files are GitHub Actions workflow configuration. The changes follow well-established GitHub Actions hardening patterns (job-scoped permissions, no GHA cache writes in untrusted fork contexts, fail-fast security scanners). No logic is altered that could break application behavior.

No files require special attention. Note that zizmor becoming a blocking check only takes effect once added as a required status check in branch protection rules for litellm_internal_staging — that step is external to this PR.

Important Files Changed

Filename	Overview
.github/workflows/zizmor.yml	Drops SARIF upload permissions, pins zizmor to 1.24.1 via v0.5.6 SHA, and enables fail-fast mode so the job now gates PRs instead of silently passing.
.github/workflows/test-unit-proxy-endpoints.yml	Moves id-token: write and pull-requests: write from workflow-level to per-job permissions, applying least-privilege so future jobs don't inherit elevated permissions by default.
.github/workflows/test_server_root_path.yml	Removes GHA build-cache read/write from the pull_request-triggered Docker build step and makes push: false explicit, eliminating an untrusted-fork cache-poisoning vector.
.github/workflows/codeql.yml	Comment-only fix: corrects the three # v3 tags to # v3.34.1; pinned SHAs are unchanged.
.github/workflows/check-ui-api-types.yml	Comment-only fix: corrects # v5.0 to # v5.0.0 for actions/setup-node; SHA is unchanged.
.github/workflows/test-litellm-ui-build.yml	Comment-only fix: corrects two # v5.0 tags to # v5.0.0 for actions/setup-node; SHAs are unchanged.

_{Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'origin/lit..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[mateo-berri]

LGTM; thanks! Glad it's actually doing something now lol