fix(worker): render TEMP_SCRIPT_REFS placeholder in Python runner-group loader.py (#11915)

* fix(worker): render TEMP_SCRIPT_REFS placeholder in Python runner-group loader.py

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: drop unrelated rustfmt churn in python_executor.rs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: cover relative imports in a python runner group, keep the raw loader private

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 32784f3907f0a25fee4a9f96fa172420f17b3fea

This commit updates the EE repository reference after PR #908 was merged in windmill-ee-private.

Previous ee-repo-ref: 6c36ef6e94dda5e43e04a5a08c00ef7eabb6d9a8

New ee-repo-ref: 32784f3907f0a25fee4a9f96fa172420f17b3fea

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ruben Fiszel <ruben@windmill.dev>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/ee-repo-ref.txt

@@ -1 +1 @@
-2c6f6c9d5415347d131cc5974d78d427446c10a7
+32784f3907f0a25fee4a9f96fa172420f17b3fea

backend/tests/dedicated_workers.rs

@@ -843,7 +843,8 @@ mod dedicated_worker_tests {
 
         let job_a = completed_job(uuid_a, &db).await;
         let job_b = completed_job(uuid_b, &db).await;
-        assert_eq!(job_a.json_result().unwrap(), json!(105));
+        // helper(5) = 50, + 100
+        assert_eq!(job_a.json_result().unwrap(), json!(150));
         assert_eq!(job_b.json_result().unwrap(), json!(205));
         assert_ran_on_dedicated_worker(&db, uuid_a, "python3").await;
         assert_ran_on_dedicated_worker(&db, uuid_b, "python3").await;

backend/tests/fixtures/dedicated_flows.sql

@@ -321,12 +321,13 @@ E'{"modules":[{"id":"a","value":{"type":"forloopflow","iterator":{"type":"javasc
 
 -- ============================================================
 -- Test: Python runner group
--- Two Python scripts sharing a workspace dependency annotation.
+-- Two Python scripts sharing a workspace dependency annotation. Script a has a
+-- relative import (helper defined below), so the group's loader.py is written.
 -- ============================================================
 INSERT INTO public.script(workspace_id, created_by, content, schema, summary, description, path, hash, language, lock, dedicated_worker) VALUES (
 'test-workspace',
 'system',
-E'# extra_requirements: f/system/dedicated_double\ndef main(x: int):\n    return x + 100',
+E'# extra_requirements: f/system/dedicated_double\nfrom .py_dedicated_helper import helper\n\ndef main(x: int):\n    return helper(x) + 100',
 '{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"x":{"type":"number","description":""}},"required":["x"],"type":"object"}',
 '', '',
 'f/system/py_rg_script_a', 300050, 'python3', '', true);

backend/windmill-worker/src/python_executor.rs

@@ -117,7 +117,7 @@ async fn handle_piptar_uploads(mut rx: tokio::sync::mpsc::UnboundedReceiver<Pipt
 const NSJAIL_CONFIG_DOWNLOAD_PY_CONTENT: &str = include_str!("../nsjail/download.py.config.proto");
 const NSJAIL_CONFIG_RUN_PYTHON3_CONTENT: &str = include_str!("../nsjail/run.python3.config.proto");
 const NSJAIL_CONFIG_LOCK_PY_CONTENT: &str = include_str!("../nsjail/lock.py.config.proto");
-pub const RELATIVE_PYTHON_LOADER: &str = include_str!("../loader.py");
+const RELATIVE_PYTHON_LOADER: &str = include_str!("../loader.py");
 
 /// Every file exchanged with a job is UTF-8 by construction, so the interpreter
 /// must agree. A job env carries no locale: Linux then picks UTF-8 on its own
@@ -129,7 +129,9 @@ pub const PYTHON_UTF8_ENVS: [(&str, &str); 1] = [("PYTHONUTF8", "1")];
 /// Python dict literal. Preview jobs pass a path -> temp-hash map so relative
 /// imports resolve from not-yet-deployed local content; deployed runs pass
 /// `None` which renders an empty dict (deployed resolution unchanged).
-fn render_relative_python_loader(temp_script_refs: &Option<HashMap<String, String>>) -> String {
+pub(crate) fn render_relative_python_loader(
+    temp_script_refs: &Option<HashMap<String, String>>,
+) -> String {
     let temp_refs_py = temp_script_refs
         .as_ref()
         .and_then(|m| serde_json::to_string(m).ok())