Merge branch 'master' into PYTHON-5253

Author: sleepyStick

.evergreen/generated_configs/functions.yml

@@ -145,6 +145,7 @@ functions:
           - MONGODB_API_VERSION
           - REQUIRE_API_VERSION
           - DEBUG_LOG
+          - DISABLE_FLAKY
           - ORCHESTRATION_FILE
           - OCSP_SERVER_TYPE
           - VERSION

.evergreen/generated_configs/tasks.yml

@@ -128,6 +128,10 @@ tasks:
             - mongo-python-driver
             - ${github_commit}
           working_dir: src
+          include_expansions_in_env:
+            - AWS_ACCESS_KEY_ID
+            - AWS_SECRET_ACCESS_KEY
+            - AWS_SESSION_TOKEN
         type: test
 
   # Coverage report tests

.evergreen/generated_configs/variants.yml

@@ -75,6 +75,8 @@ buildvariants:
     display_name: Atlas connect RHEL8
     run_on:
       - rhel87-small
+    expansions:
+      TEST_NAME: atlas_connect
     tags: [pr]
 
   # Atlas data lake tests

.evergreen/scripts/generate_config.py

@@ -425,6 +425,7 @@ def create_atlas_connect_variants():
             get_variant_name("Atlas connect", host),
             tags=["pr"],
             host=DEFAULT_HOST,
+            expansions=dict(TEST_NAME="atlas_connect"),
         )
     ]
 
@@ -896,7 +897,8 @@ def create_backport_pr_tasks():
         "mongo-python-driver",
         "${github_commit}",
     ]
-    cmd = get_subprocess_exec(args=args)
+    include_expansions = ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN"]
+    cmd = get_subprocess_exec(args=args, include_expansions_in_env=include_expansions)
     assume_func = FunctionCall(func="assume ec2 role")
     return [EvgTask(name=name, commands=[assume_func, cmd], allowed_requesters=["commit"])]
 
@@ -1084,6 +1086,7 @@ def create_run_tests_func():
         "MONGODB_API_VERSION",
         "REQUIRE_API_VERSION",
         "DEBUG_LOG",
+        "DISABLE_FLAKY",
         "ORCHESTRATION_FILE",
         "OCSP_SERVER_TYPE",
         "VERSION",

.evergreen/scripts/setup-system.sh

@@ -38,4 +38,14 @@ if [ "$(uname -s)" = "Darwin" ]; then
     fi
 fi
 
+if [ -w /etc/hosts ]; then
+  SUDO=""
+else
+  SUDO="sudo"
+fi
+
+# Add 'server' and 'hostname_not_in_cert' as a hostnames
+echo "127.0.0.1 server" | $SUDO tee -a /etc/hosts
+echo "127.0.0.1 hostname_not_in_cert" | $SUDO tee -a /etc/hosts
+
 echo "Setting up system... done."

.evergreen/scripts/setup_tests.py

@@ -162,10 +162,6 @@ def handle_test_env() -> None:
     write_env("PIP_PREFER_BINARY")  # Prefer binary dists by default.
     write_env("UV_FROZEN")  # Do not modify lock files.
 
-    # Skip CSOT tests on non-linux platforms.
-    if PLATFORM != "linux":
-        write_env("SKIP_CSOT_TESTS")
-
     # Set an environment variable for the test name and sub test name.
     write_env(f"TEST_{test_name.upper()}")
     write_env("TEST_NAME", test_name)
@@ -421,7 +417,18 @@ def handle_test_env() -> None:
             run_command(f"bash {auth_aws_dir}/setup-secrets.sh")
 
     if test_name == "atlas_connect":
-        get_secrets("drivers/atlas_connect")
+        secrets = get_secrets("drivers/atlas_connect")
+
+        # Write file with Atlas X509 client certificate:
+        decoded = base64.b64decode(secrets["ATLAS_X509_DEV_CERT_BASE64"]).decode("utf8")
+        cert_file = ROOT / ".evergreen/atlas_x509_dev_client_certificate.pem"
+        with cert_file.open("w") as file:
+            file.write(decoded)
+        write_env(
+            "ATLAS_X509_DEV_WITH_CERT",
+            secrets["ATLAS_X509_DEV"] + "&tlsCertificateKeyFile=" + str(cert_file),
+        )
+
         # We do not want the default client_context to be initialized.
         write_env("DISABLE_CONTEXT")
 

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @mongodb/dbx-python

.github/workflows/codeql.yml

@@ -46,7 +46,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
+      uses: github/codeql-action/init@181d5eefc20863364f96762470ba6f862bdef56b # v3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -63,6 +63,6 @@ jobs:
         pip install -e .
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
+      uses: github/codeql-action/analyze@181d5eefc20863364f96762470ba6f862bdef56b # v3
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/test-python.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Install just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: "3.9"
@@ -65,7 +65,7 @@ jobs:
       - name: Install just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: ${{ matrix.python-version }}
@@ -88,7 +88,7 @@ jobs:
       - name: Install just
         uses: extractions/setup-just@e33e0265a09d6d736e2ee1e0eb685ef1de4669ff # v3
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: "3.9"
@@ -111,7 +111,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: "3.9"
@@ -130,7 +130,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: "3.9"
@@ -152,7 +152,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install uv
-        uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb # v5
+        uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
         with:
           enable-cache: true
           python-version: "${{matrix.python}}"
@@ -220,3 +220,55 @@ jobs:
             which python
             pip install -e ".[test]"
             PYMONGO_MUST_CONNECT=1 pytest -v -k client_context
+
+  test_minimum:
+      permissions:
+        contents: read
+      runs-on: ubuntu-latest
+      name: Test using minimum dependencies and supported Python
+      steps:
+        - uses: actions/checkout@v4
+          with:
+            persist-credentials: false
+        - name: Install uv
+          uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
+          with:
+            python-version: '3.9'
+        - name: Start MongoDB
+          uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
+          with:
+            mongodb-version: 6.0
+        # Async and our test_dns do not support dnspython 1.X, so we don't run async or dns tests here
+        - name: Run tests
+          shell: bash
+          run: |
+            uv venv
+            source .venv/bin/activate
+            uv pip install -e ".[test]" --resolution=lowest-direct
+            pytest -v test/test_srv_polling.py
+
+  test_minimum_for_async:
+      permissions:
+        contents: read
+      runs-on: ubuntu-latest
+      name: Test async's minimum dependencies and Python
+      steps:
+        - uses: actions/checkout@v4
+          with:
+            persist-credentials: false
+        - name: Install uv
+          uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v5
+          with:
+            python-version: '3.9'
+        - name: Start MongoDB
+          uses: supercharge/mongodb-github-action@90004df786821b6308fb02299e5835d0dae05d0d # 1.12.0
+          with:
+            mongodb-version: 6.0
+        # The lifetime kwarg we use in srv resolution was added to the async resolver API in dnspython 2.1.0
+        - name: Run tests
+          shell: bash
+          run: |
+            uv venv
+            source .venv/bin/activate
+            uv pip install -e ".[test]" --resolution=lowest-direct dnspython==2.1.0 --force-reinstall
+            pytest -v test/test_srv_polling.py test/test_dns.py test/asynchronous/test_srv_polling.py test/asynchronous/test_dns.py

.github/workflows/zizmor.yml

@@ -17,16 +17,5 @@ jobs:
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@9d7e65c320fdb52dcd45ffaa68deb6c02c8754d9 # v1
-      - name: Get zizmor
-        run: cargo install zizmor
       - name: Run zizmor 🌈
-        run: zizmor --format sarif . > results.sarif
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 # v3
-        with:
-          sarif_file: results.sarif
-          category: zizmor
+        uses: zizmorcore/zizmor-action@0f0557ab4a0b31211d42435e42df31cbd63fdd59