test(downstream): validate the latest MLflow Git integration

Add MLflow's released Git project and context tests to the shared local
runner and CI matrix. Rank the project by `mlflow-skinny` downloads without
summing overlapping distributions, resolve its current PyPI release, and
check out the matching `v{version}` source tag for unchanged upstream tests.

Install the matching full `mlflow` package because upstream global fixtures
need its server and SQLite support. Clear `CI` and `GITHUB_ACTIONS` inside
the isolated run to avoid unrelated upstream wheel builds and conda
cleanup. Disable telemetry and keep the venv first on `PATH` so project
subprocesses use the same editable GitPython checkout.

The shared runner passes all 47 selected tests for MLflow 3.16.1 on Python
3.12 and Git 2.54, including 31 repository/project/model-versioning cases and 16 Git
context or credential-redaction contract cases. Validation started with
both CI variables set, exercising the CI isolation. Public example clones
and a localhost HTTP server are required; no cloud services or models are
needed. The model-versioning cases also cover staged/unstaged diffs and
dirty-state handling. No GitPython compatibility changes were necessary.

Author: codex

.github/workflows/downstream.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        project: [bandit]
+        project: [mlflow, bandit]
     steps:
       - uses: actions/checkout@v7
         with:

test/downstream/README.md

@@ -30,6 +30,7 @@ and test-only dependencies are excluded. Downloads are not unique installations.
 
 | Project | Distribution downloads | Last tested release | Selected coverage |
 | --- | ---: | --- | --- |
+| MLflow (`mlflow-skinny`) | 25,850,354 | 3.16.1 | 47 upstream tests: 31 repository/project/model-versioning cases plus 16 Git context and credential-redaction contract cases |
 | Bandit | 24,935,372 | 1.9.4 | 12 upstream baseline CLI tests: real repository creation, commits, branches, resets, discovery, and dirty state |
 
 Source: [top-pypi-packages](https://hugovk.github.io/top-pypi-packages/top-pypi-packages.min.json),
@@ -40,6 +41,19 @@ distributions was checked, together with known runtime integrations.
 
 Bandit's GitPython dependency belongs to its user-facing `baseline` extra.
 Two selected tests mock error paths; the others use real repositories.
+
+MLflow is counted once, using its largest consuming distribution,
+`mlflow-skinny`, without adding overlapping distribution counts. The tests install
+the matching full `mlflow` release because upstream global fixtures import its
+server and SQLite tracking support. Selected cases cover branches, fetches,
+checkout, invalid versions, Git context, remote URLs, Python subprocesses, dirty
+repositories, and staged/unstaged model-versioning diffs.
+Some tests clone the public `mlflow/mlflow-example` repository or start a localhost
+HTTP server. `CI` and `GITHUB_ACTIONS` are unset only for downstream setup/tests:
+upstream autouse fixtures otherwise build wheels and modify conda environments.
+No model downloads, cloud credentials, or external tracking server are needed.
+CLI examples that train models or need private SSH credentials are excluded.
+
 CI runs the same command against the latest release and fails when no test passes,
 including when all selected tests are skipped. Test dependency ranges only supply
 the upstream test harness; they do not pin the dependent's release.

test/downstream/projects.json

@@ -1,4 +1,26 @@
 {
+  "mlflow": {
+    "distribution": "mlflow-skinny",
+    "source": "git",
+    "repository": "https://github.com/mlflow/mlflow.git",
+    "tag": "v{version}",
+    "install": ["mlflow=={version}", "pytest>=9,<10", "pytest-timeout", "psutil"],
+    "unset_env": ["CI", "GITHUB_ACTIONS"],
+    "env": {"MLFLOW_DISABLE_TELEMETRY": "true"},
+    "tests": [
+      "tests/genai/test_git_versioning.py",
+      "tests/projects/test_utils.py::test__fetch_project",
+      "tests/projects/test_utils.py::test__fetch_git_repo",
+      "tests/projects/test_utils.py::test_fetch_git_repo_commit",
+      "tests/projects/test_utils.py::test_fetching_non_existing_version_fails",
+      "tests/projects/test_utils.py::test_fetch_project_validations",
+      "tests/projects/test_utils.py::test_is_valid_branch_name",
+      "tests/projects/test_projects.py::test_run_local_git_repo",
+      "tests/projects/test_projects.py::test_invalid_version_local_git_repo",
+      "tests/tracking/context/test_git_context.py",
+      "tests/utils/test_git_utils.py"
+    ]
+  },
   "bandit": {
     "distribution": "bandit",
     "source": "sdist",