ci: align CI/workflows with litellm_internal_staging

Sync CI configs with upstream/litellm_internal_staging: - Migrate from Poetry to uv (PR #25007) - Pull in zizmor security fixes for workflows - Add isolated unit test workflows + reusable bases - Drop redundant matrix workflow and azure-batches workflow - Drop .circleci/requirements.txt (replaced by uv lockfile)
2026-04-25 15:09:00 -03:00 · 2026-04-25 15:09:00 -03:00 · f118ecc1b6
commit f118ecc1b6
parent 384cfdad47
30 changed files with 1329 additions and 2633 deletions
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
--- a/.circleci/requirements.txt
+++ b/.circleci/requirements.txt
@ -1,21 +0,0 @@
-# used by CI/CD testing
-openai==1.100.1
-python-dotenv
-tiktoken
-importlib_metadata
-cohere
-redis==5.2.1
-redisvl==0.4.1
-anthropic
-orjson==3.10.15 # fast /embedding responses
-pydantic==2.12.5
-google-cloud-aiplatform==1.133.0
-google-cloud-iam==2.19.1
-fastapi-sso==0.16.0 
-uvloop==0.21.0
-mcp==1.26.0    # for MCP server
-semantic_router==0.1.10 # for auto-routing with litellm
-fastuuid==0.14.0
-responses==0.25.7  # for proxy client tests
-pytest-retry==1.6.3  # for automatic test retries
-litellm-proxy-extras  # for prisma migrations
--- a/.github/workflows/_test-unit-base.yml
+++ b/.github/workflows/_test-unit-base.yml
@ -27,6 +27,10 @@ on:
        required: false
        type: number
        default: 10
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: true
+        type: string

 permissions:
  contents: read
@ -47,37 +51,30 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

-      - name: Cache Poetry dependencies
+      - name: Cache uv dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
+            ~/.cache/uv
            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-poetry-
+            ${{ runner.os }}-uv-

      - name: Install dependencies
        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

      - name: Generate Prisma client
        env:
          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Run tests
        env:
@ -86,11 +83,53 @@ jobs:
          WORKERS: ${{ inputs.workers }}
          RERUNS: ${{ inputs.reruns }}
        run: |
-          poetry run pytest ${TEST_PATH:?} \
+          uv run --no-sync pytest ${TEST_PATH:?} \
            --tb=short -vv \
            --maxfail="${MAX_FAILURES}" \
            -n "${WORKERS}" \
            --reruns "${RERUNS}" \
            --reruns-delay 1 \
            --dist=loadscope \
-            --durations=20
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage.xml \
+            --cov-config=pyproject.toml
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false
--- a/.github/workflows/_test-unit-services-base.yml
+++ b/.github/workflows/_test-unit-services-base.yml
@ -27,55 +27,44 @@ on:
        required: false
        type: number
        default: 10
-      enable-redis:
-        description: "Pass Redis Cloud credentials to tests via REDIS_HOST/PORT/PASSWORD env vars"
-        required: false
-        type: boolean
-        default: false
      enable-postgres:
        description: "Start a local Postgres service container and run Prisma migrations"
        required: false
        type: boolean
        default: false
-    secrets:
-      REDIS_HOST:
+      dist:
+        description: "pytest-xdist distribution mode (loadscope|load|worksteal|loadfile|no)"
        required: false
-      REDIS_PORT:
-        required: false
-      REDIS_PASSWORD:
-        required: false
-      DATABASE_URL:
-        required: false
-      POSTGRES_USER:
-        required: false
-      POSTGRES_PASSWORD:
+        type: string
+        default: "loadscope"
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
        required: false
+        type: string
+        default: "run"

 permissions:
  contents: read

+# The postgres service container below is spawned per-job on localhost and
+# destroyed with the job. Nothing outside the runner can reach it. The
+# user/password/database here are not secrets — they're bootstrap values
+# for a throwaway container — so we hardcode them instead of attaching
+# every matrix shard to a GHA environment just to read three "secrets"
+# (which also produces a "temporarily deployed to …" notification on the
+# PR timeline per shard per push).
 jobs:
  run:
    name: Run tests
    runs-on: ubuntu-latest
    timeout-minutes: ${{ inputs.timeout-minutes }}
-    # Environment is derived from the enable-* flags, not caller-controllable.
-    # This prevents callers from passing arbitrary environment names to bypass secret scoping.
-    # Note: Postgres service container always starts (GHA limitation), so any Redis job
-    # also needs Postgres secrets → uses integration-redis-postgres, not integration-redis.
-    environment: >-
-      ${{
-        inputs.enable-redis && 'integration-redis-postgres' ||
-        inputs.enable-postgres && 'integration-postgres' ||
-        ''
-      }}

    services:
      postgres:
        image: postgres@sha256:705a5d5b5836f3fcba0d02c4d281e6a7dd9ed2dd4078640f08a1e1e9896e097d # postgres:14
        env:
-          POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-          POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+          POSTGRES_USER: litellm
+          POSTGRES_PASSWORD: litellm
          POSTGRES_DB: litellm_test
        ports:
          - 5432:5432
@ -95,44 +84,37 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

-      - name: Cache Poetry dependencies
+      - name: Cache uv dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
+            ~/.cache/uv
            .venv
-          key: ${{ runner.os }}-poetry-services-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-uv-services-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-poetry-services-
+            ${{ runner.os }}-uv-services-

      - name: Install dependencies
        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

      - name: Generate Prisma client
        env:
          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Run Prisma migrations
        if: ${{ inputs.enable-postgres }}
        env:
-          DATABASE_URL: ${{ secrets.DATABASE_URL }}
+          DATABASE_URL: "postgresql://litellm:litellm@localhost:5432/litellm_test"
        run: |
-          poetry run prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss
+          uv run --no-sync prisma db push --schema litellm/proxy/schema.prisma --accept-data-loss

      - name: Run tests
        env:
@ -140,25 +122,68 @@ jobs:
          MAX_FAILURES: ${{ inputs.max-failures }}
          WORKERS: ${{ inputs.workers }}
          RERUNS: ${{ inputs.reruns }}
-          DATABASE_URL: ${{ inputs.enable-postgres && secrets.DATABASE_URL || '' }}
-          REDIS_HOST: ${{ inputs.enable-redis && secrets.REDIS_HOST || '' }}
-          REDIS_PORT: ${{ inputs.enable-redis && secrets.REDIS_PORT || '' }}
-          REDIS_PASSWORD: ${{ inputs.enable-redis && secrets.REDIS_PASSWORD || '' }}
+          DIST: ${{ inputs.dist }}
+          DATABASE_URL: ${{ inputs.enable-postgres && 'postgresql://litellm:litellm@localhost:5432/litellm_test' || '' }}
        run: |
          if [ "${WORKERS}" = "0" ]; then
-            poetry run pytest ${TEST_PATH:?} \
+            uv run --no-sync pytest ${TEST_PATH:?} \
              --tb=short -vv \
              --maxfail="${MAX_FAILURES}" \
              --reruns "${RERUNS}" \
              --reruns-delay 1 \
-              --durations=20
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
          else
-            poetry run pytest ${TEST_PATH:?} \
+            uv run --no-sync pytest ${TEST_PATH:?} \
              --tb=short -vv \
              --maxfail="${MAX_FAILURES}" \
              -n "${WORKERS}" \
              --reruns "${RERUNS}" \
              --reruns-delay 1 \
-              --dist=loadscope \
-              --durations=20
+              --dist="${DIST}" \
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
          fi
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false
--- a/.github/workflows/auto_update_price_and_context_window.yml
+++ b/.github/workflows/auto_update_price_and_context_window.yml
@ -17,12 +17,13 @@ jobs:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false
-      - name: Install Dependencies
-        run: |
-          pip install 'aiohttp==3.13.3'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
      - name: Update JSON Data
        run: |
-          python ".github/workflows/auto_update_price_and_context_window_file.py"
+          uv run --frozen --with 'aiohttp==3.13.3' python ".github/workflows/auto_update_price_and_context_window_file.py"
      - name: Create Pull Request
        run: |
          git add model_prices_and_context_window.json 
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@ -48,7 +48,21 @@ jobs:
            const cosignSection = [
              `## Verify Docker Image Signature`,
              ``,
-              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). To verify the integrity of an image before deploying:`,
+              `All LiteLLM Docker images are signed with [cosign](https://docs.sigstore.dev/cosign/overview/). Every release is signed with the same key introduced in [commit \`0112e53\`](https://github.com/BerriAI/litellm/commit/0112e53046018d726492c814b3644b7d376029d0).`,
+              ``,
+              `**Verify using the pinned commit hash (recommended):**`,
+              ``,
+              `A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:`,
+              ``,
+              '```bash',
+              `cosign verify \\`,
+              `  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \\`,
+              `  ghcr.io/berriai/litellm:${tag}`,
+              '```',
+              ``,
+              `**Verify using the release tag (convenience):**`,
+              ``,
+              `Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:`,
              ``,
              '```bash',
              `cosign verify \\`,
@ -88,6 +102,17 @@ jobs:
                body: updatedBody,
                draft: false,
              });
+
            } catch (error) {
              core.setFailed(error.message);
            }
+
+  create-branch:
+    name: Create Release Branch
+    needs: release
+    permissions:
+      contents: write
+    uses: ./.github/workflows/create-release-branch.yml
+    with:
+      tag: ${{ inputs.tag }}
+      commit_hash: ${{ inputs.commit_hash }}
--- a/.github/workflows/llm-translation-testing.yml
+++ b/.github/workflows/llm-translation-testing.yml
@ -29,28 +29,27 @@ jobs:
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
-          python-version: "3.11"
+          python-version: "3.12"

-      - name: Install Poetry
-        run: |
-          pip install 'poetry==2.3.2'
-          poetry config virtualenvs.create true
-          poetry config virtualenvs.in-project true
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false

-      - name: Restore Poetry dependencies cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
+      - name: Restore uv dependencies cache
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
-            ~/.cache/pypoetry
+            ~/.cache/uv
            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-poetry-
+            ${{ runner.os }}-uv-

      - name: Install dependencies
        run: |
-          poetry install --with dev
-          poetry run pip install 'pytest-xdist==3.8.0' 'pytest-timeout==2.4.0'
+          uv sync --frozen

      - name: Create test results directory
        run: mkdir -p test-results
--- a/.github/workflows/publish_to_pypi.yml
+++ b/.github/workflows/publish_to_pypi.yml
@ -24,10 +24,22 @@ jobs:
        with:
          python-version: "3.12"

+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
      - name: Check litellm version on PyPI
        id: check-litellm
        run: |
-          VERSION=$(grep -m1 '^version' pyproject.toml | sed 's/version = "\(.*\)"/\1/')
+          VERSION=$(python - <<'PY'
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              print(tomllib.load(f)["project"]["version"])
+          PY
+          )
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Checking if litellm $VERSION exists on PyPI..."

@ -42,43 +54,46 @@ jobs:

      - name: Sanity check proxy-extras version
        run: |
-          # Read pinned version from requirements.txt
-          REQ_VERSION=$(grep -oP 'litellm-proxy-extras==\K[0-9.]+' requirements.txt)
-          if [ -z "$REQ_VERSION" ]; then
-            echo "::error::Could not find litellm-proxy-extras version in requirements.txt"
-            exit 1
-          fi
-          echo "requirements.txt pins litellm-proxy-extras==$REQ_VERSION"
+          # Read pinned version from project optional dependencies
+          PYPROJECT_VERSION=$(python3 - <<'PY'
+          import sys
+          import tomllib

-          # Read pinned version from pyproject.toml dependency
-          PYPROJECT_VERSION=$(python3 -c "
-          import re
-          with open('pyproject.toml') as f:
-              content = f.read()
-          match = re.search(r'litellm-proxy-extras\s*=\s*\{version\s*=\s*\"([^\"]+)\"', content)
-          if match:
-              print(match.group(1).lstrip('^~>='))
-          else:
-              import sys
-              print('::error::Could not find litellm-proxy-extras dependency in pyproject.toml', file=sys.stderr)
+          with open("pyproject.toml", "rb") as f:
+              proxy_requirements = tomllib.load(f)["project"]["optional-dependencies"]["proxy"]
+
+          version = None
+          for requirement in proxy_requirements:
+              normalized = requirement.split(";", 1)[0].strip()
+              if not normalized.startswith("litellm-proxy-extras"):
+                  continue
+              parts = normalized.split("==", 1)
+              if len(parts) == 2 and parts[0].strip() == "litellm-proxy-extras":
+                  candidate = parts[1].strip()
+                  if candidate:
+                      version = candidate
+                      break
+
+          if version is None:
+              print(
+                  "::error::Could not find an exact litellm-proxy-extras pin in project.optional-dependencies.proxy",
+                  file=sys.stderr,
+              )
              sys.exit(1)
-          ")
+
+          print(version)
+          PY
+          )
          echo "pyproject.toml pins litellm-proxy-extras version: $PYPROJECT_VERSION"

-          # Check that both pinned versions match
-          if [ "$REQ_VERSION" != "$PYPROJECT_VERSION" ]; then
-            echo "::error::Version mismatch: requirements.txt has $REQ_VERSION but pyproject.toml has $PYPROJECT_VERSION"
-            exit 1
-          fi
-
          # Check that the pinned version exists on PyPI
-          echo "Checking if litellm-proxy-extras $REQ_VERSION exists on PyPI..."
-          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$REQ_VERSION/json")
+          echo "Checking if litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI..."
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/litellm-proxy-extras/$PYPROJECT_VERSION/json")
          if [ "$HTTP_STATUS" != "200" ]; then
-            echo "::error::litellm-proxy-extras $REQ_VERSION is not published on PyPI yet. Publish it before releasing litellm."
+            echo "::error::litellm-proxy-extras $PYPROJECT_VERSION is not published on PyPI yet. Publish it before releasing litellm."
            exit 1
          fi
-          echo "litellm-proxy-extras $REQ_VERSION exists on PyPI. Sanity check passed."
+          echo "litellm-proxy-extras $PYPROJECT_VERSION exists on PyPI. Sanity check passed."

  publish-litellm:
    name: Publish litellm to PyPI
@ -100,16 +115,19 @@ jobs:
        with:
          python-version: "3.12"

+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+          enable-cache: false
+
      - name: Copy model prices backup
        run: cp model_prices_and_context_window.json litellm/model_prices_and_context_window_backup.json

-      - name: Install build tools
-        run: python -m pip install --upgrade pip build==1.4.2
-
      - name: Build package
        run: |
          rm -rf build dist
-          python -m build
+          uv build

      - name: Verify build artifacts
        env:
@ -129,8 +147,7 @@ jobs:

      - name: Validate package metadata
        run: |
-          pip install twine==6.2.0
-          twine check dist/*
+          uv tool run --from 'twine==6.2.0' twine check dist/*

      - name: Publish to PyPI
        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
--- a/.github/workflows/scan_duplicate_issues.yml
+++ b/.github/workflows/scan_duplicate_issues.yml
@ -29,7 +29,7 @@ jobs:
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
-          python-version: "3.13"
+          python-version: "3.12"

      - name: Scan for duplicate issues
        env:
--- a/.github/workflows/test-linting.yml
+++ b/.github/workflows/test-linting.yml
@ -2,7 +2,11 @@ name: LiteLLM Linting

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
@ -24,26 +28,28 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

      - name: Clean Python cache
        run: |
          find . -type d -name "__pycache__" -exec rm -rf {} + || true
          find . -name "*.pyc" -delete || true

-      - name: Check poetry.lock is up to date
+      - name: Check uv.lock is up to date
        run: |
-          poetry check --lock || (echo "❌ poetry.lock is out of sync with pyproject.toml. Run 'poetry lock' locally and commit the result." && exit 1)
+          uv lock --check || (echo "❌ uv.lock is out of sync with pyproject.toml. Run 'uv lock' locally and commit the result." && exit 1)

      - name: Install dependencies
        run: |
-          poetry install --with dev
+          uv sync --frozen

      - name: Check Black formatting
        run: |
          cd litellm
-          poetry run black --check --exclude '/enterprise/' .
+          uv run --no-sync black --check --exclude '/enterprise/' .
          cd ..

      - name: Debug - Check file state
@ -58,28 +64,28 @@ jobs:
      - name: Run Ruff linting
        run: |
          cd litellm
-          poetry run ruff check .
+          uv run --no-sync ruff check .
          cd ..

      - name: Print OpenAI version
        run: |
-          poetry run python -c "import openai; print(f'OpenAI version: {openai.__version__}')"
+          uv run --no-sync python -c "import openai; print(f'OpenAI version: {openai.__version__}')"

      - name: Run MyPy type checking
        run: |
          cd litellm
-          poetry run mypy . 
+          uv run --no-sync mypy .
          cd ..

      - name: Check for circular imports
        run: |
          cd litellm
-          poetry run python ../tests/documentation_tests/test_circular_imports.py
+          uv run --no-sync python ../tests/documentation_tests/test_circular_imports.py
          cd ..

      - name: Check import safety
        run: |
-          poetry run python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)
+          uv run --no-sync python -c "from litellm import *" || (echo '🚨 import failed, this means you introduced unprotected imports! 🚨'; exit 1)

  secret-scan:
    runs-on: ubuntu-latest
@ -98,18 +104,21 @@ jobs:
        with:
          python-version: "3.12"

+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"
+
      - name: Run secret scan test
        run: |
-          pip install 'pytest==9.0.2'
-          pytest tests/litellm/test_no_hardcoded_secrets.py -v
+          uv run --frozen --with 'pytest==9.0.2' pytest tests/litellm/test_no_hardcoded_secrets.py -v

      - name: Run ggshield secret scan
        env:
          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
        run: |
          if [ -n "$GITGUARDIAN_API_KEY" ]; then
-            pip install 'ggshield==1.48.0'
-            ggshield secret scan repo .
+            uv tool run --from 'ggshield==1.48.0' ggshield secret scan repo .
          else
            echo "GITGUARDIAN_API_KEY not set, skipping ggshield scan"
          fi
--- a/.github/workflows/test-litellm-matrix.yml
+++ b/.github/workflows/test-litellm-matrix.yml
@ -1,214 +0,0 @@
-name: LiteLLM Unit Tests (Matrix)
-
-on:
-  pull_request:
-    branches: [main]
-
-permissions:
-  contents: read
-
-# Cancel in-progress runs for the same PR
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20 # Increased from 15 to 20
-    strategy:
-      fail-fast: false
-      matrix:
-        test-group:
-          # tests/test_litellm split by subdirectory (~560 files total)
-          # Vertex AI tests separated for better isolation (prevent auth/env pollution)
-          - name: "llms-vertex"
-            path: "tests/test_litellm/llms/vertex_ai"
-            workers: 1
-            reruns: 2
-          - name: "llms-other"
-            path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
-            workers: 2
-            reruns: 2
-          # tests/test_litellm/proxy split by subdirectory (~180 files total)
-          - name: "proxy-guardrails"
-            path: "tests/test_litellm/proxy/guardrails tests/test_litellm/proxy/management_endpoints tests/test_litellm/proxy/management_helpers"
-            workers: 2
-            reruns: 2
-          - name: "proxy-core"
-            path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/client tests/test_litellm/proxy/db tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine"
-            workers: 2
-            reruns: 2
-          - name: "proxy-misc"
-            path: "tests/test_litellm/proxy/_experimental tests/test_litellm/proxy/agent_endpoints tests/test_litellm/proxy/anthropic_endpoints tests/test_litellm/proxy/common_utils tests/test_litellm/proxy/discovery_endpoints tests/test_litellm/proxy/experimental tests/test_litellm/proxy/google_endpoints tests/test_litellm/proxy/health_endpoints tests/test_litellm/proxy/image_endpoints tests/test_litellm/proxy/middleware tests/test_litellm/proxy/openai_files_endpoint tests/test_litellm/proxy/pass_through_endpoints tests/test_litellm/proxy/prompts tests/test_litellm/proxy/public_endpoints tests/test_litellm/proxy/response_api_endpoints tests/test_litellm/proxy/spend_tracking tests/test_litellm/proxy/ui_crud_endpoints tests/test_litellm/proxy/vector_store_endpoints tests/test_litellm/proxy/test_*.py"
-            workers: 2
-            reruns: 2
-          - name: "integrations"
-            path: "tests/test_litellm/integrations"
-            workers: 2
-            reruns: 3 # Integration tests tend to be flakier
-          - name: "core-utils"
-            path: "tests/test_litellm/litellm_core_utils"
-            workers: 2
-            reruns: 1
-          - name: "other-1"
-            # responses (5942) + caching (1723) + types (819) ≈ 8.5k lines
-            path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
-            workers: 2
-            reruns: 2
-          - name: "other-2"
-            # enterprise (3062) + google_genai (2511) + router_utils (1982) ≈ 7.6k lines
-            path: "tests/test_litellm/enterprise tests/test_litellm/google_genai tests/test_litellm/router_utils"
-            workers: 2
-            reruns: 2
-          - name: "other-3"
-            # remaining dirs ≈ 8.0k lines
-            path: "tests/test_litellm/router_strategy tests/test_litellm/secret_managers tests/test_litellm/a2a_protocol tests/test_litellm/anthropic_interface tests/test_litellm/completion_extras tests/test_litellm/containers tests/test_litellm/experimental_mcp_client tests/test_litellm/images tests/test_litellm/interactions tests/test_litellm/passthrough tests/test_litellm/vector_stores"
-            workers: 2
-            reruns: 2
-          - name: "root"
-            path: "tests/test_litellm/test_*.py"
-            workers: 2
-            reruns: 2
-          # tests/proxy_unit_tests split alphabetically (~48 files total)
-          - name: "proxy-unit-a1"
-            # test_[a-j]*.py: jwt (1564) + auth_checks (978) + google_gemini (478) + e2e_pod_lock (437) + rest
-            path: "tests/proxy_unit_tests/test_[a-j]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-a2"
-            # test_[k-o]*.py: key_generate_prisma (4346) + key_generate_dynamodb + models_fallback
-            path: "tests/proxy_unit_tests/test_[k-o]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b1"
-            # lighter config/utility proxy tests (prisma, project, prompt, proxy_[c-r]*)
-            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_project*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b2"
-            # proxy_server.py alone (2750 lines) - isolated to avoid blocking smaller tests
-            path: "tests/proxy_unit_tests/test_proxy_server.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b3"
-            # proxy_server_* (618) + proxy_setting_guardrails (71) - smaller server-related tests
-            path: "tests/proxy_unit_tests/test_proxy_server_*.py tests/proxy_unit_tests/test_proxy_setting_guardrails.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b4"
-            # proxy_utils.py alone (2339 lines) - isolated to avoid blocking token counter
-            path: "tests/proxy_unit_tests/test_proxy_utils.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b5"
-            # proxy_token_counter (1279) - runs independently from utils
-            path: "tests/proxy_unit_tests/test_proxy_token_counter.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b6"
-            # test_[r-t]*.py: response_polling (1399) + search_api_logging (202) + server_root (64) + skills_db (261) + realtime_cache (62)
-            path: "tests/proxy_unit_tests/test_[r-t]*.py"
-            workers: 2
-            reruns: 1
-          - name: "proxy-unit-b7"
-            # test_[u-z]*.py: user_api_key_auth (1136) + zero_cost (590) + update_spend (305) + unit_test_* (206) + ui_path (157)
-            path: "tests/proxy_unit_tests/test_[u-z]*.py"
-            workers: 2
-            reruns: 1
-
-    name: test (${{ matrix.test-group.name }})
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
-
-      - name: Cache Poetry dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
-        with:
-          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
-            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-poetry-
-
-      - name: Install dependencies
-        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          # pytest-rerunfailures and pytest-xdist are in pyproject.toml dev dependencies
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
-
-      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
-        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Run tests - ${{ matrix.test-group.name }}
-        run: |
-          poetry run pytest ${{ matrix.test-group.path }} \
-            --tb=short -vv \
-            --maxfail=10 \
-            -n ${{ matrix.test-group.workers }} \
-            --reruns ${{ matrix.test-group.reruns }} \
-            --reruns-delay 1 \
-            --dist=loadscope \
-            --durations=20 \
-            --cov=litellm \
-            --cov-report=xml:coverage-${{ matrix.test-group.name }}.xml \
-            --cov-config=pyproject.toml
-
-      - name: Save coverage report
-        if: always()
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
-        with:
-          name: coverage-${{ matrix.test-group.name }}
-          path: coverage-${{ matrix.test-group.name }}.xml
-          retention-days: 1
-
-  upload-coverage:
-    name: Upload coverage to Codecov
-    needs: test
-    if: always()
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write        # Required for OIDC tokenless upload
-      pull-requests: write   # Required for Codecov PR comments
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-
-      - name: Download all coverage reports
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
-        with:
-          pattern: coverage-*
-          path: coverage-reports
-          merge-multiple: true
-
-      - name: Upload to Codecov
-        uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4
-        with:
-          use_oidc: true
-          directory: coverage-reports
-          root_dir: ${{ github.workspace }}
-          fail_ci_if_error: false
--- a/.github/workflows/test-litellm.yml
+++ b/.github/workflows/test-litellm.yml
@ -31,23 +31,15 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

      - name: Install dependencies
        run: |
-          poetry lock
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install "pytest-retry==1.6.3"
-          poetry run pip install 'pytest-xdist==3.8.0'
-          poetry run pip install "google-genai==1.22.0"
-          poetry run pip install "google-cloud-aiplatform==1.115.0"
-          poetry run pip install "fastapi-offline==1.7.3"
-          poetry run pip install "python-multipart==0.0.22"
-          poetry run pip install "openapi-core==0.23.0"
-      - name: Setup litellm-enterprise as local package
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv lock --check
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router
      - name: Run tests
        run: |
-          poetry run pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50
+          uv run --no-sync pytest tests/test_litellm --tb=short -vv --maxfail=10 -n 4 --durations=50
--- a/.github/workflows/test-mcp.yml
+++ b/.github/workflows/test-mcp.yml
@ -2,7 +2,11 @@ name: LiteLLM MCP Tests (folder - tests/mcp_tests)

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
@ -27,26 +31,16 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

      - name: Install dependencies
        run: |
-          poetry lock
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install "pytest==7.3.1"
-          poetry run pip install "pytest-retry==1.6.3"
-          poetry run pip install "pytest-cov==5.0.0"
-          poetry run pip install "pytest-asyncio==0.21.1"
-          poetry run pip install "respx==0.22.0"
-          poetry run pip install "pydantic==2.11.0"
-          poetry run pip install "mcp==1.25.0"
-          poetry run pip install 'pytest-xdist==3.8.0'
-
-      - name: Setup litellm-enterprise as local package
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv lock --check
+          uv sync --frozen --group proxy-dev --extra proxy --extra semantic-router

      - name: Run MCP tests
        run: |
-          poetry run pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5
+          uv run --no-sync pytest tests/mcp_tests -x -vv -n 4 --cov=litellm --cov-report=xml --durations=5
--- a/.github/workflows/test-model-map.yaml
+++ b/.github/workflows/test-model-map.yaml
@ -2,7 +2,11 @@ name: Validate model_prices_and_context_window.json

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
--- a/.github/workflows/test-proxy-e2e-azure-batches.yml
+++ b/.github/workflows/test-proxy-e2e-azure-batches.yml
@ -1,97 +0,0 @@
-name: Proxy E2E Azure Batches Tests
-
-on:
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  proxy_e2e_azure_batches_tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-
-    services:
-      postgres:
-        image: postgres:15
-        env:
-          POSTGRES_USER: llmproxy
-          POSTGRES_PASSWORD: dbpassword9090
-          POSTGRES_DB: litellm
-        ports:
-          - 5432:5432
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: "3.12"
-
-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
-
-      - name: Cache Poetry dependencies
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.0.0
-        with:
-          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
-            .venv
-          key: ${{ runner.os }}-poetry-e2e-batches-${{ hashFiles('poetry.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-poetry-e2e-batches-
-            ${{ runner.os }}-poetry-
-
-      - name: Install dependencies
-        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy"
-          poetry run pip install psycopg2-binary==2.9.11 uvicorn==0.42.0 fastapi==0.135.2 httpx==0.28.1 tenacity==9.1.4
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
-
-      - name: Generate Prisma client
-        env:
-          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
-        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
-
-      - name: Run Prisma migrations
-        env:
-          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-        run: |
-          cd litellm/proxy
-          poetry run prisma migrate deploy --schema schema.prisma
-          cd ../..
-
-      - name: Run Azure Batch E2E Tests
-        env:
-          DATABASE_URL: postgresql://llmproxy:dbpassword9090@localhost:5432/litellm
-          USE_LOCAL_LITELLM: "true"
-          USE_MOCK_MODELS: "true"
-          USE_STATE_TRACKER: "true"
-          LITELLM_LOG: DEBUG
-        run: |
-          poetry run pytest tests/proxy_e2e_azure_batches_tests/test_proxy_e2e_azure_batches.py \
-            -vv -s -k "test_e2e_managed_batch" \
-            --tb=short \
-            --maxfail=3 \
-            --durations=10
--- a/.github/workflows/test-unit-core-utils.yml
+++ b/.github/workflows/test-unit-core-utils.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Core Utilities"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -18,3 +24,4 @@ jobs:
      test-path: "tests/test_litellm/litellm_core_utils"
      workers: 2
      reruns: 1
+      artifact-name: core-utils
--- a/.github/workflows/test-unit-documentation.yml
+++ b/.github/workflows/test-unit-documentation.yml
@ -2,7 +2,11 @@ name: "Unit Tests: Documentation Validation"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
@ -21,47 +25,47 @@ jobs:
        with:
          persist-credentials: false

+      - name: Checkout litellm-docs into docs/my-website (for documentation_tests)
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          repository: BerriAI/litellm-docs
+          path: docs/my-website
+          persist-credentials: false
+
      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

-      - name: Cache Poetry dependencies
+      - name: Cache uv dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
+            ~/.cache/uv
            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-poetry-
+            ${{ runner.os }}-uv-

      - name: Install dependencies
        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

      - name: Generate Prisma client
        env:
          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      # Run the same documentation tests that CircleCI ran (as direct Python scripts)
      - name: Run documentation validation tests
        run: |
-          poetry run python ./tests/documentation_tests/test_env_keys.py
-          poetry run python ./tests/documentation_tests/test_router_settings.py
-          poetry run python ./tests/documentation_tests/test_api_docs.py
-          poetry run python ./tests/documentation_tests/test_circular_imports.py
+          uv run --no-sync python ./tests/documentation_tests/test_env_keys.py
+          uv run --no-sync python ./tests/documentation_tests/test_router_settings.py
+          uv run --no-sync python ./tests/documentation_tests/test_api_docs.py
+          uv run --no-sync python ./tests/documentation_tests/test_circular_imports.py
--- a/.github/workflows/test-unit-enterprise-routing.yml
+++ b/.github/workflows/test-unit-enterprise-routing.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Enterprise, Google GenAI & Routing"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -22,3 +28,4 @@ jobs:
        tests/test_litellm/router_strategy
      workers: 2
      reruns: 2
+      artifact-name: enterprise-routing
--- a/.github/workflows/test-unit-integrations.yml
+++ b/.github/workflows/test-unit-integrations.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Integrations (Callbacks & Logging)"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -18,3 +24,4 @@ jobs:
      test-path: "tests/test_litellm/integrations"
      workers: 2
      reruns: 3
+      artifact-name: integrations
--- a/.github/workflows/test-unit-llm-providers.yml
+++ b/.github/workflows/test-unit-llm-providers.yml
@ -2,7 +2,11 @@ name: "Unit Tests: LLM Provider Transformations"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
@ -14,16 +18,26 @@ concurrency:
 jobs:
  vertex-ai:
    name: Vertex AI
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
    uses: ./.github/workflows/_test-unit-base.yml
    with:
      test-path: "tests/test_litellm/llms/vertex_ai"
      workers: 1
      reruns: 2
+      artifact-name: llm-vertex-ai

  other-providers:
    name: All Other Providers
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
    uses: ./.github/workflows/_test-unit-base.yml
    with:
      test-path: "tests/test_litellm/llms --ignore=tests/test_litellm/llms/vertex_ai"
      workers: 2
      reruns: 2
+      artifact-name: llm-other-providers
--- a/.github/workflows/test-unit-misc.yml
+++ b/.github/workflows/test-unit-misc.yml
@ -2,10 +2,16 @@ name: "Unit Tests: MCP, Secrets, Containers & Misc"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -29,3 +35,4 @@ jobs:
        tests/test_litellm/test_*.py
      workers: 2
      reruns: 2
+      artifact-name: misc
--- a/.github/workflows/test-unit-proxy-auth.yml
+++ b/.github/workflows/test-unit-proxy-auth.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Proxy Auth & Key Management"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -18,3 +24,4 @@ jobs:
      test-path: "tests/test_litellm/proxy/auth tests/test_litellm/proxy/hooks tests/test_litellm/proxy/policy_engine tests/test_litellm/proxy/client"
      workers: 2
      reruns: 2
+      artifact-name: proxy-auth
--- a/.github/workflows/test-unit-proxy-db.yml
+++ b/.github/workflows/test-unit-proxy-db.yml
@ -3,7 +3,7 @@ name: "Unit Tests: Proxy DB Operations"
 # Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
 on:
  push:
-    branches: [main, "litellm_*"]
+    branches: [main, "litellm_**"]

 permissions:
  contents: read
@ -12,34 +12,227 @@ concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

+# Semantic matrix: each shard groups tests by concern (auth, server, logging, …)
+# rather than alphabetical letter ranges. Adding a new test file means adding it
+# to whichever group it belongs to, not reshuffling slices.
+#
+# Design targets:
+#   * Every shard runs in <= 7 minutes of wall-clock on the default runner.
+#     Most of a shard's time is pytest plugin load + xdist worker imports +
+#     pytest-cov instrumentation, not the tests themselves. Keeping per-shard
+#     work low and matching worker count to runner cores is what controls it.
+#   * workers: 4 matches the 4-core ubuntu-latest runner. -n 8 on 4 cores
+#     oversubscribes 2x and workers fight for CPU during their cold-start
+#     imports (measured ~441% CPU for -n 8 locally, i.e. ~55% effective).
+#   * test_key_generate_prisma.py stays serial (workers=0) — it has event-loop
+#     conflicts with the logging worker when run in parallel.
+#   * test_proxy_utils.py runs as a single shard with --dist=worksteal so
+#     xdist balances its 188 parametrized cases across workers instead of
+#     pinning the whole file to one worker (the default --dist=loadscope
+#     behavior for single-file targets).
+#   * test_db_schema_migration.py is isolated because one test in it
+#     (test_aaaasschema_migration_check) takes ~170s — by itself it
+#     determines the shard's wall-clock floor.
 jobs:
+  # Fast guard — fails the workflow if a test_*.py file under
+  # tests/proxy_unit_tests/ is not referenced by any matrix entry below.
+  # The semantic-shard design (no catch-all "remaining" bucket) relies on
+  # every test file being explicitly assigned; this guard prevents a new
+  # file from silently dropping out of CI.
+  assert-shard-coverage:
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+      - name: Assert every test_*.py is in a matrix shard
+        run: |
+          python3 - <<'PY'
+          import pathlib, sys, yaml
+          wf = yaml.safe_load(open(".github/workflows/test-unit-proxy-db.yml"))
+          matrix = wf["jobs"]["proxy-db"]["strategy"]["matrix"]["include"]
+          referenced = set()
+          for entry in matrix:
+              for token in entry["test-path"].split():
+                  if token.startswith("tests/proxy_unit_tests/"):
+                      referenced.add(pathlib.PurePosixPath(token).name)
+          actual = {p.name for p in pathlib.Path("tests/proxy_unit_tests").iterdir()
+                    if p.name.startswith("test_") and (p.suffix == ".py" or p.is_dir())
+                    and p.name != "test_configs"}
+          orphans = sorted(actual - referenced)
+          if orphans:
+              print("ERROR: the following files/dirs under tests/proxy_unit_tests/")
+              print("       are not assigned to any shard in test-unit-proxy-db.yml:")
+              for o in orphans:
+                  print(f"  - {o}")
+              print()
+              print("Add each to whichever semantic shard it belongs to.")
+              sys.exit(1)
+          print(f"OK: all {len(actual)} files assigned to a shard.")
+          PY
+
  proxy-db:
+    needs: assert-shard-coverage
+    # Display only the semantic shard name in the checks UI instead of GHA's
+    # default "proxy-db (key-generation, tests/proxy_unit_tests/…, 0, loadscope, 20)"
+    # which includes every matrix field and gets truncated past the test-path.
+    name: ${{ matrix.test-group }}
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
    strategy:
      fail-fast: false
      matrix:
        include:
-          # Key generation tests must NOT run in parallel (event loop conflicts with logging worker)
+          # Must run serially — event-loop conflict with the logging worker.
          - test-group: key-generation
            test-path: "tests/proxy_unit_tests/test_key_generate_prisma.py"
            workers: 0
-            timeout: 30
+            dist: loadscope
+            timeout: 20
+
+          # ---- auth: split into 2 shards ----
          - test-group: auth-checks
-            test-path: "tests/proxy_unit_tests/test_auth_checks.py tests/proxy_unit_tests/test_user_api_key_auth.py"
-            workers: 8
-            timeout: 20
-          - test-group: remaining
-            test-path: "tests/proxy_unit_tests --ignore=tests/proxy_unit_tests/test_key_generate_prisma.py --ignore=tests/proxy_unit_tests/test_auth_checks.py --ignore=tests/proxy_unit_tests/test_user_api_key_auth.py"
-            workers: 8
-            timeout: 20
+            test-path: >-
+              tests/proxy_unit_tests/test_auth_checks.py
+              tests/proxy_unit_tests/test_user_api_key_auth.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+          - test-group: jwt-and-keys
+            test-path: >-
+              tests/proxy_unit_tests/test_jwt.py
+              tests/proxy_unit_tests/test_jwt_key_mapping.py
+              tests/proxy_unit_tests/test_proxy_custom_auth.py
+              tests/proxy_unit_tests/test_key_generate_dynamodb.py
+              tests/proxy_unit_tests/test_deployed_proxy_keygen.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+
+          # ---- test_proxy_utils.py, single shard, worksteal distribution ----
+          - test-group: proxy-utils
+            test-path: "tests/proxy_unit_tests/test_proxy_utils.py"
+            workers: 4
+            dist: worksteal
+            timeout: 15
+
+          # ---- proxy server: split into 2 shards ----
+          - test-group: proxy-server-core
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_server.py
+              tests/proxy_unit_tests/test_proxy_server_keys.py
+              tests/proxy_unit_tests/test_proxy_server_caching.py
+              tests/proxy_unit_tests/test_proxy_server_langfuse.py
+              tests/proxy_unit_tests/test_proxy_server_spend.py
+              tests/proxy_unit_tests/test_aproxy_startup.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+          - test-group: proxy-runtime
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_config_unit_test.py
+              tests/proxy_unit_tests/test_proxy_routes.py
+              tests/proxy_unit_tests/test_proxy_gunicorn.py
+              tests/proxy_unit_tests/test_server_root_path.py
+              tests/proxy_unit_tests/test_proxy_pass_user_config.py
+              tests/proxy_unit_tests/test_proxy_token_counter.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+
+          # ---- logging: split into 2 shards ----
+          - test-group: custom-logging
+            test-path: >-
+              tests/proxy_unit_tests/test_custom_callback_input.py
+              tests/proxy_unit_tests/test_custom_logger_s3_gcs.py
+              tests/proxy_unit_tests/test_proxy_custom_logger.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+          - test-group: logging-misc
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_reject_logging.py
+              tests/proxy_unit_tests/test_audit_logs_proxy.py
+              tests/proxy_unit_tests/test_search_api_logging.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+
+          # ---- db-and-spend: isolate the 170s schema-migration test ----
+          # test_db_schema_migration.py has exactly one test, and that test
+          # is mostly waiting on `prisma migrate deploy` / `prisma migrate
+          # diff` subprocesses (~170s). It does no CPU-bound Python work
+          # inside the test. Running with workers=0 (serial, no xdist)
+          # skips the 4-worker cold-start cost we'd otherwise pay for a
+          # single test, saving ~4 minutes of wall-clock.
+          - test-group: schema-migration
+            test-path: "tests/proxy_unit_tests/test_db_schema_migration.py"
+            workers: 0
+            dist: loadscope
+            timeout: 15
+          - test-group: db-and-spend
+            test-path: >-
+              tests/proxy_unit_tests/test_prisma_client_backoff_retry.py
+              tests/proxy_unit_tests/test_db_schema_changes.py
+              tests/proxy_unit_tests/test_e2e_pod_lock_manager.py
+              tests/proxy_unit_tests/test_skills_db.py
+              tests/proxy_unit_tests/test_update_daily_tag_spend.py
+              tests/proxy_unit_tests/test_update_spend.py
+              tests/proxy_unit_tests/test_proxy_encrypt_decrypt.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+
+          # ---- guardrails + budget + hooks: split into 2 ----
+          - test-group: guardrails-hooks
+            test-path: >-
+              tests/proxy_unit_tests/test_proxy_setting_guardrails.py
+              tests/proxy_unit_tests/test_banned_keyword_list.py
+              tests/proxy_unit_tests/test_unit_test_proxy_hooks.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+          - test-group: budgets
+            test-path: >-
+              tests/proxy_unit_tests/test_default_end_user_budget_simple.py
+              tests/proxy_unit_tests/test_unit_test_max_model_budget_limiter.py
+              tests/proxy_unit_tests/test_zero_cost_model_budget_bypass.py
+            workers: 4
+            dist: loadscope
+            timeout: 15
+
+          - test-group: endpoints-and-responses
+            test-path: >-
+              tests/proxy_unit_tests/test_blog_posts_endpoint.py
+              tests/proxy_unit_tests/test_models_fallback_endpoint.py
+              tests/proxy_unit_tests/test_google_endpoint_routing.py
+              tests/proxy_unit_tests/test_google_gemini_proxy_request.py
+              tests/proxy_unit_tests/test_get_favicon.py
+              tests/proxy_unit_tests/test_get_image.py
+              tests/proxy_unit_tests/test_ui_path_detection.py
+              tests/proxy_unit_tests/test_prompt_test_endpoint.py
+              tests/proxy_unit_tests/test_check_batch_cost.py
+              tests/proxy_unit_tests/test_check_responses_cost.py
+              tests/proxy_unit_tests/test_response_polling_handler.py
+              tests/proxy_unit_tests/test_response_polling_pre_call_checks.py
+              tests/proxy_unit_tests/test_realtime_cache.py
+              tests/proxy_unit_tests/test_proxy_exception_mapping.py
+              tests/proxy_unit_tests/test_custom_tokenizer_bug.py
+              tests/proxy_unit_tests/test_model_response_typing
+            workers: 4
+            dist: loadscope
+            timeout: 15
    uses: ./.github/workflows/_test-unit-services-base.yml
    with:
      test-path: ${{ matrix.test-path }}
      workers: ${{ matrix.workers }}
      reruns: 2
      timeout-minutes: ${{ matrix.timeout }}
-      enable-redis: false
      enable-postgres: true
-    secrets:
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+      dist: ${{ matrix.dist }}
+      artifact-name: proxy-db-${{ matrix.test-group }}
--- a/.github/workflows/test-unit-proxy-endpoints.yml
+++ b/.github/workflows/test-unit-proxy-endpoints.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Proxy API Endpoints"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -30,6 +36,9 @@ jobs:
        tests/test_litellm/proxy/health_endpoints
        tests/test_litellm/proxy/public_endpoints
        tests/test_litellm/proxy/prompts
+        tests/test_litellm/proxy/rag_endpoints
+        tests/test_litellm/proxy/realtime_endpoints
        tests/test_litellm/proxy/ui_crud_endpoints
      workers: 2
      reruns: 2
+      artifact-name: proxy-endpoints
--- a/.github/workflows/test-unit-proxy-infra.yml
+++ b/.github/workflows/test-unit-proxy-infra.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Proxy Infrastructure"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -26,3 +32,4 @@ jobs:
        tests/test_litellm/proxy/test_*.py
      workers: 2
      reruns: 2
+      artifact-name: proxy-infra
--- a/.github/workflows/test-unit-proxy-legacy.yml
+++ b/.github/workflows/test-unit-proxy-legacy.yml
@ -2,7 +2,11 @@ name: "Unit Tests: Proxy Legacy Tests"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
@ -24,7 +28,7 @@ jobs:
          - name: "key-generation"
            path: "tests/proxy_unit_tests/test_[k-o]*.py"
          - name: "proxy-config"
-            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_project*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
+            path: "tests/proxy_unit_tests/test_prisma*.py tests/proxy_unit_tests/test_prompt*.py tests/proxy_unit_tests/test_proxy_[c-r]*.py"
          - name: "proxy-server"
            path: "tests/proxy_unit_tests/test_proxy_server.py"
          - name: "proxy-server-extras"
@ -50,43 +54,36 @@ jobs:
        with:
          python-version: "3.12"

-      - name: Install Poetry
-        run: pip install 'poetry==2.3.2'
+      - name: Set up uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          version: "0.10.9"

-      - name: Cache Poetry dependencies
+      - name: Cache uv dependencies
        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
-            ~/.cache/pypoetry
-            ~/.cache/pip
+            ~/.cache/uv
            .venv
-          key: ${{ runner.os }}-poetry-${{ hashFiles('poetry.lock') }}
+          key: ${{ runner.os }}-uv-${{ hashFiles('uv.lock') }}
          restore-keys: |
-            ${{ runner.os }}-poetry-
+            ${{ runner.os }}-uv-

      - name: Install dependencies
        run: |
-          poetry config virtualenvs.in-project true
-          poetry install --with dev,proxy-dev --extras "proxy semantic-router"
-          poetry run pip install google-genai==1.22.0 \
-            google-cloud-aiplatform==1.115.0 fastapi-offline==1.7.3 python-multipart==0.0.22 openapi-core==0.23.0
-
-      - name: Setup litellm-enterprise
-        run: |
-          poetry run pip install --force-reinstall --no-deps -e enterprise/
+          uv sync --frozen --group ci --group proxy-dev --extra google --extra proxy --extra semantic-router

      - name: Generate Prisma client
        env:
          PRISMA_BINARY_CACHE_DIR: ${{ runner.temp }}/prisma-cache
        run: |
-          poetry run pip install nodejs-wheel-binaries==24.13.1
-          poetry run prisma generate --schema litellm/proxy/schema.prisma
+          uv run --no-sync prisma generate --schema litellm/proxy/schema.prisma

      - name: Run tests - ${{ matrix.test-group.name }}
        env:
          TEST_PATH: ${{ matrix.test-group.path }}
        run: |
-          poetry run pytest ${TEST_PATH} \
+          uv run --no-sync pytest ${TEST_PATH} \
            --tb=short -vv \
            --maxfail=10 \
            -n 2 \
--- a/.github/workflows/test-unit-responses-caching-types.yml
+++ b/.github/workflows/test-unit-responses-caching-types.yml
@ -2,10 +2,16 @@ name: "Unit Tests: Responses, Caching & Types"

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@ -18,3 +24,4 @@ jobs:
      test-path: "tests/test_litellm/responses tests/test_litellm/caching tests/test_litellm/types"
      workers: 2
      reruns: 2
+      artifact-name: responses-caching-types
--- a/.github/workflows/test-unit-security.yml
+++ b/.github/workflows/test-unit-security.yml
@ -1,12 +1,16 @@
 name: "Unit Tests: Security"

-# Uses DATABASE_URL secret — only runs on trusted branches, not PRs.
+# Kept push-only (was previously required by DATABASE_URL secret scoping;
+# now the postgres credentials are ephemeral localhost values but the
+# push-trigger stays to match the proxy-db workflow cadence).
 on:
  push:
-    branches: [main, "litellm_*"]
+    branches: [main, "litellm_**"]

 permissions:
  contents: read
+  id-token: write
+  pull-requests: write

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@ -20,9 +24,5 @@ jobs:
      workers: 1
      reruns: 2
      timeout-minutes: 20
-      enable-redis: false
      enable-postgres: true
-    secrets:
-      DATABASE_URL: ${{ secrets.DATABASE_URL }}
-      POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
-      POSTGRES_PASSWORD: ${{ secrets.POSTGRES_PASSWORD }}
+      artifact-name: security
--- a/.github/workflows/test_server_root_path.yml
+++ b/.github/workflows/test_server_root_path.yml
@ -4,12 +4,16 @@ permissions:

 on:
  pull_request:
-    branches: [main]
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"

 jobs:
  test-server-root-path:
    runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30

    strategy:
      matrix:
@ -21,6 +25,12 @@ jobs:
        with:
          persist-credentials: false

+      - name: Free up disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc /usr/local/share/boost
+          sudo apt-get clean
+          df -h /
+
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12

--- a/scripts/install.sh
+++ b/scripts/install.sh
@ -11,6 +11,7 @@ MIN_PYTHON_MINOR=9

 # NOTE: before merging, this must stay as "litellm[proxy]" to install from PyPI.
 LITELLM_PACKAGE="litellm[proxy]"
+UV_VERSION="0.10.9"

 # ── colours ────────────────────────────────────────────────────────────────
 if [ -t 1 ]; then
@ -69,13 +70,34 @@ if [ -z "$PYTHON_BIN" ]; then
  die "Python ${MIN_PYTHON_MAJOR}.${MIN_PYTHON_MINOR}+ is required but not found.
  Install it from https://python.org/downloads or via your package manager:
    macOS:  brew install python@3
-    Ubuntu: sudo apt install python3 python3-pip"
+    Ubuntu: sudo apt install python3"
 fi

-# ── pip detection ──────────────────────────────────────────────────────────
-if ! "$PYTHON_BIN" -m pip --version >/dev/null 2>&1; then
-  die "pip is not available. Install it with:
-    $PYTHON_BIN -m ensurepip --upgrade"
+# ── uv detection / install ────────────────────────────────────────────────
+UV_BIN=""
+CURRENT_UV_VERSION=""
+for candidate in uv "$HOME/.local/bin/uv"; do
+  if command -v "$candidate" >/dev/null 2>&1; then
+    UV_BIN="$(command -v "$candidate")"
+    break
+  elif [ -x "$candidate" ]; then
+    UV_BIN="$candidate"
+    break
+  fi
+done
+
+if [ -n "$UV_BIN" ]; then
+  CURRENT_UV_VERSION="$("$UV_BIN" --version 2>/dev/null | awk '{print $2}' | head -1 || true)"
+fi
+
+if [ -z "$UV_BIN" ] || [ "${CURRENT_UV_VERSION:-}" != "$UV_VERSION" ]; then
+  header "Installing uv…"
+  if [ -n "${CURRENT_UV_VERSION:-}" ]; then
+    info "Upgrading uv from ${CURRENT_UV_VERSION} to ${UV_VERSION}"
+  fi
+  curl -LsSf "https://astral.sh/uv/${UV_VERSION}/install.sh" | env UV_NO_MODIFY_PATH=1 sh \
+    || die "uv installation failed. Try manually: curl -LsSf https://astral.sh/uv/${UV_VERSION}/install.sh | sh"
+  UV_BIN="$HOME/.local/bin/uv"
 fi

 # ── install ────────────────────────────────────────────────────────────────
@ -83,23 +105,15 @@ echo ""
 header "Installing litellm[proxy]…"
 echo ""

-"$PYTHON_BIN" -m pip install --only-binary :all: --upgrade "${LITELLM_PACKAGE}" \
-  || die "pip install failed. Try manually: $PYTHON_BIN -m pip install --only-binary :all: '${LITELLM_PACKAGE}'"
+"$UV_BIN" tool install --python "$PYTHON_BIN" --force "${LITELLM_PACKAGE}" \
+  || die "uv tool install failed. Try manually: $UV_BIN tool install --python '$PYTHON_BIN' '${LITELLM_PACKAGE}'"

-# ── find the litellm binary installed by pip for this Python ───────────────
-# sysconfig.get_path('scripts') is where pip puts console scripts — reliable
-# even when the Python lives in a libexec/ symlink tree (e.g. Homebrew).
-SCRIPTS_DIR="$("$PYTHON_BIN" -c 'import sysconfig; print(sysconfig.get_path("scripts"))')"
+# ── find the litellm binary installed by uv tool ───────────────────────────
+SCRIPTS_DIR="$("$UV_BIN" tool dir --bin)"
 LITELLM_BIN="${SCRIPTS_DIR}/litellm"

 if [ ! -x "$LITELLM_BIN" ]; then
-  # Fall back to user-base bin (pip install --user)
-  USER_BIN="$("$PYTHON_BIN" -c 'import site; print(site.getuserbase())')/bin"
-  LITELLM_BIN="${USER_BIN}/litellm"
-fi
-
-if [ ! -x "$LITELLM_BIN" ]; then
-  die "litellm binary not found after install. Try: $PYTHON_BIN -m pip install --user '${LITELLM_PACKAGE}'"
+  die "litellm binary not found after install. Try: $UV_BIN tool install --python '$PYTHON_BIN' '${LITELLM_PACKAGE}'"
 fi

 # ── success banner ─────────────────────────────────────────────────────────