Use uv.lock

* The action uses --frozen: Only use versions from uv.lock
* Dependabot only updates lock file
* pyproject.toml no longer contains version pinning, only minimum versions

Signed-off-by: Jussi Kukkonen <jkukkonen@google.com>

Author: jku

.github/dependabot.yml

@@ -1,10 +1,13 @@
 version: 2
 updates:
 
-- package-ecosystem: "pip"
+- package-ecosystem: "uv"
   directory: "/"
+  versioning-strategy: lockfile-only
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7
   groups:
     python-dependencies:
       patterns:
@@ -17,6 +20,8 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7
   groups:
     action-dependencies:
       patterns:
@@ -29,3 +34,5 @@ updates:
   directory: "/clients/go-tuf/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7

action.yml

@@ -19,11 +19,11 @@ runs:
       with:
         python-version: "3.14"
 
-    - name: Install test
+    - name: Install test suite
       run: |
         echo "::group::Install test suite and dependencies"
         sudo apt install faketime
-        uv sync --project "${{ github.action_path }}"
+        uv sync --frozen --project "${{ github.action_path }}"
         echo "::endgroup::"
       shell: bash
 
@@ -42,7 +42,8 @@ runs:
         fi
 
         # run test suite
-        uv run --project "${{ github.action_path }}" pytest -v --json-report --json-report-file=tuf-conformance-report.json "$TEST_LOCATION" \
+        uv run --frozen --project "${{ github.action_path }}" -- \
+          pytest -v --json-report --json-report-file=tuf-conformance-report.json "$TEST_LOCATION" \
           --entrypoint "$ENTRYPOINT" \
           --repository-dump-dir ./test-repositories
       shell: bash

pyproject.toml

@@ -5,18 +5,18 @@ build-backend = "hatchling.build"
 [project]
 name = "tuf-conformance"
 dependencies = [
-    "securesystemslib[crypto]==1.4.0",
-    "tuf==7.0.0",
-    "pytest==9.0.3",
-    "pytest-json-report==1.5.0"
+    "securesystemslib[crypto]>=1.4.0",
+    "tuf>=7.0.0",
+    "pytest",
+    "pytest-json-report"
 ]
 dynamic = ["version"]
 requires-python = ">= 3.10"
 
 [project.optional-dependencies]
 lint = [
-    "mypy==2.1.0",
-    "ruff==0.15.15"
+    "mypy",
+    "ruff"
 ]
 
 [tool.hatch.version]