ci: add OSS daily branch workflow

[ishaan-berri]

Relevant issues

Internal request: create a dated GitHub daily branch flow for OSS PR intake

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Screenshots / Proof of Fix

YAML parse of both workflows on the updated branch:

$ .venv/bin/python -c "import yaml; [print('ok', f.split('/')[-1], list(yaml.safe_load(open(f))['jobs'])) for f in files]"
ok create_daily_oss_branch.yml ['create-oss-branch']
ok oss_daily_guardrails.yml ['oss-safe-checks']

Type

🚄 Infrastructure

Changes

Create Daily OSS Branch creates the dated litellm_oss_daily_YYYY_MM_DD branch from main on a weekday schedule or manual dispatch. OSS Daily Guardrails runs OSS-safe checks for those branches, namely the hardcoded-secret test and ruff. Path-based restrictions for the OSS daily branches are handled through repository settings rather than in this workflow, so the earlier in-workflow file check has been removed

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ yuneng-berri
❌ ishaan-berri
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR adds two new CI workflows to manage a dated OSS daily branch intake flow: one creates litellm_oss_daily_YYYY_MM_DD from main each weekday and one enforces guardrails on those branches by blocking sensitive file changes and running a secret scan + Ruff lint.

• create_daily_oss_branch.yml: schedules branch creation at 16:00 UTC weekdays with manual-dispatch override, validates the date input format, and guards against duplicate branch creation idempotently.
• oss_daily_guardrails.yml: blocks changes to workflows, actions, CI config, dependency manifests, lockfiles, Dockerfiles, and common tool configs; runs test_no_hardcoded_secrets.py and Ruff as OSS-safe checks. Both workflows use pinned action SHAs and persist-credentials: false.

Confidence Score: 5/5

Safe to merge — both workflows are additive CI infrastructure with no effect on existing jobs or production code paths.

Both files are new workflow additions. Security practices are sound: action SHAs are pinned, persist-credentials: false is set, the date input is validated against a strict regex before being embedded in a branch name, and the GITHUB_TOKEN is passed via env rather than inline expression. The blocked-files regex covers workflows, composite actions, dependency manifests, lockfiles, and common tool configs. The base-ref diffing logic correctly uses three-dot syntax to isolate the OSS delta from main/staging drift. The only notable gap is that oss-safe-checks runs concurrently with sensitive-file-guard rather than after it, which wastes runner minutes on already-blocked PRs but has no correctness impact.

.github/workflows/oss_daily_guardrails.yml — the job ordering between sensitive-file-guard and oss-safe-checks is worth a second look.

Important Files Changed

Filename	Overview
.github/workflows/create_daily_oss_branch.yml	New workflow creating dated OSS daily branches from main on a weekday cron or manual dispatch; uses pinned SHA, persist-credentials: false, input validation, and idempotent branch guard.
.github/workflows/oss_daily_guardrails.yml	New guardrails workflow blocking sensitive file changes on OSS daily branches; oss-safe-checks runs concurrently with sensitive-file-guard instead of depending on it, so the expensive test/lint job still runs even when the guard fails.

_{Reviews (2): Last reviewed commit: "ci: add OSS daily branch workflow" | Re-trigger Greptile}

[greptile-apps]

At 16:00 UTC this fires at 9 am PDT (UTC-7) in summer but at 8 am PST (UTC-8) in winter. The comment only documents the DST case, which can mislead reviewers into thinking the schedule is always 9 am PT. Updating it to note both seasons (or picking 17:00 UTC if 9 am year-round is the intent) would make the intent unambiguous.

Suggested change

	- cron: "0 16 * * 1-5" # 9am PT during daylight saving time, weekdays.
	- cron: "0 16 * * 1-5" # 9am PDT (UTC-7) / 8am PST (UTC-8), weekdays. Use 17:00 UTC for year-round 9am PST/PDT.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ishaan-berri]

@greptileai please review the latest head 33aaea3

[codspeed-hq]

Merging this PR will not alter performance

✅ 30 untouched benchmarks

---

_{Comparing litellm_oss_daily_branch_workflow (b4d63c1) with litellm_internal_staging (142d5aa)}