chore(ci): tag-triggered Docker release workflow with cosign signing - #8
Merged
Merged
Conversation
Adds .github/workflows/release-docker.yml and scripts/release-tag.sh to automate Docker image releases for this internal fork. Workflow (triggered on v*-internal.* tags): - Multi-arch build (linux/amd64, linux/arm64) pushed to Docker Hub - Three tags per release: immutable internal tag, internal+sha for audit, rolling <base>-stable pointer - cosign keyless signing (GitHub OIDC -> Sigstore Fulcio), signs the immutable digest so all tags inherit the signature - Auto-creates a GitHub Release with changelog (since previous internal tag), Docker pull commands, and cosign verify instructions - Ancestry check: refuses to publish tags not on a ship/* branch scripts/release-tag.sh: convenience script to validate state, generate changelog, and create+push the annotated tag from a ship/* branch. Requires DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets, plus optional docker-release environment for manual approval gating. No cosign key management required (keyless via OIDC).
3 tasks
songkuan-zheng
added a commit
that referenced
this pull request
Jun 4, 2026
* chore(ci): add tag-triggered Docker release workflow with cosign signing Adds .github/workflows/release-docker.yml and scripts/release-tag.sh to automate Docker image releases for this internal fork. Workflow (triggered on v*-internal.* tags): - Multi-arch build (linux/amd64, linux/arm64) pushed to Docker Hub - Three tags per release: immutable internal tag, internal+sha for audit, rolling <base>-stable pointer - cosign keyless signing (GitHub OIDC -> Sigstore Fulcio), signs the immutable digest so all tags inherit the signature - Auto-creates a GitHub Release with changelog (since previous internal tag), Docker pull commands, and cosign verify instructions - Ancestry check: refuses to publish tags not on a ship/* branch scripts/release-tag.sh: convenience script to validate state, generate changelog, and create+push the annotated tag from a ship/* branch. Requires DOCKERHUB_USERNAME and DOCKERHUB_TOKEN secrets, plus optional docker-release environment for manual approval gating. No cosign key management required (keyless via OIDC). * chore(ci): set IMAGE_NAME to zsk2026/litellm * chore(ci): drop environment gating, run on repo secrets only The docker-release environment was re-introduced during merge of #8 but is unconfigured, which would block any tag-triggered run from starting. Remove the environment reference so the workflow runs end-to-end using repo-level DOCKERHUB_USERNAME / DOCKERHUB_TOKEN secrets. If approval gating is wanted later, create the environment in repo Settings and re-add the line. * ci: add SWR (Huawei Cloud) Docker image push workflow Mirrors release-docker.yml trigger (v*-internal.* tags) plus manual workflow_dispatch. Pushes to swr.ap-southeast-3.myhuaweicloud.com/ghisha/litellm with the same three-tag strategy (internal release, +sha, rolling stable). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci(swr): fix workflow_dispatch, support ghisha tag, use ghisha-gateway image name - Skip ship/* branch check on manual dispatch (tag may not be a git tag) - Accept both v*-internal.* and v*-ghisha.* tag triggers - Fix BASE_VERSION extraction to handle both suffixes - Use ghisha-gateway as image name to match Helm chart Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci(swr): inject LITELLM_BUILD_TAG + LITELLM_BUILD_SHA into SWR image build The SWR workflow builds the same ./Dockerfile as release-docker.yml but was missing the build-args, so SWR-pulled deployments would still show the upstream base version in the UI navbar instead of the internal tag. steps.version already extracts tag + git_sha — just pass them through. * chore(release): update fallback URL after repo transfer to GhishaDev The repository was transferred from `songkuan-zheng/litellm` to `GhishaDev/litellm`. Update the fallback URL in `scripts/release-tag.sh` so local invocations (where `$GITHUB_REPOSITORY` is unset) point to the new Actions workflow URL. Everything else remains correct after transfer: - Docker Hub namespace stays at `zsk2026/litellm` by choice; no changes to `.github/workflows/release-docker.yml` or the `zsk2026/litellm` references in `CLAUDE.md`. - `DOCKERHUB_USERNAME` / `DOCKERHUB_TOKEN` secrets migrated with the repo automatically — verified via `gh secret list`. - Fork relationship to `BerriAI/litellm` is preserved. * Update .gitignore * chore(ci): disable all upstream workflows except release-{docker,swr} This fork only needs CI to run on internal release tags. All other inherited workflows either: 1. Filter pull_request.branches to main/litellm_** and silently skip PRs targeting ship/v1.83.10 (effectively dead weight on the Actions UI and bill). 2. Operate on upstream concerns we don't run (daily staging branch, auto price-map update, issue automation, supply-chain scorecard, docs validation, helm chart tests). 3. Are workflow_call helpers only consumed by 1 + 2. Rather than maintain per-file branch-filter overrides on 40+ workflows (each adds upstream-rebase friction), move them to a sibling `.github/workflows.disabled/` directory. GitHub Actions only loads from `.github/workflows/`, so anything under `.disabled/` is dormant but preserved for: - diff against upstream when rebasing - one-line re-enable via `git mv` if a specific workflow is wanted later - reference when investigating "what did upstream test for this code?" Test discipline is enforced locally per CLAUDE.md: - `make lint` + `make test-unit` before commit - `vitest run` for UI changes - `e2e/tools/proxy start` + `e2e/tools/run-all-cases` for e2e Active workflows after this change (2): - release-docker.yml — tag push v*-internal.* publishes Docker Hub image - release-swr.yml — tag push v*-internal.* / v*-ghisha.* mirrors to Huawei Cloud SWR + workflow_dispatch override See .github/workflows.disabled/_README.md for re-enable instructions. * chore(ci): also disable new upstream workflows added since v1.83.10 Upstream added 6 workflows between v1.83.10 and v1.87.0 that are not covered by the original ccda07d disable-list. Move them to .github/workflows.disabled/ to match our policy (only release-docker and release-swr should run in this fork): - create-release-branch.yml - guard-fork-dependencies.yml - mutation-test.yml - test-code-quality.yml - test-semgrep.yml - test-unit-proxy-mgmt-behavior.yml Also dropped via the previous cherry-pick: 9 workflow files upstream deleted between v1.83.10 and v1.87.0 (README.md, llm-translation- testing.yml, publish_to_pypi.yml, read_pyproject_version.yml, results_stats.csv, run_observatory_tests.yml, scan_duplicate_issues.yml, test-litellm.yml, update_release.py). Net result: same posture as ship/v1.83.10 — only release-docker.yml and release-swr.yml remain enabled. Tier: B (CI infra). * chore(ci): disable release-docker workflow (#37) Move .github/workflows/release-docker.yml to .github/workflows.disabled/ so tag pushes no longer trigger the multi-arch Docker build/publish to zsk2026/litellm. --------- Co-authored-by: shadow.zhang <shadow.zhang@algento.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/release-docker.yml— tag-triggered (v*-internal.*) multi-arch Docker build, pushed to Docker Hub, signed with cosign keyless (OIDC), and auto-creates a GitHub Release with changelog + verify instructions.scripts/release-tag.sh— validates branch/worktree state, generates changelog, creates+pushes the annotated git tag from aship/*branch.What the workflow does (3 jobs)
linux/amd64,linux/arm64) viadocker buildx. Three tags per release:IMAGE:v1.83.10-internal.N(immutable)IMAGE:v1.83.10-internal.N-<sha>(audit trail)IMAGE:v1.83.10-stable(rolling pointer)*-internal.*tag, composes release notes with pull commands + cosign verify command, and creates the GitHub Release.Configuration required after merge
IMAGE_NAMEin workflow (currentlysongkuanzheng/litellm) to actual Docker Hub repoDOCKERHUB_USERNAME,DOCKERHUB_TOKENdocker-releaseGitHub Environment with required reviewers for approval gatingTest plan
DOCKERHUB_USERNAMEandDOCKERHUB_TOKENsecrets to repo settingsdocker-releaseenvironment with approval rulesship/v1.83.10, run./scripts/release-tag.sh v1.83.10-internal.1cosign verify --certificate-identity-regexp '^https://github.com/songkuan-zheng/litellm/.github/workflows/release-docker.yml@refs/tags/.*' --certificate-oidc-issuer https://token.actions.githubusercontent.com <IMAGE>@<DIGEST>