build: Switch to uv_build

.github/workflows/release.yml

@@ -23,6 +23,7 @@ jobs:
           # NOTE: We intentionally don't use a cache in the release step,
           # to reduce the risk of cache poisoning.
           enable-cache: false
+          version-file: uv.lock
 
       - name: build
         run: make package

pyproject.toml

@@ -1,13 +1,14 @@
 [build-system]
-requires = ["flit_core >=3.2,<4"]
-build-backend = "flit_core.buildapi"
+requires = ["uv_build>=0.12.0,<0.13.0"]
+build-backend = "uv_build"
 
 [project]
 name = "sigstore"
-dynamic = ["version"]
+version = "4.5.0"
 description = "A tool for signing Python package distributions"
 readme = "README.md"
-license = { file = "LICENSE" }
+license = "Apache-2.0"
+license-files = ["LICENSE"]
 authors = [
   { name = "Sigstore Authors", email = "sigstore-dev@googlegroups.com" },
 ]
@@ -71,6 +72,9 @@ dev = [
   "pip-tools>=7.6.0",
 ]
 
+# pin uv for setup-uv action
+uv = ["uv"]
+
 
 [tool.coverage.run]
 # branch coverage in addition to statement coverage.
@@ -134,3 +138,6 @@ ignore = [
 
 [tool.uv]
 exclude-newer = "P7D"
+
+[tool.uv.build-backend]
+module-root = ""

test/unit/test_version.py

@@ -12,8 +12,21 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+import sys
+from pathlib import Path
+
+if sys.version_info >= (3, 11):
+    import tomllib
+else:
+    import tomli as tomllib  # type: ignore[no-redef]
+
 import sigstore
 
 
 def test_version():
     assert isinstance(sigstore.__version__, str)
+
+    pyproject_path = Path(__file__).parents[2] / "pyproject.toml"
+    with open(pyproject_path, "rb") as f:
+        pyproject = tomllib.load(f)
+    assert sigstore.__version__ == pyproject["project"]["version"]