[blink1073]

PYTHON-6114

Replaces #3059, rebased on main including the merged subinterpreter support (#3061).

Changes in this PR

• Reinstate the mod_wsgi infrastructure that was removed in PYTHON-6104 - remove mod wsgi from evergreen #3060.
• Add the ability to run mod_wsgi locally on Linux and in a container otherwise.
• Add GitHub Actions tests covering apache and httpd, min and max cpython, min and max server (6.0 is the lowest supported on the runner), and embedded and standalone modes.

Test Plan

• just smoke-mod-wsgi passes both modes in an ubuntu:24.04 container; the tester cycle was also verified natively on Linux.
• just lint-manual and the monitor, pooling, and uri_parser suites pass on Python 3.14 against MongoDB 8.0.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)?
• Is there test coverage?
• Is any followup work tracked in a JIRA ticket? If so, add link(s). (Upstream mod_wsgi issue for the child-exit crash pending; tracked in the PYTHON-6114 pitfalls.)

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[semgrep-code-mongodb]

Semgrep found 2 github-actions-mutable-action-tag findings:

• .github/workflows/test-python.yml
  • L340 - Triage
  • L408 - Triage

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

• Fix the code
• Reply /fp $reason (if security gap doesn’t exist)
• Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
• Reply /other $reason (e.g., test-only)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical workflow and test-orchestration issues block reliable execution.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 5 · 1 · 2

Open (8)

• CI sync overwrites minimum dependency versions · New
• Test setup removes the required mod_wsgi dependency group · New
• MongoDB archive extracts to a path different from the executable path · New
• GitHub Actions local action reference uses an invalid path · New
• WSGIPythonHome appears before mod_wsgi is loaded · New
• Workflow filters omit mod_wsgi entry points and matrix dependencies · New
• Workflow description incorrectly implies all pull requests run · New
• Workflow description ignores pull request path filters · New

What changed in this PR

Moves mod_wsgi integration tests from Evergreen to GitHub Actions with shared local/CI tooling, dependency setup, and updated Apache configurations.

Changes:

• Adds dedicated minimum- and latest-dependency workflows.
• Adds mod_wsgi orchestration, version-matrix, and smoke-test tooling.
• Updates documentation and removes obsolete Apache 2.2 configurations.

File	Description
uv.lock	Locks mod_wsgi and updated dependency metadata.
test/​mod_wsgi_test/​README.rst	Documents CI and local testing.
test/​mod_wsgi_test/​httpd24fedora.conf	Adds Fedora Apache configuration.
test/​mod_wsgi_test/​apache24ubuntu161404.conf	Removes obsolete configuration.
test/​mod_wsgi_test/​apache24ubuntu.conf	Adds Ubuntu Apache configuration.
test/​mod_wsgi_test/​apache22ubuntu1204.conf	Removes obsolete configuration.
test/​mod_wsgi_test/​apache22amazon.conf	Removes obsolete configuration.
pyproject.toml	Adds the mod_wsgi dependency group.
justfile	Adds smoke testing and dispatch integration.
CONTRIBUTING.md	Documents running mod_wsgi tests.
.gitignore	Ignores Apache logs.
.github/​workflows/​test-mod-wsgi.yml	Defines GitHub Actions jobs.
.github/​actions/​mod-wsgi-versions/​action.yml	Computes test versions.
.evergreen/​scripts/​mod_wsgi.sh	Orchestrates native and container tests.
.evergreen/​scripts/​mod_wsgi_tester.py	Manages Apache and test execution.
.evergreen/​scripts/​mod_wsgi_matrix.py	Defines the version matrix.
.evergreen/​scripts/​dispatch.sh	Dispatches shared test recipes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Invalid local-action references prevent both CI jobs from running, and the test harness has dependency and state-management correctness issues.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 6 · 3 · 2

Open (11)

• Predictable shared state file enables command injection · New
• WSGIPythonHome appears before mod_wsgi is loaded
• GitHub Actions local action reference uses an invalid path
• MongoDB archive extracts to a path different from the executable path
• Test setup removes the required mod_wsgi dependency group
• CI sync overwrites minimum dependency versions
• Stale container marker prevents updated version selection · New
• Bootstrap deletes live Apache diagnostics and state · New
• Workflow filters omit mod_wsgi entry points and matrix dependencies
• Workflow description ignores pull request path filters
• Workflow description incorrectly implies all pull requests run

[Copilot]

Copilot review overview

🟡 Changes recommended

Invalid local-action references prevent both new CI jobs from starting, with additional test-harness safety and documentation issues outstanding.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 2 · 1 · 1

Open (4)

• Validate PID before terminating Apache process · New
• GitHub Actions local action reference uses an invalid path
• Add timeout to readiness HTTP requests · New
• Correct MongoDB compatibility description · New

Resolved since last review (10)

• Predictable shared state file enables command injection
• WSGIPythonHome appears before mod_wsgi is loaded
• MongoDB archive extracts to a path different from the executable path
• Test setup removes the required mod_wsgi dependency group
• CI sync overwrites minimum dependency versions
• Bootstrap deletes live Apache diagnostics and state
• Stale container marker prevents updated version selection
• Workflow filters omit mod_wsgi entry points and matrix dependencies
• Workflow description ignores pull request path filters
• Workflow description incorrectly implies all pull requests run

[Copilot]

Copilot review overview

🟡 Changes recommended

Failed setup can bypass mod_wsgi teardown and leave Apache or Docker resources running.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Run mod_wsgi teardown before deleting the dispatch marker · New
• Unused import triggers Ruff F401 in lint-manual

Resolved since last review (1)

• Failed setup leaves stale dispatch marker

[Copilot]

Copilot review overview

🟡 Changes recommended

Both new CI jobs use malformed local-action references, so neither reaches the mod_wsgi tests.

Review effort: Balanced
Findings: 1

Open (1)

• Unnecessary host server command causes incorrect non-Linux setup · New

Resolved since last review (2)

• Run mod_wsgi teardown before deleting the dispatch marker
• Unused import triggers Ruff F401 in lint-manual

[Copilot]

Copilot review overview

🟡 Changes recommended

Both CI jobs use invalid repository-local action paths and therefore cannot start.

Review effort: Balanced
Findings: 1

Open (1)

• Use ./ prefix for local action in minimum-dependencies job · New

Resolved since last review (1)

• Unnecessary host server command causes incorrect non-Linux setup

[Copilot]

Copilot review overview

🟡 Changes recommended

Invalid local-action paths prevent both CI jobs from starting, and partial container initialization cannot recover automatically.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Invalid local action path prevents latest-dependencies job · New
• Clean up failed containers to keep bootstrap retries idempotent · New

Resolved since last review (1)

• Use ./ prefix for local action in minimum-dependencies job

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved workflow and setup defects prevent reliable CI execution.

Review effort: Lite
Findings: 3

Open (3)

• Resolve file before deriving the project directory · New
• Remove or configure missing drivers-tools setup dependency · New
• Use supported uv workflow for installing dependency groups · New

Resolved since last review (2)

• Invalid local action path prevents latest-dependencies job
• Clean up failed containers to keep bootstrap retries idempotent

Previously missed (1)

In code that hasn't changed since last review

Avoid primary server selection timeout during replica set probing

.evergreen/​scripts/​mod_wsgi.sh:199

On a fresh container, mongod is started with --replSet but has no primary yet. MongoClient().admin.command("hello") uses the default primary server selection, so this probe waits for PyMongo's default server-selection timeout before the initiation branch runs, adding roughly 30 seconds to every fresh/recreated container bootstrap. Probe replSetGetStatus through a direct connection instead; it returns immediately for both initialized and uninitialized replica sets.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved workflow validation, process-management, and process-targeting issues remain.

Review effort: Lite
Findings: 1

Open (1)

• Prevent pkill fallback from terminating unrelated Apache processes · New

Resolved since last review (3)

• Use supported uv workflow for installing dependency groups
• Remove or configure missing drivers-tools setup dependency
• Resolve file before deriving the project directory

[blink1073]

@NoahStapp ready for real this time