Use script metadata in utils/convert_attestations.py

.github/workflows/create-release.yml

@@ -43,8 +43,6 @@ jobs:
       - name: Install build dependencies (pypa/build, twine)
         run: |
           uv pip install build "twine>=5.1"
-          # resolution fails without betterproto and protobuf-specs
-          uv pip install "pypi-attestations~=0.0.12" "sigstore-protobuf-specs==0.3.2" "betterproto==2.0.0b6"
 
       - name: Build distribution
         run: python -m build
@@ -64,7 +62,7 @@ jobs:
 
       - name: Convert attestations to PEP 740
         run: >
-          python utils/convert_attestations.py
+          uv run utils/convert_attestations.py
           "$BUNDLE_PATH"
           "$SIGNER_IDENTITY"
         env:

utils/convert_attestations.py

@@ -3,6 +3,16 @@
 See https://github.com/trailofbits/pypi-attestations.
 """
 
+# resolution fails without betterproto and protobuf-specs
+# /// script
+# requires-python = ">=3.11"
+# dependencies = [
+#     "pypi-attestations~=0.0.12",
+#     "sigstore-protobuf-specs==0.3.2",
+#     "betterproto==2.0.0b6",
+# ]
+# ///
+
 from __future__ import annotations
 
 import json