PYTHON-6071 Fix ML-KEM OCSP tests and run min-deps OCSP task on PRs

[blink1073]

PYTHON-6071

Changes in this PR

• Replaced real ML-KEM key generation in two OCSP tests with MagicMock(spec=...), so they no longer depend on cryptography's backend supporting ML-KEM.
• Added a min-deps stapled OCSP task to the PR-triggered Evergreen variant, alongside the existing latest-CPython one.
• Scoped both PR-gated OCSP tasks to one algorithm (ecdsa) to keep PR CI at two tasks instead of four.

Test Plan

• pytest test/test_ocsp_support.py::TestVerifySignature -m ocsp: 9 passed, including under a min-deps (cryptography==47.0.0) environment where they previously failed with UnsupportedAlgorithm.
• just lint and just typing: clean.

Checklist

Checklist for Author

• Did you update the changelog (if necessary)? Not needed (test/CI-only fix).
• Is there test coverage? Yes, and it now runs on every PR.
• Is any followup work tracked in a JIRA ticket? If so, add link(s). None; PYTHON-6071 is caused-by PYTHON-6032.

Checklist for Reviewer

• Does the title of the PR reference a JIRA Ticket?
• Do you fully understand the implementation? (Would you be comfortable explaining how this code works to someone else?)
• Is all relevant documentation (README or docstring) updated?

[Copilot]

🟢 Approval recommended

The changes are narrowly scoped to tests and CI configuration, and the updated mocking approach and task tagging align with the intended OCSP behavior without introducing functional driver risk.

Pull request overview

This PR fixes OCSP signature-verification tests that were failing under the min-deps CI environment due to cryptography’s OpenSSL build lacking ML-KEM support, and updates Evergreen config generation so PR CI runs a minimal, targeted set of stapled-OCSP tasks (including min-deps) to catch backend regressions before merge.

Changes:

• Updated ML-KEM “fails closed” OCSP unit tests to use MagicMock(spec=MLKEM*PublicKey) instead of generating real ML-KEM keys.
• Added a PR-only Evergreen build variant that runs stapled OCSP tasks selected by the .pr tag.
• Adjusted OCSP task tagging so PR CI runs exactly two stapled OCSP tasks (ECDSA only): one min-deps (4.4) and one latest-CPython (latest, with coverage).

File summaries

File	Description
test/test_ocsp_support.py	Reworks ML-KEM OCSP signature tests to avoid relying on runtime ML-KEM support in the local cryptography/OpenSSL build.
.evergreen/scripts/generate_config.py	Generates a PR-only “OCSP Staples” variant and tags only the intended ECDSA stapled OCSP tasks for PR execution (min-deps + latest).
.evergreen/generated_configs/variants.yml	Adds the generated PR build variant for stapled OCSP tasks on the default host.
.evergreen/generated_configs/tasks.yml	Reflects the new PR tagging behavior (adds PR tag for the selected ECDSA tasks; removes PR tagging/coverage from RSA stapled task).

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The changes are consistent with the PR description, appear internally coherent (tests + config generation + generated outputs), and reduce CI fragility without altering runtime driver behavior.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[codeowners-service-app]

Assigned caseyclements for team dbx-python because NoahStapp is out of office.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[caseyclements]

LGTM