pyproject.toml: [tool.setuptools_scm] is inert — maturin takes the version from Cargo.toml

[alxmrs]

Third one from modelling ddx's packaging on this repo (after #242 and #243) — this one I checked empirically rather than by reading, because I was about to copy the pattern.

pyproject.toml declares SCM versioning:

[project]
dynamic = ["version"]     # L7
...
[tool.setuptools_scm]     # L110

but setuptools-scm is never installed at build time:

[build-system]
requires = ["maturin>=1.9,<2.0"]
build-backend = "maturin"

and maturin is the backend, not setuptools — it does not consult setuptools-scm at all. For dynamic = ["version"], maturin takes the version from Cargo.toml.

How I checked

I put the identical configuration on ddx's own maturin package — dynamic = ["version"], [tool.setuptools_scm], and (unlike here) setuptools-scm actually present in build-system.requires — in a repo with no matching git tag at all. SCM versioning would have had to produce a 0.1.x.dev...+g<sha> string. The build produced:

📦 Built wheel ... ddxdb-0.1.0-cp310-abi3-macosx_11_0_arm64.whl

0.1.0 is exactly the Cargo.toml version. Git was never consulted.

So [tool.setuptools_scm] here is inert configuration: the published version is whatever rust/Cargo.toml says, and the section reads as though tags drive it. That is harmless today but misleading — someone bumping a tag and expecting the wheel to follow would be surprised, and the failure is silent.

Options

1. Drop [tool.setuptools_scm] and treat rust/Cargo.toml as the single source, which is what already happens. Optionally assert tag-vs-version in the publish workflow so a mismatched tag fails the release rather than shipping.
2. Actually use SCM, which means not using maturin's version handling — e.g. generate the version in CI and pass --version / rewrite Cargo.toml before building. More machinery than it is likely worth.

I went with (1) plus a tag check in ddx. Happy to send a PR here if useful.