Set up PyPI publishing via trusted publishing

.copier-answers.yml

@@ -5,10 +5,10 @@ _src_path: gh:MattFisher/python-project-template
 author_email: m@ttfisher.com
 author_name: Matt Fisher
 github_owner: Generality-Labs
-license: Proprietary
+license: MIT
 project_description: Dataset quality scanner for AI evaluation datasets
 project_kind: library
 project_name: inspect-dataset
-publish_to_pypi: false
+publish_to_pypi: true
 python_version: '3.12'
 use_coverage_gate: false

.github/workflows/release.yml

@@ -0,0 +1,57 @@
+name: Release
+
+# Publishes to PyPI via trusted publishing (OIDC) when a version tag is pushed.
+# One-time PyPI setup: add a Trusted Publisher for this repository
+# (owner: Generality-Labs, repository: inspect_dataset, workflow: release.yml,
+# environment: pypi) at https://pypi.org/manage/account/publishing/.
+#
+# Release flow:
+#   1. bump `version` in pyproject.toml (and src/inspect_dataset/__init__.py if present)
+#   2. tag: git tag vX.Y.Z && git push origin vX.Y.Z
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+# One release at a time; never cancel a publish in flight.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish to PyPI
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write # OIDC token for PyPI trusted publishing
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          # No cache restore in the publish job — a poisoned cache could
+          # tamper with what gets uploaded to PyPI (zizmor: cache-poisoning).
+          enable-cache: false
+
+      - name: Check tag matches package version
+        run: |
+          pkg_version=$(uv version --short)
+          tag_version="${GITHUB_REF_NAME#v}"
+          if [ "$pkg_version" != "$tag_version" ]; then
+            echo "Tag $GITHUB_REF_NAME does not match pyproject version $pkg_version" >&2
+            exit 1
+          fi
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        run: uv publish --trusted-publishing always

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Matt Fisher
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -143,6 +143,19 @@ Each finding includes the scanner name, severity, category, explanation, sample
 
 inspect-scout tracks which samples models consistently fail or succeed on. inspect-dataset provides a complementary static pass before running evals. A future release will accept inspect-scout results directly to produce eval-informed findings and a `clean_ids.txt` export for quality-adjusted benchmark scores.
 
+## Releasing
+
+Releases publish to PyPI via [trusted publishing](https://docs.pypi.org/trusted-publishers/) — no API tokens. One-time setup: add a Trusted Publisher on PyPI for `Generality-Labs/inspect_dataset`, workflow `release.yml`, environment `pypi`.
+
+```bash
+uv version --bump minor      # or: patch / major — updates pyproject.toml
+git commit -am "Release $(uv version --short)"
+git tag "v$(uv version --short)"
+git push origin main "v$(uv version --short)"
+```
+
+The tag push triggers `.github/workflows/release.yml`, which checks the tag against the package version, builds with `uv build`, and publishes.
+
 ## Development
 
 ```bash

pyproject.toml

@@ -3,6 +3,8 @@ name = "inspect-dataset"
 version = "0.3.4"
 description = "Dataset quality scanner for AI evaluation datasets"
 readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
 authors = [
     { name = "Matt Fisher", email = "m@ttfisher.com" }
 ]
@@ -28,6 +30,12 @@ inspect = [
 requires = ["uv_build>=0.8.17,<0.9.0"]
 build-backend = "uv_build"
 
+[tool.uv.build-backend]
+# The viewer frontend ships only as its built bundle (_view/www/dist);
+# node_modules must never reach the sdist or wheel.
+source-exclude = ["**/node_modules/**"]
+wheel-exclude = ["**/node_modules/**"]
+
 [tool.ruff]
 line-length = 100
 src = ["src"]