Use uv

.github/dependabot.yml

@@ -1,10 +1,13 @@
 version: 2
 updates:
 
-- package-ecosystem: "pip"
+- package-ecosystem: "uv"
   directory: "/"
+  versioning-strategy: lockfile-only
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7
   groups:
     python-dependencies:
       patterns:
@@ -17,6 +20,8 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7
   groups:
     action-dependencies:
       patterns:
@@ -29,3 +34,5 @@ updates:
   directory: "/clients/go-tuf/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 7

.github/workflows/ci.yml

@@ -20,11 +20,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - name: Set up uv
+        uses: astral-sh/setup-uv@1edb52594c857e2b5b13128931090f0640537287 # v5.3.0
         with:
           python-version: "3.14"
-          cache: "pip"
+          enable-cache: true
 
       - name: Install lint dependencies
         run: make env/pyvenv.cfg

Makefile

@@ -23,9 +23,8 @@ DUMP_DIR = /tmp/tuf-conformance-dump
 #########################
 
 env/pyvenv.cfg: pyproject.toml
-	python3 -m venv env
-	./env/bin/python -m pip install --upgrade pip
-	./env/bin/python -m pip install -e .[lint]
+	uv venv --allow-existing env
+	uv pip install --python env -e .[lint]
 
 .PHONY: dev
 dev: faketime env/pyvenv.cfg

action.yml

@@ -14,16 +14,16 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Set up Python
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+    - name: Set up uv
+      uses: astral-sh/setup-uv@1edb52594c857e2b5b13128931090f0640537287 # v5.3.0
       with:
         python-version: "3.14"
 
-    - name: Install test
+    - name: Install test suite
       run: |
         echo "::group::Install test suite and dependencies"
         sudo apt install faketime
-        pip install -e "${{ github.action_path }}"
+        uv sync --frozen --project "${{ github.action_path }}"
         echo "::endgroup::"
       shell: bash
 
@@ -42,9 +42,10 @@ runs:
         fi
 
         # run test suite
-        pytest -v --json-report --json-report-file=tuf-conformance-report.json "$TEST_LOCATION" \
+        uv run --frozen --project "${{ github.action_path }}" -- \
+          pytest -v --json-report --json-report-file=tuf-conformance-report.json "$TEST_LOCATION" \
           --entrypoint "$ENTRYPOINT" \
-          --repository-dump-dir ./test-repositories \
+          --repository-dump-dir ./test-repositories
       shell: bash
 
     - name: Upload repository dump

pyproject.toml

@@ -5,18 +5,18 @@ build-backend = "hatchling.build"
 [project]
 name = "tuf-conformance"
 dependencies = [
-    "securesystemslib[crypto]==1.4.0",
-    "tuf==7.0.0",
-    "pytest==9.1.1",
-    "pytest-json-report==1.5.0"
+    "securesystemslib[crypto]>=1.4.0",
+    "tuf>=7.0.0",
+    "pytest",
+    "pytest-json-report"
 ]
 dynamic = ["version"]
 requires-python = ">= 3.10"
 
 [project.optional-dependencies]
 lint = [
-    "mypy==2.1.0",
-    "ruff==0.15.20"
+    "mypy",
+    "ruff"
 ]
 
 [tool.hatch.version]