fix(e2e): batch credentials wiring and compose harness for live proxy suite

[mubashir1osmani]

Relevant issues

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Proxy image litellm:e2e-staging-bf02a4a47f (staging tip bf02a4a47f) via tests/e2e compose on localhost:4000 with real provider keys from tests/e2e/.env (including AWS_BATCH_ROLE_ARN and AWS_BATCH_S3_BUCKET=litellm-e2e-suite-batches)

curl -s http://localhost:4000/health/liveliness
# I'm alive!

Batches suite after secrets + compose harness:

LITELLM_PROXY_URL=http://localhost:4000 LITELLM_MASTER_KEY=sk-1234 \
  uv run pytest tests/e2e/batches/test_batches_e2e.py -v --tb=short -q
# 16 passed in 96.20s

Full core re-run (batches, budgets, management API, access_control, ocr, chat):

# same proxy
# 58 passed, 1 skipped, 4 errors in 684.75s
# 0 failed; 4 errors are Playwright Admin UI (no UI on :3000); 1 skip is reseed without host redis

Type

Test
Bug Fix

Changes

E2e-only. No product litellm/ edits

Wires batch provider secrets into the live e2e suite for Docker compose: deployments register with os.environ/NAME refs and the credential field names the proxy keeps for files/batches (gcs_bucket_name / bucket_name for Vertex; aws_* + s3_bucket_name + aws_batch_role_arn for Bedrock). Compose mirrors AWS_BATCH_S3_BUCKET / AWS_S3_BUCKET_NAME, declares OpenAI/Azure files_settings, short budget rescheduler windows, and Azure + GOOGLE_APPLICATION_CREDENTIALS passthrough

Missing secrets hard-fail (intentionally). There is no provider_env.py and no require_provider_env skip path on tip. The suite does not convert missing-env into pytest.skip; a red run means the gateway or the runner is missing real secrets or the product misrouted. That matches tests/e2e/batches/COVERAGE.md ("never skips"). Early drafts of this branch experimented with skips; those helpers were removed

Batch matrix: Bedrock is unified-only (encoded create_batch unsupported). When managed batches reject provider-scoped list, fall back to unfiltered list and assert the envelope; only provider_fallback may omit membership when the raw provider id is not in the managed list index (documented in-test). Team create waits for /team/info; member_add retries transient team-not-found

Also includes budget reset advances e2e (test_budget_reset_advances_e2e.py) and related budget/management harness hardening under tests/e2e only

[greptile-apps]

Greptile Summary

This PR wires batch provider credentials (Bedrock AWS/S3 fields, Vertex GCS bucket names) into the live e2e compose harness and adds a new budget reset regression suite targeting the #25109 nullable-JSON filter bug. All changes are confined to tests/e2e/; no production litellm/ code is touched.

• docker-compose.yml gains files_settings for OpenAI/Azure, short rescheduler windows (5–10 s), and full env passthrough for AWS/GCS/Vertex/Azure secrets; capabilities.py adds the matching os.environ/ credential refs and narrows Bedrock to unified-only.
• budget_client.py and management_client.py grow _wait_for_team polling loops and add_team_member retry logic to absorb propagation lag between team creation and index readiness.
• test_budget_reset_advances_e2e.py (new) asserts six invariants for the reset path: scheduling at creation, enforcement, strict before < after timestamp advancement, per-window independence, JSON-backed team-member resets, and the non-5xx error-path guard.

Confidence Score: 5/5

Safe to merge — all changes are e2e test infrastructure with no production code edits.

Every changed file lives under tests/e2e/. The credential wiring, compose harness additions, retry hardening, and new budget regression tests are straightforward and well-scoped. No production paths are affected.

The new test_budget_reset_advances_e2e.py has one assertion that may read a zero spend baseline due to async DB writes, which could make that specific guard vacuous in practice.

Important Files Changed

Filename	Overview
tests/e2e/batches/COVERAGE.md	Documentation update: corrects credential field names for Vertex AI and Bedrock, notes Bedrock is unified-only.
tests/e2e/batches/capabilities.py	Adds _env_ref() helper; wires GCS and Bedrock AWS credential fields; narrows BEDROCK_SCENARIOS to unified-only.
tests/e2e/batches/test_batches_e2e.py	Passes provider to assert_file_object for Bedrock bytes=0 accommodation; fixes provider_fallback list assertion with documented early-return.
tests/e2e/budgets/budget_client.py	Adds _wait_for_team polling and add_team_member retry logic to absorb team propagation lag.
tests/e2e/budgets/test_budget_reset_advances_e2e.py	New regression test suite for #25109; multi-window assertion may be vacuous if spend_at_block reads 0.0 before DB flush.
tests/e2e/budgets/test_spend_counter_reseed_e2e.py	Adds _parse_counter for robust Redis value parsing; expands cluster namespace candidates; inlines burst logic with polling.
tests/e2e/budgets/test_tag_budget_e2e.py	Increases max_tokens, extends deadline, handles first-call block — minor robustness improvements.
tests/e2e/budgets/test_team_multi_window_budget_e2e.py	Pins model, increases loop iterations, tightens sleep — timing hardening.
tests/e2e/docker-compose.yml	Adds rescheduler short windows, files_settings for OpenAI/Azure, and full env passthrough for batch provider secrets.
tests/e2e/llm_translation/realtime/test_realtime_pipecat_audio_e2e.py	Adds NLTK punkt_tab skip guard but only catches LookupError; missing nltk package would cause a collection error.
tests/e2e/management/management_client.py	Mirrors budget_client hardening: _wait_for_team polling, add_team_member retry, update_key_models Redis back-off.
tests/e2e/models.py	Adds aws_access_key_id, aws_secret_access_key, and gcs_bucket_name fields to LiteLLMParamsBody.

_{Reviews (2): Last reviewed commit: "fix(e2e): assert managed list fallback b..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_batch_credentials_e2e (5c26ecf) with litellm_internal_staging (bf02a4a)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (77a30a1) during the generation of this report, so bf02a4a was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[mubashir1osmani]

Greptile 3/5 note on tip: the P1 about require_provider_env / provider_env.py / conditional registration is stale relative to current HEAD.

Tip does not ship provider_env.py, does not skip providers in batch_deployments, and does not convert missing secrets to skips. batch_deployments registers every provider in PROVIDERS unconditionally; lifecycle and the three non-lifecycle tests all assume secrets are present and hard-fail via unwrap if the gateway cannot serve the model. That is intentional (see tests/e2e/batches/COVERAGE.md).

An earlier draft of this branch had skip helpers; they were removed so a red result means missing real secrets or a product/routing bug, not a silent skip.

P2 list-assertion gap for provider_fallback was fixed in 5c26ecf483 (unfiltered list + envelope assert; membership skip only when managed filter is unsupported and the id is raw provider-shaped, with an in-test comment).

@greptileai please re-review against current tip.