🐛 fix(build): carry toml-fmt-common in the sdist

[gaborbernat]

What broke

pyproject-fmt 2.29.0 and tox-toml-fmt 1.10.0 ship an sdist that declares Requires-Dist: toml-fmt-common. A build from it (a distro packager, pip install --no-binary, pip install -e .) resolves that name from PyPI, where the last upload is 1.3.5 from 2026-05-29. This tree's copy carries the same version number and over 400 different lines, so the install runs May's settings reader against August's formatter. #450 reports the 26 test failures that follow.

Vendoring ran in build_wheel alone, and only where ../toml-fmt-common/src/toml_fmt_common sat beside the package:

if not (_COMMON / "src" / _VENDOR).is_dir():  # no workspace (e.g. building from sdist)
    return maturin.build_wheel(...)

The sdist shipped the Rust common/ crate without the Python sibling, so a build from it took that escape hatch and wrote an unvendored wheel. build_editable vendored nothing.

Changes

• build_sdist writes toml-fmt-common's Python sources and its pyproject.toml into the tarball, so a wheel built from the sdist vendors like any other.
• build_editable adds a .pth naming toml-fmt-common's source directory, so an editable install reads the live sources rather than a published snapshot.
• _MODULE and _COMMON resolve in the sdist layout, where the backend sits at the tarball root rather than beside the package. _MODULE now reads the project name instead of the directory name, which in an sdist is pyproject_fmt-2.29.0.
• Both packages drop dependencies = ["toml-fmt-common"], and the workspace drops the uv source that pointed it at the local member. Nothing resolves the published distribution now, and a vendor step that goes missing raises an ImportError instead of installing four-month-old code.

Why CI missed it

The test environments install a wheel built from the working tree, where the sibling is present, so vendoring ran. pkg_meta built an sdist and then only linted its metadata with twine check. The dev environment built an editable install and never imported through it.

• pkg_sdist builds the sdist, builds a wheel from it, and fails if that wheel holds no _vendor/toml_fmt_common or still requires toml-fmt-common. It runs in the check matrix of both packages.
• dev runs import toml_fmt_common.

Fixes #450

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f089730) to head (9924565).

Additional details and impacted files

Flag	Coverage Δ
pyproject-fmt	100.00% <ø> (?)
tox-rules	100.00% <ø> (?)
tox-toml-fmt	100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 43 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.