Use uv build

[edgarrmondragon]

uv v0.4.5 was just released with uv build

uv build can be used to build both source distributions and binary distributions for your project. By default, uv build will build the project in the current directory, and place the built artifacts in a dist/ subdirectory

https://docs.astral.sh/uv/concepts/projects/#building-projects

[edgarrmondragon]

This seems to shave off a couple of seconds so let me know if the change is welcome :)

[hynek]

I'm obviously very interested in what uv is doing 🤓 I wouldn't give too much on the seconds shaved off, since CIs are rather indeterministic, but the simplification of the requirement files looks extremely lovely.

I'm just not 100% if I trust them nailing it on first try. 🤔 I'll merge for now, but I'll think about it for a moment, maybe even bump major version.

Thanks!

[hynek]

Hey @charliermarsh & @zanieb – how confident are you that pushing this out won't break the Pythonverse? :)

[hynek]

ah shit it totally will: astral-sh/uv#7066

I'll wait a moment before reverting, Astral tends to fix simple things faster than I can type git commands.

[hynek]

ok, it's all good with SOURCE_DATE_EPOCH, but I'd still like to hear the confidence rating :)

[hynek]

fyi https://github.com/hynek/build-and-inspect-python-package/releases/tag/v2.9.0 is out with it

[davidism]

I'm playing around with uv for building and publishing Flask (although have to wait until uv publish supports attestations). It looks like you figured out that SOURCE_DATE_EPOCH is accounted for? Your comments are very mysterious, I was hoping you could explain exactly how you concluded it was ok.

[hynek]

@davidism The key point is that uv is not involved in that part at all. It's all done by the build backend. I think my confusion was that the wheel command doesn't preserve timestamps so the output was wrong which is why I removed timestamps.

I tried replacing wheel with zip but that broke pytest: https://github.com/hynek/build-and-inspect-python-package/pull/114/files

If you want to make 100% sure it's accounted for, you'll have to download the built packages and look inside. :| LMK if you run into something else, my memory is somewhat cloudy on that, but again: uv build just calls your build backend, so any problems with it are to be searched there.