Align PyPI publish workflow OIDC claims with trusted publisher configuration

[Copilot]

The build-and-publish GitHub Actions job was failing during PyPI trusted publishing with invalid-publisher. The job token claims showed environment: MISSING, which prevented claim matching on the PyPI publisher side.

• Root cause

  • build-and-publish in .github/workflows/pypi.yml did not run under the expected GitHub environment, so OIDC claims did not include the environment required by trusted publishing.

• Change

  • Added the PyPI environment to the publish job:
    • environment: pypi

• Workflow impact

  • Ensures the OIDC token includes environment-scoped claims expected by the configured PyPI trusted publisher.
  • Keeps existing publish behavior intact (skip-existing: true, same build/check/publish steps).

jobs:
  build-and-publish:
    runs-on: ubuntu-latest
    environment: pypi
    permissions:
      id-token: write

[Copilot]

Pull request overview

This PR fixes PyPI Trusted Publishing failures for the csdid package by ensuring the GitHub Actions OIDC token includes the expected environment claim. It does so by running the publish job under the pypi GitHub environment, aligning workflow token claims with the configured PyPI trusted publisher.

Changes:

• Add environment: pypi to the build-and-publish job in the PyPI publish workflow to ensure correct OIDC claim matching.