Merge branch 'main' into ft/dependabot-cooldown

Author: woodruffw

.github/workflows/tests.yml

@@ -18,11 +18,11 @@ jobs:
     strategy:
       matrix:
         python:
-          - "3.9"
           - "3.10"
           - "3.11"
           - "3.12"
           - "3.13"
+          - "3.14"
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -52,7 +52,7 @@ jobs:
 
       - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
-          python-version: 3.13
+          python-version: 3.14
           cache: "pip"
           cache-dependency-path: pyproject.toml
           allow-prereleases: true

.gitignore

@@ -1,4 +1,5 @@
 env/
+.venv/
 pip-wheel-metadata/
 *.egg-info/
 __pycache__/

Makefile

@@ -6,7 +6,7 @@ ALL_PY_SRCS := $(shell find src -name '*.py') \
 	$(shell find test -name '*.py')
 
 # Optionally overriden by the user, if they're using a virtual environment manager.
-VENV ?= env
+VENV ?= .venv
 
 # On Windows, venv scripts/shims are under `Scripts` instead of `bin`.
 VENV_BIN := $(VENV)/bin
@@ -45,7 +45,7 @@ dev: $(VENV)/pyvenv.cfg
 
 $(VENV)/pyvenv.cfg: pyproject.toml
 	# Create our Python 3 virtual environment
-	python3 -m venv env
+	python3 -m venv $(VENV)
 	$(VENV_BIN)/python -m pip install --upgrade pip
 	$(VENV_BIN)/python -m pip install -e .[$(INSTALL_EXTRA)]
 

pyproject.toml

@@ -22,7 +22,7 @@ dependencies = [
     "sigstore >= 4.0, < 5.0",
     "sigstore-models",
 ]
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 
 [tool.setuptools.dynamic]
 version = { attr = "pypi_attestations.__version__" }
@@ -64,7 +64,7 @@ omit = ["src/pypi_attestations/__main__.py"]
 mypy_path = "src"
 packages = "pypi_attestations"
 plugins = ["pydantic.mypy"]
-python_version = "3.9"
+python_version = "3.10"
 allow_redefinition = true
 check_untyped_defs = true
 disallow_incomplete_defs = true
@@ -83,17 +83,14 @@ warn_unused_ignores = true
 
 [tool.ruff]
 line-length = 100
-target-version = "py39"
+target-version = "py310"
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "W", "UP", "ANN", "D", "COM", "ISC", "TCH", "SLF"]
 # D203 and D213 are incompatible with D211 and D212 respectively.
 # COM812 and ISC001 can cause conflicts when using ruff as a formatter.
 # See https://docs.astral.sh/ruff/formatter/#conflicting-lint-rules.
 ignore = ["D203", "D213", "COM812", "ISC001"]
-# Needed since Pydantic relies on runtime type annotations, and we target Python versions
-# < 3.10. See https://docs.astral.sh/ruff/rules/non-pep604-annotation/#why-is-this-bad
-pyupgrade.keep-runtime-typing = true
 
 [tool.ruff.lint.per-file-ignores]
 
@@ -107,6 +104,6 @@ pyupgrade.keep-runtime-typing = true
 [tool.interrogate]
 # don't enforce documentation coverage for packaging, testing, the virtual
 # environment, or the CLI (which is documented separately).
-exclude = ["env", "test", "src/pypi_attestations/__main__.py"]
+exclude = [".venv", "test", "src/pypi_attestations/__main__.py"]
 ignore-semiprivate = true
 fail-under = 100

src/pypi_attestations/_impl.py

@@ -8,7 +8,7 @@
 import base64
 import json
 from enum import Enum
-from typing import TYPE_CHECKING, Annotated, Any, Literal, NewType, Optional, Union, get_args
+from typing import TYPE_CHECKING, Annotated, Any, Literal, NewType
 
 import packaging
 import packaging.tags
@@ -238,7 +238,7 @@ def verify(
         *,
         staging: bool = False,
         offline: bool = False,
-    ) -> tuple[str, Optional[dict[str, Any]]]:
+    ) -> tuple[str, dict[str, Any] | None]:
         """Verify against an existing Python distribution.
 
         The `identity` can be an object confirming to
@@ -257,8 +257,7 @@ def verify(
         # NOTE: Can't do `isinstance` with `Publisher` since it's
         # a `_GenericAlias`; instead we punch through to the inner
         # `_Publisher` union.
-        # Use of typing.get_args is needed for Python < 3.10
-        if isinstance(identity, get_args(_Publisher)):
+        if isinstance(identity, _Publisher):
             policy = identity._as_policy()  # noqa: SLF001
         else:
             policy = identity
@@ -412,7 +411,7 @@ def _der_decode_utf8string(der: bytes) -> str:
     packaging.utils.BuildTag,
     frozenset[packaging.tags.Tag],
 ]
-_DistName = Union[_SdistName, _BdistName]
+_DistName = _SdistName | _BdistName
 
 
 def _check_dist_filename(dist: str) -> _DistName:
@@ -544,7 +543,7 @@ class GitHubPublisher(_PublisherBase):
     action.
     """
 
-    environment: Optional[str] = None
+    environment: str | None = None
     """
     The optional name GitHub Actions environment that the publishing
     action was performed from.
@@ -637,7 +636,7 @@ class GitLabPublisher(_PublisherBase):
     but can be customized.
     """
 
-    environment: Optional[str] = None
+    environment: str | None = None
     """
     The optional environment that the publishing action was performed from.
     """
@@ -661,7 +660,7 @@ def _as_policy(self) -> VerificationPolicy:
         return policy.Identity(identity=self.email, issuer="https://accounts.google.com")
 
 
-_Publisher = Union[GitHubPublisher, GitLabPublisher, GooglePublisher]
+_Publisher = GitHubPublisher | GitLabPublisher | GooglePublisher
 Publisher = Annotated[_Publisher, Field(discriminator="kind")]