🎨 minor improvement on CI reliability

.github/workflows/ci.yml

@@ -55,6 +55,15 @@ jobs:
           - experimental: true
             python-version: "3.14"
             os: ubuntu-22.04
+            traefik-server: true
+          - experimental: true
+            python-version: "3.14"
+            os: macos-13
+            traefik-server: true
+          - experimental: true
+            python-version: "3.14"
+            os: windows-2022
+            traefik-server: true
           - python-version: "pypy-3.7"
             os: ubuntu-22.04
             experimental: false
@@ -64,7 +73,7 @@ jobs:
             experimental: false
             nox-session: test-pypy
             traefik-server: true
-          - python-version: "pypy-3.9-v7.3.13"  # urllib3#3308
+          - python-version: "pypy-3.9"
             os: ubuntu-22.04
             experimental: false
             nox-session: test-pypy
@@ -94,17 +103,21 @@ jobs:
     runs-on: ${{ matrix.os }}
     name: ${{ fromJson('{"macos-13":"macOS","windows-2022":"Windows","ubuntu-20.04":"Ubuntu 20.04 (OpenSSL 1.1.1)","ubuntu-22.04":"Ubuntu 22 (OpenSSL 3+)"}')[matrix.os] }} ${{ matrix.python-version }} ${{ matrix.nox-session }}
     continue-on-error: ${{ matrix.experimental }}
-    timeout-minutes: 40
+    timeout-minutes: 60
     steps:
       - name: "Checkout repository"
         uses: "actions/checkout@d632683dd7b4114ad314bca15554477dd762a938"
 
       - name: "Traefik: Prerequisites - Colima (MacOS)"
         if: ${{ matrix.traefik-server && contains(matrix.os, 'mac') }}
-        uses: douglascamata/setup-docker-macos-action@8d5fa43892aed7eee4effcdea113fd53e4d4bf83
+        uses: douglascamata/setup-docker-macos-action@4fe96839fcba8a2d746e020d00a89a37afbc7dc9
         with:
           colima-network-address: true
 
+      - name: "Colima VM List (MacOS)"
+        if: ${{ matrix.traefik-server && contains(matrix.os, 'mac') }}
+        run: colima list
+
       - name: "Setup Python ${{ matrix.python-version }}"
         uses: "actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3"
         with:
@@ -121,7 +134,7 @@ jobs:
           NOX_SESSION: ${{ matrix.nox-session }}
           TRAEFIK_HTTPBIN_ENABLE: ${{ matrix.traefik-server }}
           # on MacOS, the Colima VM is located at "192.168.106.2" by default.
-          TRAEFIK_HTTPBIN_IPV4: ${{ contains(matrix.os, 'mac') && '192.168.106.2' || '127.0.0.1' }}
+          TRAEFIK_HTTPBIN_IPV4: ${{ contains(matrix.os, 'mac') && '192.168.65.2' || '127.0.0.1' }}
 
       - name: "Upload artifact"
         uses: "actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce"
@@ -130,7 +143,6 @@ jobs:
           path: ".coverage.*"
           if-no-files-found: error
 
-
   coverage:
     if: always()
     runs-on: "ubuntu-latest"

noxfile.py

@@ -120,32 +120,16 @@ def traefik_boot(
                 "./traefik/patched.Dockerfile", "./go-httpbin/patched.Dockerfile"
             )
 
-            pre_build = subprocess.Popen(
+            dc_process = subprocess.Popen(
                 [
                     "docker",
                     "compose",
                     "-f",
                     "docker-compose.win.yaml",
-                    "build",
-                    "httpbin",
+                    "up",
+                    "-d",
                 ]
             )
-
-            pre_build.wait()
-
-            if pre_build.returncode == 0:
-                dc_process = subprocess.Popen(
-                    [
-                        "docker",
-                        "compose",
-                        "-f",
-                        "docker-compose.win.yaml",
-                        "up",
-                        "-d",
-                    ]
-                )
-            else:
-                raise OSError("Unable to build go-httpbin on Windows")
         else:
             if dc_v1_legacy:
                 dc_process = subprocess.Popen(["docker-compose", "up", "-d"])
@@ -359,6 +343,7 @@ def downstream_niquests(session: nox.Session) -> None:
         "-v",
         f"--color={'yes' if 'GITHUB_ACTIONS' in os.environ else 'auto'}",
         *(session.posargs or ("tests/",)),
+        env={"NIQUESTS_STRICT_OCSP": "1"},
     )
 
 

pyproject.toml

@@ -106,6 +106,7 @@ markers = ["limit_memory"]
 log_level = "DEBUG"
 filterwarnings = [
     "error",
+    '''ignore:.*iscoroutinefunction.*:DeprecationWarning''',
     '''default:ssl\.PROTOCOL_TLS is deprecated:DeprecationWarning''',
     '''default:ssl\.PROTOCOL_TLSv1 is deprecated:DeprecationWarning''',
     '''default:ssl\.TLSVersion\.TLSv1_1 is deprecated:DeprecationWarning''',
@@ -127,7 +128,6 @@ filterwarnings = [
     '''ignore:ssl\.TLSVersion\.TLSv1 is deprecated:DeprecationWarning''',
     '''ignore:ssl\.TLSVersion\.TLSv1_1 is deprecated:DeprecationWarning''',
     '''ignore:loop is closed:ResourceWarning''',
-    '''ignore:iscoroutinefunction:DeprecationWarning''',
 ]
 
 [tool.isort]

src/urllib3/_version.py

@@ -1,4 +1,4 @@
 # This file is protected via CODEOWNERS
 from __future__ import annotations
 
-__version__ = "2.12.900"
+__version__ = "2.12.901"

src/urllib3/contrib/ssa/__init__.py

@@ -116,7 +116,17 @@ async def wait_for_close(self) -> None:
             await asyncio.sleep(0)
             self._writer.transport.abort()
 
-        await self._writer.wait_closed()
+        try:
+            # wait_closed can hang indefinitely!
+            # on Python 3.8 and 3.9
+            # there's some case where Python want an explicit EOT
+            # (spoiler: it was a CPython bug) fixed in recent interpreters.
+            # to circumvent this and still have a proper close
+            # we enforce a maximum delay (1000ms).
+            async with timeout(1):
+                await self._writer.wait_closed()
+        except TimeoutError:
+            pass
 
     def close(self) -> None:
         if self._writer is not None:

src/urllib3/contrib/webextensions/_async/sse.py

@@ -33,8 +33,13 @@ def urlopen_kwargs(self) -> dict[str, typing.Any]:
     async def close(self) -> None:
         if self._stream is not None and self._response is not None:
             await self._stream.aclose()
-            if self._response._fp is not None and hasattr(self._response._fp, "abort"):
-                await self._response._fp.abort()
+            if (
+                self._response._fp is not None
+                and self._police_officer is not None
+                and hasattr(self._response._fp, "abort")
+            ):
+                async with self._police_officer.borrow(self._response):
+                    await self._response._fp.abort()
             self._stream = None
             self._response = None
             self._police_officer = None

src/urllib3/contrib/webextensions/sse.py

@@ -91,8 +91,13 @@ def closed(self) -> bool:
     def close(self) -> None:
         if self._stream is not None and self._response is not None:
             self._stream.close()
-            if self._response._fp is not None and hasattr(self._response._fp, "abort"):
-                self._response._fp.abort()
+            if (
+                self._response._fp is not None
+                and self._police_officer is not None
+                and hasattr(self._response._fp, "abort")
+            ):
+                with self._police_officer.borrow(self._response):
+                    self._response._fp.abort()
             self._stream = None
             self._response = None
             self._police_officer = None

test/__init__.py

@@ -70,7 +70,7 @@
 SHORT_TIMEOUT = 0.001
 LONG_TIMEOUT = 0.3
 if os.environ.get("CI") or os.environ.get("GITHUB_ACTIONS") == "true":
-    LONG_TIMEOUT = 0.6
+    LONG_TIMEOUT = 1.5
 
 DUMMY_POOL = ConnectionPool("dummy")
 

test/with_dummyserver/test_socketlevel.py

@@ -587,10 +587,10 @@ def socket_handler(listener: socket.socket) -> None:
 
         # In situations where the main thread throws an exception, the server
         # thread can hang on an accept() call. This ensures everything times
-        # out within 1 second. This should be long enough for any socket
+        # out within 3 second. This should be long enough for any socket
         # operations in the test suite to complete
         default_timeout = socket.getdefaulttimeout()
-        socket.setdefaulttimeout(1)
+        socket.setdefaulttimeout(3)
 
         try:
             self._start_server(socket_handler)

test/with_traefik/asynchronous/test_connection.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import socket
+
 import pytest
 
 from urllib3 import HttpVersion
@@ -207,13 +209,22 @@ async def test_quic_extract_ssl_ctx_ca_root(self) -> None:
         await conn.close()
 
     async def test_fast_reuse_outgoing_port(self) -> None:
+        def _get_free_port(host: str) -> int:
+            s = socket.socket()
+            s.bind((host, 0))
+            port = s.getsockname()[1]
+            s.close()
+            return port  # type: ignore[no-any-return]
+
+        _tba_port = _get_free_port("localhost")
+
         for _ in range(4):
             conn = AsyncHTTPSConnection(
                 self.host,
                 self.https_port,
                 ca_certs=self.ca_authority,
                 resolver=self.test_async_resolver.new(),
-                source_address=("0.0.0.0", 8789),
+                source_address=("0.0.0.0", _tba_port),
             )
 
             await conn.connect()

test/with_traefik/asynchronous/test_send_data.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import io
+import os
+import platform
 from base64 import b64decode
 from io import BytesIO
 
@@ -92,7 +94,17 @@ async def test_h2n3_data(self, method: str, body: bytes | str | BytesIO) -> None
                 assert resp.status == 200
 
                 if _HAS_HTTP3_SUPPORT():
-                    assert resp.version == (20 if i == 0 else 30)
+                    # colima is our only way to test HTTP/2 and HTTP/3 in GHA runners
+                    # its known to have flaky behaviors. We can lose the connection easily...
+                    # and our automatic downgrade to HTTP/2 makes the following assert
+                    # problematic!
+                    if (
+                        os.environ.get("CI") is not None
+                        and platform.system() == "Darwin"
+                    ):
+                        assert resp.version in {20, 30}
+                    else:
+                        assert resp.version == (20 if i == 0 else 30)
                 else:
                     assert resp.version == 20
 
@@ -152,7 +164,17 @@ async def test_h2n3_form_field(self, method: str, fields: dict[str, str]) -> Non
 
                 assert resp.status == 200
                 if _HAS_HTTP3_SUPPORT():
-                    assert resp.version == (20 if i == 0 else 30)
+                    # colima is our only way to test HTTP/2 and HTTP/3 in GHA runners
+                    # its known to have flaky behaviors. We can lose the connection easily...
+                    # and our automatic downgrade to HTTP/2 makes the following assert
+                    # problematic!
+                    if (
+                        os.environ.get("CI") is not None
+                        and platform.system() == "Darwin"
+                    ):
+                        assert resp.version in {20, 30}
+                    else:
+                        assert resp.version == (20 if i == 0 else 30)
                 else:
                     assert resp.version == 20
 

test/with_traefik/asynchronous/test_stream.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import os
+import platform
 from json import JSONDecodeError, loads
 
 import pytest
@@ -37,7 +39,17 @@ async def test_h2n3_stream(self, amt: int | None) -> None:
 
                 assert resp.status == 200
                 if _HAS_HTTP3_SUPPORT():
-                    assert resp.version == (20 if i == 0 else 30)
+                    # colima is our only way to test HTTP/2 and HTTP/3 in GHA runners
+                    # its known to have flaky behaviors. We can lose the connection easily...
+                    # and our automatic downgrade to HTTP/2 makes the following assert
+                    # problematic!
+                    if (
+                        os.environ.get("CI") is not None
+                        and platform.system() == "Darwin"
+                    ):
+                        assert resp.version in {20, 30}
+                    else:
+                        assert resp.version == (20 if i == 0 else 30)
                 else:
                     assert resp.version == 20
 

test/with_traefik/test_connection.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import socket
+
 import pytest
 
 from urllib3 import HttpVersion
@@ -201,13 +203,22 @@ def test_quic_extract_ssl_ctx_ca_root(self) -> None:
         conn.close()
 
     def test_fast_reuse_outgoing_port(self) -> None:
+        def _get_free_port(host: str) -> int:
+            s = socket.socket()
+            s.bind((host, 0))
+            port = s.getsockname()[1]
+            s.close()
+            return port  # type: ignore[no-any-return]
+
+        _tba_port = _get_free_port("localhost")
+
         for _ in range(4):
             conn = HTTPSConnection(
                 self.host,
                 self.https_port,
                 ca_certs=self.ca_authority,
                 resolver=self.test_resolver.new(),
-                source_address=("0.0.0.0", 50010),
+                source_address=("0.0.0.0", _tba_port),
             )
 
             conn.connect()

test/with_traefik/test_send_data.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import io
+import os
+import platform
 from base64 import b64decode
 from io import BytesIO
 
@@ -91,7 +93,17 @@ def test_h2n3_data(self, method: str, body: bytes | str | BytesIO) -> None:
                 assert resp.status == 200
 
                 if _HAS_HTTP3_SUPPORT():
-                    assert resp.version == (20 if i == 0 else 30)
+                    # colima is our only way to test HTTP/2 and HTTP/3 in GHA runners
+                    # its known to have flaky behaviors. We can lose the connection easily...
+                    # and our automatic downgrade to HTTP/2 makes the following assert
+                    # problematic!
+                    if (
+                        os.environ.get("CI") is not None
+                        and platform.system() == "Darwin"
+                    ):
+                        assert resp.version in {20, 30}
+                    else:
+                        assert resp.version == (20 if i == 0 else 30)
                 else:
                     assert resp.version == 20
 
@@ -151,7 +163,17 @@ def test_h2n3_form_field(self, method: str, fields: dict[str, str]) -> None:
 
                 assert resp.status == 200
                 if _HAS_HTTP3_SUPPORT():
-                    assert resp.version == (20 if i == 0 else 30)
+                    # colima is our only way to test HTTP/2 and HTTP/3 in GHA runners
+                    # its known to have flaky behaviors. We can lose the connection easily...
+                    # and our automatic downgrade to HTTP/2 makes the following assert
+                    # problematic!
+                    if (
+                        os.environ.get("CI") is not None
+                        and platform.system() == "Darwin"
+                    ):
+                        assert resp.version in {20, 30}
+                    else:
+                        assert resp.version == (20 if i == 0 else 30)
                 else:
                     assert resp.version == 20