Summary

drivers-evergreen-tools installs mongo-orchestration from https://github.com/mongodb/mongo-orchestration/archive/master.tar.gz, so every Evergreen task on every host fetches a moving branch tarball at setup time. Task environments are not reproducible, and one fetch failure at GitHub fails every task that starts a server.

Master is one commit ahead of 0.11.2, and that commit only bumps the version string, so pinning to the released version on PyPI loses nothing.

Motivation

Who is the affected end user?

Maintainers of drivers-evergreen-tools, and every driver team whose Evergreen tasks use it to start server topologies.

How does this affect the end user?

A transient network failure fails dozens of tasks at once instead of degrading one, and the only recourse is to restart. Logs also do not record which revision actually ran.

How likely is it that this problem or use case will occur?

Main path. Every task that starts a server fetches the tarball, on every run.

If the problem does occur, what are the consequences and how severe are they?

Fleet-wide CI failure. Patch 6a7ccdc48cd3370007104936 lost 37 tasks across 14 build variants, spanning rhel7, rhel8, debian11, debian12, amazon2023, ubuntu, macOS, Windows, and power8, all with:

× Failed to download and build `mongo-orchestration @ ...
├─▶ Failed to fetch:
├─▶ error sending request for url
├─▶ client error (SendRequest)
├─▶ http2 error
╰─▶ stream error received: refused stream before processing any application

The failures reached post blocks too, so teardown broke alongside the tests.

Is this issue urgent?

No fixed timeline. The cost accrues in wasted patch runs whenever the fetch is throttled.

Is this ticket required by a downstream team?

No specific downstream ask. It benefits every driver team running Evergreen tasks through this repository.

Is this ticket only for tests?

Test infrastructure only. No product behavior changes.

Acceptance Criteria

• drivers-evergreen-tools depends on the released mongo-orchestration version from PyPI, and the lockfile records it.
• No branch tarball remains as the source for this dependency.
• The resolved dependencies still support the old server versions downstream projects test against, per the contributing guide.
• A patch build passes the tasks that build the orchestration environment.