chore(e2e): move the compat-matrix populator from a GCE VM to a Render cron job

.github/workflows/compat-matrix-image.yml

@@ -0,0 +1,33 @@
+name: Compat Matrix Image
+
+on:
+  pull_request:
+    paths:
+      - tests/e2e/claude_code/cron_vm/**
+      - .github/workflows/compat-matrix-image.yml
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  compat-matrix-image:
+    name: compat-matrix-image
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Build the Render cron image
+        run: docker build -f tests/e2e/claude_code/cron_vm/Dockerfile -t compat-matrix:${{ github.sha }} tests/e2e
+
+      - name: Run the pinned binaries as the cron user
+        run: |
+          docker run --rm compat-matrix:${{ github.sha }} bash -c 'set -e; whoami; claude --version; gh --version; uv --version'

tests/e2e/claude_code/cron_vm/Dockerfile

@@ -0,0 +1,41 @@
+FROM debian:bookworm-slim@sha256:3783cc01769c7b2b1b83a5c5ad96c815348e28ed7da68e2e3687004faa906251
+
+ARG GH_VERSION=2.101.0
+ARG GH_SHA256=9bca2d1c16825f109907a23307628a2f0698fbf99662b73a5cf0b020293072b8
+ARG UV_VERSION=0.10.9
+ARG UV_SHA256=20d79708222611fa540b5c9ed84f352bcd3937740e51aacc0f8b15b271c57594
+ARG CLAUDE_CODE_VERSION=2.1.228
+ARG CLAUDE_CODE_SHA256=d535985e6941a3eb00179ccd7f52ceb0c6623a0305a518ebc4e6514f84a94c99
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates curl git jq procps iproute2 \
+ && rm -rf /var/lib/apt/lists/*
+
+RUN curl -fsSLo /tmp/gh.tar.gz "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_linux_amd64.tar.gz" \
+ && echo "${GH_SHA256}  /tmp/gh.tar.gz" | sha256sum -c - \
+ && tar -xzf /tmp/gh.tar.gz -C /usr/local/bin --strip-components=2 "gh_${GH_VERSION}_linux_amd64/bin/gh" \
+ && rm /tmp/gh.tar.gz
+
+RUN curl -fsSLo /tmp/uv.tar.gz "https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-x86_64-unknown-linux-gnu.tar.gz" \
+ && echo "${UV_SHA256}  /tmp/uv.tar.gz" | sha256sum -c - \
+ && tar -xzf /tmp/uv.tar.gz -C /usr/local/bin --strip-components=1 uv-x86_64-unknown-linux-gnu/uv \
+ && rm /tmp/uv.tar.gz
+
+RUN curl -fsSLo /tmp/claude "https://downloads.claude.ai/claude-code-releases/${CLAUDE_CODE_VERSION}/linux-x64/claude" \
+ && echo "${CLAUDE_CODE_SHA256}  /tmp/claude" | sha256sum -c - \
+ && install -m 0755 /tmp/claude /usr/local/bin/claude \
+ && rm /tmp/claude
+
+RUN groupadd --gid 1000 populator && useradd --uid 1000 --gid 1000 --create-home populator
+
+ENV HOME=/home/populator \
+    LITELLM_REPO=/opt/litellm \
+    DISABLE_AUTOUPDATER=1
+
+COPY --chown=populator:populator . /opt/litellm/tests/e2e/
+
+USER populator
+WORKDIR /home/populator
+CMD ["/opt/litellm/tests/e2e/claude_code/cron_vm/run_daily.sh"]

tests/e2e/claude_code/cron_vm/litellm-compat-matrix.env.example

@@ -1,9 +1,8 @@
-# Environment file consumed by `litellm-compat-matrix.service`.
+# Environment variables of the Render cron job `litellm-compat-matrix`.
 #
-# Install at `/etc/litellm-compat-matrix.env` and chmod 0600.
-# `EnvironmentFile=-` in the unit means the service is allowed to start
-# even if this file is missing, but the populator will fail at the
-# first provider request without these credentials.
+# Set every value here on the Render service (Environment tab, or the
+# `envVars` list of the create-service call in README.md). A local run
+# passes a filled-in copy with `docker run --env-file`.
 
 # Anthropic
 ANTHROPIC_API_KEY=
@@ -17,11 +16,12 @@ AWS_BEARER_TOKEN_BEDROCK=
 AWS_REGION_NAME=us-east-1
 
 # Vertex AI (vertex_ai + vertex_ai_gpt columns).
-# On the GCP VM, the default service-account ADC from the metadata server
-# is used -- no JSON key file is needed. If you ever need to run outside
-# GCP, also export GOOGLE_APPLICATION_CREDENTIALS=/path/to/sa.json.
+# The service-account key JSON is the Render secret file
+# `vertex-service-account.json`, mounted at /etc/secrets, and
+# GOOGLE_APPLICATION_CREDENTIALS points google-auth at it.
 VERTEXAI_PROJECT=
 VERTEXAI_LOCATION=global
+GOOGLE_APPLICATION_CREDENTIALS=/etc/secrets/vertex-service-account.json
 
 # Azure AI Foundry (azure column — Claude models on Foundry)
 AZURE_AI_API_KEY=
@@ -35,19 +35,20 @@ AZURE_API_BASE=
 AZURE_API_KEY=
 
 # The publish PAT (mateo-berri, write access on BerriAI/litellm-docs)
-# deliberately does NOT live in this file. Everything here lands in the
-# process environment of pytest, the proxy, and the model-driven claude
-# CLI, where any same-UID reader can lift it from /proc/<pid>/environ.
-# Instead, install the token at /etc/litellm-compat-matrix-github-token
-# (chmod 0600, single line); the service maps it in via systemd
-# LoadCredential and run_daily.sh keeps it out of every child process
-# env. Used to (a) resolve the latest stable release, (b) push the
-# daily compat-matrix branch directly to BerriAI/litellm-docs, (c) open
-# the same-repo PR, and (d) enable squash auto-merge on it. Scopes:
+# deliberately is NOT an env var. Everything here lands in the process
+# environment of pytest, the proxy, and the model-driven claude CLI,
+# where any same-UID reader can lift it from /proc/<pid>/environ.
+# Instead, the token is the Render secret file `github-token` (single
+# line), mounted under CREDENTIALS_DIRECTORY, and run_daily.sh reads it
+# from there and keeps it out of every child process env. Used to
+# (a) resolve the latest stable release, (b) push the daily
+# compat-matrix branch directly to BerriAI/litellm-docs, (c) open the
+# same-repo PR, and (d) enable squash auto-merge on it. Scopes:
 # classic `repo` + `workflow`, or fine-grained on BerriAI/litellm-docs
 # with Contents:RW + Pull requests:RW + Workflows:RW.
 # Manual runs export GITHUB_TOKEN instead, or skip publishing entirely
 # with SKIP_PUBLISH=1 (only writes the matrix JSON locally).
+CREDENTIALS_DIRECTORY=/etc/secrets
 
 # Optional: the bedrock_mantle column is opt-in because the AWS account
 # needs the Mantle (OpenAI-on-Bedrock) models enabled. Without this the
@@ -59,9 +60,9 @@ AZURE_API_KEY=
 # usually run them. Skipped cells are recorded as not_tested.
 # COMPAT_OPENAI_GPT_CELLS=1
 
-# Optional overrides; defaults are sensible for the cron VM.
+# Optional overrides; defaults are sensible for the cron job.
 # PROXY_PORT=4100
-# LITELLM_WORKTREE=/home/mateo/litellm-cron-worktree
+# LITELLM_WORKTREE=/home/populator/litellm-cron-worktree
 # DOCS_REPO=BerriAI/litellm-docs
 # DOCS_BRANCH=main
 # DOCS_TARGET_PATH=src/data/compatibility-matrix.json