use constraints file for sdist/wheel build + get version using build.util

[graingert]

stuff that I wanted to sneak into the zizmor PR, but decided should be in another PR

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00000%. Comparing base (3260974) to head (c479af6).

Additional details and impacted files

@@               Coverage Diff               @@
##                 main        #3167   +/-   ##
===============================================
  Coverage   100.00000%   100.00000%           
===============================================
  Files             124          124           
  Lines           18427        18427           
  Branches         1215         1215           
===============================================
  Hits            18427        18427           

[webknjaz]

If you're going this route already, let's also set PIP_CONSTRAINT in the pypa/build invocation step. I like using a separate constraint file generated with pip-tools, containing the build deps pins like setuptools+wheel. This will be able to pin the ephemeral PEP 517 build env.

[webknjaz]

This would leak into the underlying PEP 517 ephemeral build envs.

Suggested change

	run: python -Im pip install build -c test-requirements.txt
	env:
	PIP_CONSTRAINT: test-requirements.txt
	run: python -Im pip install build

[webknjaz]

Assuming, you'll do something like pip-compile --only-build-deps --output-file=build-requirements.txt pyproject.toml:

Suggested change

	run: python -Im build
	env:
	PIP_CONSTRAINT: build-requirements.txt
	run: python -Im build

[webknjaz]

This could also use an env var:

Suggested change

	python -m uv pip install build -c test-requirements.txt
	PIP_CONSTRAINT=test-requirements.txt python -m uv pip install build

[webknjaz]

Additionally, I realized that this project doesn't have a combined workflow and so this https://github.com/python-trio/trio/blob/main/.github/workflows/release.yml also needs to be handled similarly.