Is HMAC-SHA-1 secure?
As shown in the paper Ricky Demer linked in the comments, HMAC can be secure even when the underlying hash function is not collision resistant. Only PRF-ness of the hash function is required, and SHA-1 is not known to lack it. Or a couple of other conditions can suffice even if it isn't a PRF.

Intuitively, it makes sense that HMAC is secure as a MAC even with SHA-1, because a MAC does not allow a collision search. The only way to find the key would be to compromise the preimage resistance of SHA-1. HMAC in turn prevents length extension attacks and the like that would allow a forgery without knowing the key.

As an aside, even HMAC-MD5 hasn't been broken. However, for the same reason as there – attacks only get better – I would recommend not choosing SHA-1 as the HMAC hash for new applications if you can just as easily use SHA-2.