Add PyPI trusted-publishing workflow; cap inspect-ai, enrich metadata

Release workflow publishes via PyPI Trusted Publishing (OIDC, no stored token);
a build + twine check job gates the publish job, which runs in the 'pypi'
environment and triggers only on a published GitHub Release. pyproject caps
inspect-ai <0.4 (pre-1.0 churn) and adds classifiers, keywords, project URLs.

Author: CTWalk

.github/workflows/publish.yml

@@ -0,0 +1,47 @@
+name: publish
+
+# Publishes to PyPI via Trusted Publishing (OIDC) — no API token is stored in
+# the repo or in Actions secrets. Register the pending publisher once on PyPI
+# (Project → Publishing): owner CTWalk, repo decision-contract-audit,
+# workflow publish.yml, environment pypi.
+#
+# Runs only when a GitHub Release is published (or manually via workflow_dispatch),
+# never on an ordinary push. The build job validates the distribution before the
+# publish job runs, and publish is gated on the `pypi` environment so a required
+# reviewer can approve the upload.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install --upgrade build twine
+      - run: python -m build
+      # Dry run / safety gate: validate metadata + README rendering. Fails the
+      # job — and therefore blocks publish — on any problem.
+      - run: python -m twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC token for PyPI Trusted Publishing; no stored secret
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

pyproject.toml

@@ -10,10 +10,34 @@ readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.10"
-dependencies = ["inspect-ai>=0.3.248"]
+# Upper cap: inspect-ai is pre-1.0 and its scorer/solver API still churns, so a
+# minor bump can break installs. Relax when a tested newer floor is verified.
+dependencies = ["inspect-ai>=0.3.248,<0.4"]
+keywords = [
+    "inspect-ai",
+    "llm",
+    "llm-evaluation",
+    "reliability",
+    "contract-testing",
+    "metamorphic-testing",
+    "test-oracles",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Software Development :: Testing",
+    "Topic :: Scientific/Engineering :: Artificial Intelligence",
+    "Operating System :: OS Independent",
+]
 
 [project.urls]
+Homepage = "https://github.com/CTWalk/decision-contract-audit"
 Repository = "https://github.com/CTWalk/decision-contract-audit"
+Issues = "https://github.com/CTWalk/decision-contract-audit/issues"
 
 [tool.setuptools]
 packages = ["decision_contracts"]