🔄 Upstream Sync: LiteLLM v1.83.7-stable

.github/pull_request_template.md

@@ -32,6 +32,13 @@ If you're seeing a delay in your PR being merged, ping the LiteLLM Team on [Slac
 - [ ] **Merge / cherry-pick CI run**  
        Links:
 
+## Screenshots / Proof of Fix
+
+<!-- Include screenshots, screen recordings, or log output demonstrating that your changes work as expected.
+     For bug fixes: show reproduction before the fix and passing behavior after.
+     For new features: show the feature working end-to-end.
+     For UI changes: include before/after screenshots. -->
+
 ## Type
 
 <!-- Select the type of Pull Request -->

.github/workflows/_test-unit-base.yml

@@ -27,6 +27,10 @@ on:
         required: false
         type: number
         default: 10
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -93,4 +97,46 @@ jobs:
             --reruns "${RERUNS}" \
             --reruns-delay 1 \
             --dist=loadscope \
-            --durations=20
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage.xml \
+            --cov-config=pyproject.toml
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/_test-unit-services-base.yml

@@ -27,23 +27,17 @@ on:
         required: false
         type: number
         default: 10
-      enable-redis:
-        description: "Pass Redis Cloud credentials to tests via REDIS_HOST/PORT/PASSWORD env vars"
-        required: false
-        type: boolean
-        default: false
       enable-postgres:
         description: "Start a local Postgres service container and run Prisma migrations"
         required: false
         type: boolean
         default: false
-    secrets:
-      REDIS_HOST:
-        required: false
-      REDIS_PORT:
-        required: false
-      REDIS_PASSWORD:
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
         required: false
+        type: string
+        default: "run"
+    secrets:
       DATABASE_URL:
         required: false
       POSTGRES_USER:
@@ -61,11 +55,8 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     # Environment is derived from the enable-* flags, not caller-controllable.
     # This prevents callers from passing arbitrary environment names to bypass secret scoping.
-    # Note: Postgres service container always starts (GHA limitation), so any Redis job
-    # also needs Postgres secrets → uses integration-redis-postgres, not integration-redis.
     environment: >-
       ${{
-        inputs.enable-redis && 'integration-redis-postgres' ||
         inputs.enable-postgres && 'integration-postgres' ||
         ''
       }}
@@ -141,17 +132,17 @@ jobs:
           WORKERS: ${{ inputs.workers }}
           RERUNS: ${{ inputs.reruns }}
           DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
-          REDIS_HOST: ${{ inputs.enable-redis && secrets.REDIS_HOST || '' }}
-          REDIS_PORT: ${{ inputs.enable-redis && secrets.REDIS_PORT || '' }}
-          REDIS_PASSWORD: ${{ inputs.enable-redis && secrets.REDIS_PASSWORD || '' }}
         run: |
           if [ "${WORKERS}" = "0" ]; then
             poetry run pytest ${TEST_PATH:?} \
               --tb=short -vv \
               --maxfail="${MAX_FAILURES}" \
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
-              --durations=20
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
           else
             poetry run pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -160,5 +151,47 @@ jobs:
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
               --dist=loadscope \
-              --durations=20
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
           fi
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/create-release.yml

@@ -48,7 +48,21 @@ jobs:
             const cosignSection = [
               `## Verify Docker Image Signature`,
               ``,
-              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying:`,
+              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
+              ``,
+              `**Verify using the pinned commit hash (recommended):**`,
+              ``,
+              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
+              ``,
+              '```bash',
+              `cosign verify \\`,
+              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
+              `  ghcr.io/berriai/litellm:${tag}`,
+              '```',
+              ``,
+              `**Verify using the release tag (convenience):**`,
+              ``,
+              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
               ``,
               '```bash',
               `cosign verify \\`,