PYTHON-6114 Exclude mod_wsgi from Windows dependency resolution

.evergreen/scripts/mod_wsgi.sh

@@ -73,12 +73,11 @@ if [ "$(uname -s)" = "Linux" ] && [ -z "${MOD_WSGI_DOCKER:-}" ]; then
   # "just run-server" or the CI workflow. Set MOD_WSGI_DOCKER to force the
   # container path on Linux.
   if [ "$CMD" != "teardown" ]; then
-    # Other recipes' exact uv syncs — including run-tests' resync — prune the
-    # mod_wsgi group; restore it before setup or test when missing. Checking
-    # first keeps the sync from reconciling dependencies that a caller
-    # resolved differently, like the min-deps job's lowest-direct install.
+    # Other recipes' exact uv syncs prune the on-demand mod_wsgi install;
+    # restore it when missing. Checking first avoids reconciling a caller's
+    # differently-resolved dependencies.
     if ! uv run --no-sync python -c "import mod_wsgi" 2>/dev/null; then
-      uv sync --group mod_wsgi --quiet
+      uv pip install -r requirements/mod_wsgi.txt --quiet
     fi
   fi
   if [ "$CMD" = "setup" ]; then
@@ -190,7 +189,9 @@ bootstrap() {
     # Rebuild the in-place C extensions on every bootstrap; the source
     # refresh may carry artifacts built by a different interpreter.
     export PYMONGO_C_EXT_MUST_BUILD=1
-    uv sync --group mod_wsgi --refresh-package pymongo
+    uv sync --refresh-package pymongo
+    # The sync above prunes mod_wsgi, so install it after.
+    VIRTUAL_ENV="$VENV" uv pip install -r requirements/mod_wsgi.txt --quiet
   '
   ensure_mongod
   docker exec --user smoke -w "$HOME_SRC" "$CONTAINER" bash -c 'set -euo pipefail

.github/dependabot.yml

@@ -19,3 +19,20 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 0
+  # Python (pip). Manages requirements/mod_wsgi.txt only; the other
+  # requirements files are resolved in uv.lock.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    exclude-paths:
+      - "/pyproject.toml"
+      - "/requirements.txt"
+      - "/requirements/aws.txt"
+      - "/requirements/docs.txt"
+      - "/requirements/encryption.txt"
+      - "/requirements/gssapi.txt"
+      - "/requirements/ocsp.txt"
+      - "/requirements/snappy.txt"
+      - "/requirements/test.txt"
+      - "/requirements/zstd.txt"

.github/workflows/sbom.yml

@@ -14,6 +14,7 @@ on:
       - 'requirements/**.txt'
       - '!requirements/docs.txt'
       - '!requirements/test.txt'
+      - '!requirements/mod_wsgi.txt'
 
 permissions:
   contents: write

.github/workflows/test-mod-wsgi.yml

@@ -16,6 +16,7 @@ on:
       - "justfile"
       - "pyproject.toml"
       - "uv.lock"
+      - "requirements/mod_wsgi.txt"
   pull_request:
     paths:
       - ".evergreen/scripts/mod_wsgi_*"
@@ -30,6 +31,7 @@ on:
       - "justfile"
       - "pyproject.toml"
       - "uv.lock"
+      - "requirements/mod_wsgi.txt"
   workflow_dispatch:
 
 concurrency:
@@ -87,12 +89,11 @@ jobs:
         run: |
           export PYMONGO_C_EXT_MUST_BUILD=1
           just install
-          uv sync --group mod_wsgi --refresh-package pymongo
+          # just install skips the sync when uv is already set up.
+          uv sync --refresh-package pymongo
           uv run --no-sync python tools/fail_if_no_c.py
-          # Re-resolve at the lowest direct versions, including the mod_wsgi
-          # group: uv sync above installed the locked version, but this job
-          # must exercise the group's mod_wsgi>=4.9.4 lower bound.
-          uv pip install -e ".[test]" --group mod_wsgi --resolution=lowest-direct --force-reinstall
+          # Exercise the mod_wsgi>=4.9.4 lower bound.
+          uv pip install -e ".[test]" -r requirements/mod_wsgi.txt --resolution=lowest-direct --force-reinstall
       - name: Start MongoDB
         # Fedora is not a supported MongoDB platform, so install the RHEL build
         # directly instead of using the drivers-evergreen-tools action, which
@@ -153,7 +154,9 @@ jobs:
         run: |
           export PYMONGO_C_EXT_MUST_BUILD=1
           just install
-          uv sync --group mod_wsgi --refresh-package pymongo
+          # just install skips the sync when uv is already set up.
+          uv sync --refresh-package pymongo
+          uv pip install -r requirements/mod_wsgi.txt
           uv run --no-sync python tools/fail_if_no_c.py
       - id: setup-mongodb
         uses: mongodb-labs/drivers-evergreen-tools@49da51cebc0060b4d699d57bdef30ee7e071de44

CONTRIBUTING.md

@@ -361,7 +361,7 @@ Continuous integration runs the tests on pull requests that change
 mod_wsgi-relevant files, in the `test-mod-wsgi.yml` workflow.
 
 To run the tests by hand, install Apache and mod_wsgi (`sudo apt-get install -y apache2
-apache2-dev` and `uv sync --group mod_wsgi` on Ubuntu), then:
+apache2-dev` and `uv pip install -r requirements/mod_wsgi.txt` on Ubuntu), then:
 
 - On Linux, run `TOPOLOGY=replica_set just run-server`.
 - Run `just setup-tests mod_wsgi <mode>`.

pyproject.toml

@@ -70,9 +70,6 @@ unasync = [
 ]
 pip = ["pip>=20.2"]
 gevent = ["gevent>=21.12"]
-# mod_wsgi is built against the interpreter it is installed with and is used
-# only by the mod_wsgi test suite.
-mod_wsgi = ["mod_wsgi>=4.9.4"]
 coverage = [
     "coverage[toml]>=5,<=7.15.0"
 ]

requirements/mod_wsgi.txt

@@ -0,0 +1,3 @@
+# Test-only; kept out of pyproject.toml so the uv lock never has to
+# resolve it (building its sdist needs Apache).
+mod_wsgi>=4.9.4

test/mod_wsgi_test/README.rst

@@ -41,10 +41,11 @@ with the matching config file (``apache24ubuntu.conf`` or
 Install mod_wsgi
 ................
 
-The project defines a ``mod_wsgi`` dependency group used for testing. pip
-builds mod_wsgi against the interpreter it is installed with::
+mod_wsgi is only needed by these tests, so it is not a project dependency.
+Its constraint lives in ``requirements/mod_wsgi.txt``. pip builds mod_wsgi
+against the interpreter it is installed with::
 
-    uv sync --group mod_wsgi
+    uv pip install -r requirements/mod_wsgi.txt
 
 Start mongod
 ............

tools/generate_sbom_requirements.py

@@ -3,15 +3,15 @@
 
 - Includes repo_root/requirements.txt if present
 - Includes all files matching repo_root/requirements/**/*.txt
-- Excludes docs.txt and test.txt in the requirements folder
+- Excludes docs.txt, test.txt, and mod_wsgi.txt in the requirements folder
 - Writes output to sbom-requirements.txt (overwrites)
 """
 
 from __future__ import annotations
 
 from pathlib import Path
 
-EXCLUDED_NAMES = {"docs.txt", "test.txt"}
+EXCLUDED_NAMES = {"docs.txt", "test.txt", "mod_wsgi.txt"}
 
 
 def collect_files(root: Path) -> list[Path]: