From bfa9d93f92793b8fb7286c295009f7549334f8c7 Mon Sep 17 00:00:00 2001
From: Michael D'Angelo <mdangelo@openai.com>
Date: Thu, 17 Sep 2026 21:08:34 +0000
Subject: [PATCH 1/2] fix(ci): set up Python for Windows package verification

---
 .github/workflows/node-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index f35c37671..cfba16ed8 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -597,6 +597,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
       - name: Set up Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

From 89992af6bfb726e98aa8a0ef25318eaf7828c962 Mon Sep 17 00:00:00 2001
From: Michael D'Angelo <mdangelo@openai.com>
Date: Fri, 18 Sep 2026 17:25:46 -0700
Subject: [PATCH 2/2] test(ci): cover Windows package prerequisites and release
 timing

---
 .../tests-ts/release-automation.test.ts       | 10 ++++----
 sdk/typescript/tests-ts/skeleton.test.ts      | 24 +++++++++++++++++++
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/sdk/typescript/tests-ts/release-automation.test.ts b/sdk/typescript/tests-ts/release-automation.test.ts
index 02be19530..317b05e1b 100644
--- a/sdk/typescript/tests-ts/release-automation.test.ts
+++ b/sdk/typescript/tests-ts/release-automation.test.ts
@@ -156,7 +156,7 @@ const {
 const releaseCommit = "1e03c89ad22d2df5ae65b146be1483b3608572a9";
 const releaseRun = "30481596229";
 const releaseRepository = "openai/codex-security";
-const releaseTagTimeout = process.platform === "win32" ? 20_000 : 10_000;
+const releaseWorkflowTimeout = process.platform === "win32" ? 20_000 : 10_000;
 
 const bash = bashCommand();
 
@@ -2189,7 +2189,7 @@ describe("GitHub release workflow safeguards", () => {
         RELEASE_SHA: releaseCommit,
         RELEASE_TAG: "npm-v0.1.2",
       },
-      timeout: releaseTagTimeout,
+      timeout: releaseWorkflowTimeout,
     });
 
     expect(result.status).toBe(0);
@@ -2258,7 +2258,7 @@ describe("GitHub release workflow safeguards", () => {
           MOCK_LOOKUP_RESPONSE: lookupResponse,
           RELEASE_TAG: "npm-v0.1.2",
         },
-        timeout: releaseTagTimeout,
+        timeout: releaseWorkflowTimeout,
       });
 
       expect(result.status).toBe(status);
@@ -2335,7 +2335,7 @@ describe("GitHub release workflow safeguards", () => {
           MOCK_TAG_TYPE: tagType,
           RELEASE_TAG: "npm-v0.1.2",
         },
-        timeout: releaseTagTimeout,
+        timeout: releaseWorkflowTimeout,
       });
 
       expect(result.status).toBe(status);
@@ -3711,7 +3711,7 @@ describe("GitHub release workflow safeguards", () => {
           RELEASE_TAG: "npm-v0.1.2",
           RELEASE_VERSION: "0.1.2",
         },
-        timeout: 10_000,
+        timeout: releaseWorkflowTimeout,
       });
 
       expect(result.status).toBe(status);
diff --git a/sdk/typescript/tests-ts/skeleton.test.ts b/sdk/typescript/tests-ts/skeleton.test.ts
index dc1e83bbd..c1a7a5e83 100644
--- a/sdk/typescript/tests-ts/skeleton.test.ts
+++ b/sdk/typescript/tests-ts/skeleton.test.ts
@@ -164,6 +164,30 @@ describe("TypeScript package skeleton", () => {
       "22.13.0",
       "24",
     ]);
+    const verificationSteps = jobs["windows-verify"]!.steps!;
+    const shardPython = jobs["windows-test"]!.steps!.find(({ uses }) =>
+      uses?.startsWith("actions/setup-python@"),
+    );
+    const pythonSetup = verificationSteps.findIndex(({ uses }) =>
+      uses?.startsWith("actions/setup-python@"),
+    );
+    const packageInspection = verificationSteps.findIndex(
+      ({ run }) => run === "node scripts/check-package.mjs ../../dist/*.tgz",
+    );
+    expect(shardPython?.uses).toMatch(/^actions\/setup-python@[a-f0-9]{40}$/);
+    expect(pythonSetup).toBeGreaterThanOrEqual(0);
+    expect(pythonSetup).toBeLessThan(packageInspection);
+    expect(verificationSteps[pythonSetup]).toMatchObject({
+      uses: shardPython?.uses,
+      with: { "python-version": "3.12" },
+    });
+    expect(verificationSteps[pythonSetup]).not.toHaveProperty("if");
+    expect(verificationSteps[pythonSetup]).not.toHaveProperty(
+      "continue-on-error",
+    );
+    expect([false, "false"]).not.toContain(
+      verificationSteps[pythonSetup]?.with?.["update-environment"],
+    );
     expect(jobs["required-test"]?.name).toBe("${{ matrix.os }} / node-22");
     expect(jobs["required-test"]?.needs).toEqual([
       "validate-title",