You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add the ability to run mod_wsgi locally on Linux and in a container otherwise.
Add GitHub Actions tests covering apache and httpd, min and max cpython, min and max server (6.0 is the lowest supported on the runner), and embedded and standalone modes.
Test Plan
just smoke-mod-wsgi passes both modes in an ubuntu:24.04 container; the tester cycle was also verified natively on Linux.
just lint-manual and the monitor, pooling, and uri_parser suites pass on Python 3.14 against MongoDB 8.0.
Checklist
Checklist for Author
Did you update the changelog (if necessary)?
Is there test coverage?
Is any followup work tracked in a JIRA ticket? If so, add link(s). (Upstream mod_wsgi issue for the child-exit crash pending; tracked in the PYTHON-6114 pitfalls.)
Checklist for Reviewer
Does the title of the PR reference a JIRA Ticket?
Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
Is all relevant documentation (README or docstring) updated?
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🛟 Help? Slack #semgrep-help or go/semgrep-help.
Resolution Options:
Fix the code
Reply /fp $reason (if security gap doesn’t exist)
Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
The WSGI application imports and extensively exercises bson, including asserting that its C extension is loaded, but a push changing only bson/** will skip this workflow. Add that path so these regressions are covered.
This issue also appears on line 29 of the same file.
Install cleanup trap before setup
justfile:141
If setup fails, set -e exits immediately and never tears down the partially started Apache/container or clears the dispatch marker. Install an exit trap before setup so the smoke command cleans up on setup and test failures as well as on success.
urllib.error is never referenced. Ruff selects the F rules and only exempts T201 for .evergreen/scripts/*.py (pyproject.toml:198-223,258-260), so this produces an F401 failure in the normal lint job.
Document required environment variables for manual Fedora setup
test/mod_wsgi_test/README.rst:61
The manual setup is incomplete for the newly added Fedora config: httpd24fedora.conf expands MOD_WSGI_PYTHON_HOME, while both top-level configs also expand PROJECT_DIRECTORY and MOD_WSGI_CONF. Following these instructions and starting the config directly therefore fails on undefined variables; document all required exports or direct this section to mod_wsgi_tester.py.
PYTHON-6104 removed the mod_wsgi tests from Evergreen. Restore the test
infrastructure they need: refresh the Apache configs (drop the stale
Apache 2.2 configs, add current apache24ubuntu and httpd24fedora
configs), update the README, and declare the mod_wsgi dependency group
the tests are installed from.
Move the mod_wsgi tests to a dedicated test-mod-wsgi.yml workflow: a
min-deps job (Fedora container, httpd) and a latest job (Ubuntu,
apache2), each running standalone and embedded rounds, triggered when
mod_wsgi-relevant files change. The mod-wsgi-versions action computes
the CPython and MongoDB versions from the Evergreen config lists.
Add .evergreen/scripts/mod_wsgi.sh with dispatch.sh routing the just
recipes, so just setup-tests mod_wsgi <mode>, just run-tests, and just
teardown-tests run the tests against the host's Apache on Linux and
inside an ubuntu container with its own replica set otherwise (just
smoke-mod-wsgi runs both modes). mod_wsgi_tester.py drives Apache and
verifies readiness; mod_wsgi_matrix.py defines the version matrix.
Document the workflow and the local commands in CONTRIBUTING.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
PYTHON-6114
Replaces #3059, rebased on main including the merged subinterpreter support (#3061).
Changes in this PR
Test Plan
just smoke-mod-wsgipasses both modes in an ubuntu:24.04 container; the tester cycle was also verified natively on Linux.just lint-manualand the monitor, pooling, and uri_parser suites pass on Python 3.14 against MongoDB 8.0.Checklist
Checklist for Author
Checklist for Reviewer