chore(v1.87.0): port CI workflows + release tooling (Wave 1) - #46
Merged
Conversation
Adds .github/workflows/release-docker.yml and scripts/release-tag.sh to automate Docker image releases for this internal fork. Workflow (triggered on v*-internal.* tags): - Multi-arch build (linux/amd64, linux/arm64) pushed to Docker Hub - Three tags per release: immutable internal tag, internal+sha for audit, rolling <base>-stable pointer - cosign keyless signing (GitHub OIDC -> Sigstore Fulcio), signs the immutable digest so all tags inherit the signature - Auto-creates a GitHub Release with changelog (since previous internal tag), Docker pull commands, and cosign verify instructions - Ancestry check: refuses to publish tags not on a ship/* branch scripts/release-tag.sh: convenience script to validate state, generate changelog, and create+push the annotated tag from a ship/* branch. Requires DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets, plus optional docker-release environment for manual approval gating. No cosign key management required (keyless via OIDC).
The docker-release environment was re-introduced during merge of #8 but is unconfigured, which would block any tag-triggered run from starting. Remove the environment reference so the workflow runs end-to-end using repo-level DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets. If approval gating is wanted later, create the environment in repo Settings and re-add the line.
Mirrors release-docker.yml trigger (v*-internal.* tags) plus manual workflow_dispatch. Pushes to swr.ap-southeast-3.myhuaweicloud.com/ghisha/litellm with the same three-tag strategy (internal release, +sha, rolling stable). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…y image name - Skip ship/* branch check on manual dispatch (tag may not be a git tag) - Accept both v*-internal.* and v*-ghisha.* tag triggers - Fix BASE_VERSION extraction to handle both suffixes - Use ghisha-gateway as image name to match Helm chart Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…build The SWR workflow builds the same ./Dockerfile as release-docker.yml but was missing the build-args, so SWR-pulled deployments would still show the upstream base version in the UI navbar instead of the internal tag. steps.version already extracts tag + git_sha — just pass them through.
The repository was transferred from `songkuan-zheng/litellm` to `GhishaDev/litellm`. Update the fallback URL in `scripts/release-tag.sh` so local invocations (where `$GITHUB_REPOSITORY` is unset) point to the new Actions workflow URL. Everything else remains correct after transfer: - Docker Hub namespace stays at `zsk2026/litellm` by choice; no changes to `.github/workflows/release-docker.yml` or the `zsk2026/litellm` references in `CLAUDE.md`. - `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN` secrets migrated with the repo automatically — verified via `gh secret list`. - Fork relationship to `BerriAI/litellm` is preserved.
This fork only needs CI to run on internal release tags. All other
inherited workflows either:
1. Filter pull_request.branches to main/litellm_** and silently skip
PRs targeting ship/v1.83.10 (effectively dead weight on the Actions
UI and bill).
2. Operate on upstream concerns we don't run (daily staging branch,
auto price-map update, issue automation, supply-chain scorecard,
docs validation, helm chart tests).
3. Are workflow_call helpers only consumed by 1 + 2.
Rather than maintain per-file branch-filter overrides on 40+ workflows
(each adds upstream-rebase friction), move them to a sibling
`.github/workflows.disabled/` directory. GitHub Actions only loads from
`.github/workflows/`, so anything under `.disabled/` is dormant but
preserved for:
- diff against upstream when rebasing
- one-line re-enable via `git mv` if a specific workflow is wanted later
- reference when investigating "what did upstream test for this code?"
Test discipline is enforced locally per CLAUDE.md:
- `make lint` + `make test-unit` before commit
- `vitest run` for UI changes
- `e2e/tools/proxy start` + `e2e/tools/run-all-cases` for e2e
Active workflows after this change (2):
- release-docker.yml — tag push v*-internal.* publishes Docker Hub image
- release-swr.yml — tag push v*-internal.* / v*-ghisha.* mirrors to
Huawei Cloud SWR + workflow_dispatch override
See .github/workflows.disabled/_README.md for re-enable instructions.
Upstream added 6 workflows between v1.83.10 and v1.87.0 that are not covered by the original ccda07d disable-list. Move them to .github/workflows.disabled/ to match our policy (only release-docker and release-swr should run in this fork): - create-release-branch.yml - guard-fork-dependencies.yml - mutation-test.yml - test-code-quality.yml - test-semgrep.yml - test-unit-proxy-mgmt-behavior.yml Also dropped via the previous cherry-pick: 9 workflow files upstream deleted between v1.83.10 and v1.87.0 (README.md, llm-translation- testing.yml, publish_to_pypi.yml, read_pyproject_version.yml, results_stats.csv, run_observatory_tests.yml, scan_duplicate_issues.yml, test-litellm.yml, update_release.py). Net result: same posture as ship/v1.83.10 — only release-docker.yml and release-swr.yml remain enabled. Tier: B (CI infra).
Move .github/workflows/release-docker.yml to .github/workflows.disabled/ so tag pushes no longer trigger the multi-arch Docker build/publish to zsk2026/litellm.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tier classification
litellm_extras/only)litellm/corelitellm/coreIf Tier C or D, did you try upstream first?
Summary
First wave of the v1.87.0 version bump. Ports our internal CI workflow
chain + release tooling onto the new
ship/v1.87.0branch.Net policy posture matches
ship/v1.83.10: onlyrelease-swr.ymlruns by default.
release-docker.ymlis disabled during the bump(re-enable when cutting
v1.87.0-internal.1).Cherry-picks (chronological, 9 commits)
d4af687157dc4d466e160c3d6d0fa4fdfb29196abc4e02b2c5f41261ef642c93b7bccd3eeea37894417a9fc2edBridge commits (new, not on ship/v1.83.10)
a65b2f4607chore(ci): also disable new upstream workflows added since v1.83.10Upstream added 6 workflows between v1.83.10 and v1.87.0 (not covered by
the original disable-list). This commit moves them to
.disabled/:create-release-branch.ymlguard-fork-dependencies.ymlmutation-test.ymltest-code-quality.ymltest-semgrep.ymltest-unit-proxy-mgmt-behavior.ymlAlso dropped during the
417a9fc2edcherry-pick: 9 workflow filesupstream deleted between v1.83.10 and v1.87.0 (resolved as rename/delete
conflicts).
Last commit
e3a5d5185achore(ci): disable release-docker workflow (#37)Matches the production posture on
ship/v1.83.10(re-enable when readyto publish
v1.87.0-internal.1).Verification
```bash
Workflows currently runnable
ls .github/workflows/
→ release-swr.yml (only this; release-docker.yml moved to .disabled/)
Disabled workflows
ls .github/workflows.disabled/ | wc -l
→ 45 (matches ship/v1.83.10's 48 minus 9 upstream-deleted plus 6 new upstream)
```
Pre-Submission checklist
litellm/core touched.make test-unitunaffected.Type
🚄 Infrastructure