mesh-2876: dependabot and sonar updates - #279
Conversation
There was a problem hiding this comment.
Pull request overview
Updates the Python dependency lockfile and adjusts CI workflow steps to align with Dependabot/Sonar-related dependency hygiene and reproducible installs.
Changes:
- Regenerated
poetry.lockwith updated dependency versions across dev/main/local groups. - Pinned tox/tox-gh-actions versions in the PR workflow install step.
- Switched the TestPyPI validation step to install exported requirements with hashes.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
poetry.lock |
Regenerated lockfile with updated package versions and metadata. |
.github/workflows/pull-request.yml |
Tightens CI dependency installation (pinning tox tooling; hashed requirements export/install for TestPyPI validation). |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 2 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/workflows/pull-request.yml:325
- After installing all runtime dependencies from the exported requirements (with hashes), installing the package from TestPyPI without
--no-depscan still trigger dependency resolution/network access against TestPyPI. Adding--no-depsmakes this step deterministic and avoids accidental dependency changes.
poetry export --only main -f requirements.txt --generate-hashes -o requirements.txt
python3 -m pip install --require-hashes -r requirements.txt
python3 -m pip install --index-url https://test.pypi.org/simple/ "mesh-client==${RELEASE_VERSION}"
INSTALLED_VERSION="$(python3 -c 'import mesh_client; print(mesh_client.__version__)')"
☂️ Code Coverage
Overall Coverage
New FilesNo new covered files... Modified FilesNo covered modified files...
|
|
https://nhsd-jira.digital.nhs.uk/browse/MESH-2876