fix: address medium CI/test review feedback from upstream-test-suite

.github/workflows/test.yaml

@@ -8,6 +8,7 @@ jobs:
   python-tests:
     name: Python tests (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
     strategy:
       fail-fast: false
       matrix:
@@ -21,7 +22,9 @@ jobs:
         with:
           python-version: "3.11"
           cache: "pip"
-          cache-dependency-path: libs/openant-core/requirements.txt
+          cache-dependency-path: |
+            libs/openant-core/requirements.txt
+            libs/openant-core/pyproject.toml
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
@@ -32,7 +35,7 @@ jobs:
 
       - name: Install Python dependencies
         working-directory: libs/openant-core
-        run: pip install -r requirements.txt && pip install pytest
+        run: pip install -r requirements.txt && pip install ".[dev]"
 
       - name: Cache JS parser node_modules
         id: cache-node-modules
@@ -53,6 +56,9 @@ jobs:
   go-tests:
     name: Go build + integration (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    env:
+      OPENANT_PYTHON: python
     strategy:
       fail-fast: false
       matrix:
@@ -72,7 +78,9 @@ jobs:
         with:
           python-version: "3.11"
           cache: "pip"
-          cache-dependency-path: libs/openant-core/requirements.txt
+          cache-dependency-path: |
+            libs/openant-core/requirements.txt
+            libs/openant-core/pyproject.toml
 
       - name: Set up Node.js
         uses: actions/setup-node@v6
@@ -107,7 +115,7 @@ jobs:
 
       - name: Install Python dependencies
         working-directory: libs/openant-core
-        run: pip install -r requirements.txt && pip install pytest
+        run: pip install -r requirements.txt && pip install ".[dev]"
 
       - name: Cache JS parser node_modules
         id: cache-node-modules

apps/openant-cli/internal/python/runtime.go

@@ -46,9 +46,34 @@ func venvPython() string {
 // DetectRuntime finds a suitable Python 3.11+ installation.
 //
 // Search order:
-//  1. Managed venv at ~/.openant/venv/ (if it exists and is valid)
-//  2. python3 / python on PATH
+//  1. OPENANT_PYTHON env var (if set and valid) — set this to pin a specific
+//     interpreter for debugging, CI, or container use (e.g. OPENANT_PYTHON=python3.11).
+//  2. Managed venv at ~/.openant/venv/ (if it exists and is valid)
+//  3. python3 / python on PATH
+//
+// Note: the managed-venv path (strategy 2) uses "bin/python" which is correct
+// on Linux/macOS. On Windows the venv layout uses "Scripts\python.exe"; users
+// on Windows who rely on the managed venv should set OPENANT_PYTHON explicitly
+// to point at the desired interpreter.
 func DetectRuntime() (*RuntimeInfo, error) {
+	// Strategy 0: honour explicit override via OPENANT_PYTHON env var.
+	// If the override is set but unusable, warn and fall through rather than
+	// silently using a different interpreter behind the caller's back.
+	if override := os.Getenv("OPENANT_PYTHON"); override != "" {
+		info, err := checkPython(override)
+		if err != nil {
+			fmt.Fprintf(os.Stderr,
+				"warning: OPENANT_PYTHON=%q is not a usable Python binary (%v); ignoring override\n",
+				override, err)
+		} else if info.Major > MinPythonMajor || (info.Major == MinPythonMajor && info.Minor >= MinPythonMinor) {
+			return info, nil
+		} else {
+			fmt.Fprintf(os.Stderr,
+				"warning: OPENANT_PYTHON=%q is Python %s, below the required %d.%d; ignoring override\n",
+				override, info.Version, MinPythonMajor, MinPythonMinor)
+		}
+	}
+
 	// Strategy 1: check managed venv
 	vp := venvPython()
 	if fileExists(vp) {

libs/openant-core/tests/test_go_cli.py

@@ -123,9 +123,15 @@ def test_parse_js_repo(self, sample_js_repo, tmp_path):
         )
         if result.returncode != 0:
             if "No module named" in result.stderr:
-                pytest.skip("Go CLI using system Python without required packages")
+                if sys.platform == "win32":
+                    pytest.skip("Go CLI using system Python without required packages (Windows)")
+                else:
+                    pytest.fail("Go CLI resolved wrong Python (missing required packages)")
             if "UnicodeEncodeError" in result.stderr:
-                pytest.skip("Pre-existing Unicode bug in JS test_pipeline.py on Windows")
+                if sys.platform == "win32":
+                    pytest.skip("Pre-existing Unicode bug in JS test_pipeline.py on Windows")
+                else:
+                    pytest.fail("UnicodeEncodeError from JS parser on non-Windows (unexpected regression)")
         assert result.returncode == 0
         envelope = json.loads(result.stdout)
         assert envelope["status"] == "success"