[Infra] Remove Redundant Matrix Unit Test Workflow (#25251)

* Remove redundant matrix unit test workflow

All test paths in test-litellm-matrix.yml are fully covered by the
newer semantic unit test workflows (test-unit-*.yml), making the
matrix workflow redundant CI spend.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Codecov coverage reporting to semantic unit test workflows

Add coverage collection (--cov) and Codecov OIDC upload to both
reusable base workflows and all 12 caller workflows, replacing the
coverage reporting that was previously only in the matrix workflow.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Move id-token/pull-requests permissions to job level for multi-job workflows

For workflows with multiple jobs (llm-providers, proxy-db), move
id-token: write and pull-requests: write from workflow level to job
level so permissions are scoped to only the jobs that need them.
Removes zizmor inline suppressions that were masking the issue.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: yuneng-berri

.github/workflows/_test-unit-base.yml

@@ -27,6 +27,10 @@ on:
         required: false
         type: number
         default: 10
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: true
+        type: string
 
 permissions:
   contents: read
@@ -93,4 +97,46 @@ jobs:
             --reruns "${RERUNS}" \
             --reruns-delay 1 \
             --dist=loadscope \
-            --durations=20
+            --durations=20 \
+            --cov=litellm \
+            --cov-report=xml:coverage.xml \
+            --cov-config=pyproject.toml
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/_test-unit-services-base.yml

@@ -37,6 +37,11 @@ on:
         required: false
         type: boolean
         default: false
+      artifact-name:
+        description: "Unique name for the coverage artifact (must be unique per run)"
+        required: false
+        type: string
+        default: "run"
     secrets:
       REDIS_HOST:
         required: false
@@ -151,7 +156,10 @@ jobs:
               --maxfail="${MAX_FAILURES}" \
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
-              --durations=20
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
           else
             poetry run pytest ${TEST_PATH:?} \
               --tb=short -vv \
@@ -160,5 +168,47 @@ jobs:
               --reruns "${RERUNS}" \
               --reruns-delay 1 \
               --dist=loadscope \
-              --durations=20
+              --durations=20 \
+              --cov=litellm \
+              --cov-report=xml:coverage.xml \
+              --cov-config=pyproject.toml
           fi
+
+      - name: Save coverage report
+        if: always()
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        with:
+          name: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage.xml
+          retention-days: 1
+
+  upload-coverage:
+    name: Upload coverage to Codecov
+    needs: run
+    if: always()
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern: coverage-${{ inputs.artifact-name }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: coverage-reports
+          merge-multiple: true
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
+        with:
+          use_oidc: true
+          directory: coverage-reports
+          root_dir: ${{ github.workspace }}
+          fail_ci_if_error: false

.github/workflows/test-litellm-matrix.yml

@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -29,6 +31,7 @@ jobs:
       timeout-minutes: 20
       enable-redis: true
       enable-postgres: false
+      artifact-name: caching-redis
     secrets:
       REDIS_HOST: ${{ secrets.REDIS_HOST }}
       REDIS_PORT: ${{ secrets.REDIS_PORT }}

.github/workflows/test-unit-caching-redis.yml

@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -18,3 +20,4 @@ jobs:
       test-path: "tests/test_litellm/litellm_core_utils"
       workers: 2
       reruns: 1
+      artifact-name: core-utils

.github/workflows/test-unit-core-utils.yml

@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: read
+  id-token: write
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -22,3 +24,4 @@ jobs:
         tests/test_litellm/router_strategy
       workers: 2
       reruns: 2
+      artifact-name: enterprise-routing