ci: add test + publish workflows for the Inspect integration package

test-inspect-python.yml: runs ruff + pytest across Python 3.10–3.13. Triggered
only when integrations/inspect-python/** or sdks/python/** changes (an SDK
change, including a version bump, can break the integration). Installs the
in-repo SDK from source first because the integration needs LLMGeneratorProtocol
(SDK 0.3.0), which is not yet on PyPI.

publish-inspect-python.yml: builds + publishes to PyPI on
integrations-inspect-python-v* release tags, mirroring publish-python-sdk.yml.
Header documents the two pre-publish steps: tighten the SDK floor to >=0.3.0 and
remove release-as after 0.1.0 ships.

Author: adnanrhussain

.github/workflows/publish-inspect-python.yml

@@ -0,0 +1,59 @@
+# ─── Before the first publish (integrations-inspect-python-v0.1.0) ───────────
+#
+# 1. Tighten the SDK dependency. integrations/inspect-python/pyproject.toml pins
+#    `learning-commons-evaluators>=0.2.0`, but the integration requires the
+#    LLMGeneratorProtocol / llm_provider support that ships in SDK 0.3.0. Raise
+#    the floor to `>=0.3.0` once 0.3.0 is on PyPI — and do not publish this
+#    package before then, or installs resolve a SDK without llm_provider.
+#
+# 2. Remove `release-as: "0.1.0"` from the integrations/inspect-python block in
+#    release-please-config.json IMMEDIATELY after 0.1.0 lands on PyPI. It is a
+#    sticky pin: every later release-please PR stays at 0.1.0 until removed, and
+#    `skip-existing: true` below silently hides the duplicate-version rejection.
+#
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: Publish Inspect integration
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  publish:
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'integrations-inspect-python-v')
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    defaults:
+      run:
+        working-directory: integrations/inspect-python
+    concurrency:
+      group: publish-inspect-python
+      cancel-in-progress: false
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@v6
+
+      - name: 🐍 Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: 📥 Install build tooling
+        run: python -m pip install --upgrade build twine
+
+      - name: 📦 Build sdist + wheel
+        run: python -m build
+
+      - name: 🧪 Validate distribution metadata
+        run: python -m twine check dist/*
+
+      - name: 🚀 Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: integrations/inspect-python/dist
+          skip-existing: true

.github/workflows/test-inspect-python.yml

@@ -0,0 +1,63 @@
+name: 🔍 Test Inspect integration
+
+# Runs only when the integration package itself changes, or when the Python SDK
+# it depends on changes (a SDK change — including a version bump — can break the
+# integration, so we re-verify here too).
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "integrations/inspect-python/**"
+      - "sdks/python/**"
+      - "sdks/settings/**"
+      - ".github/workflows/test-inspect-python.yml"
+  pull_request:
+    paths:
+      - "integrations/inspect-python/**"
+      - "sdks/python/**"
+      - "sdks/settings/**"
+      - ".github/workflows/test-inspect-python.yml"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install in-repo SDK + integration package
+        # Install the SDK from source first: the integration relies on
+        # LLMGeneratorProtocol (SDK >=0.3.0), which is not yet on PyPI. The
+        # editable install satisfies the >=0.2.0 floor while providing the
+        # unreleased protocol code, so CI tests against current monorepo state.
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ./sdks/python
+          pip install -e "./integrations/inspect-python[dev]"
+
+      - name: Lint
+        working-directory: integrations/inspect-python
+        run: |
+          python -m ruff check .
+          python -m ruff format --check .
+
+      - name: Test
+        working-directory: integrations/inspect-python
+        run: python -m pytest