Manage versioning of Poetry tool dependency

[per1234]

The project's Python package dependencies are managed by the Poetry tool.

Previously, the version of Poetry was managed in two inconsistent and sub-ideal ways:

• The version used during execution of the action was hardcoded in the action metadata file.
• The version used locally by contributors and by the GitHub Actions workflows was not managed at all.

The first is problematic because there is no mechanism to facilitate updates, which means it will never be updated.

The second is problematic because some versions might be incompatible, or produce different results than the version used by the action.

The better solution is to take the same approach for managing the Poetry dependency as done for the project's other dependencies:

• Install a specific version of Poetry according to a single source of versioning data.
• Use the Dependabot service to get automated update pull requests.

The logical place to define the poetry package dependency version is in pyproject.toml, as is done for all direct Python package dependencies.

Dependabot recognizes two forms of dependency data in the pyproject.toml file:

• Poetry
• PEP 621

Since Poetry can't be used to manage itself (it is instead installed using pipx, the obvious approach would be to define the poetry dependency in a PEP 621 field in the file. However, this is not possible because if Dependabot finds Poetry data in pyproject.toml, it ignores the PEP 621 fields. So it is necessary to define the Poetry dependency in the Poetry fields of the file. A special dependencies group is created for this purpose. That group is configured as "optional" so that it won't be installed redundantly by poetry install commands.

Unfortunately pipx doesn't support using pyproject.toml as a dependency configuration file so it is necessary to generate the dependency argument in the pipx command by parsing the project.toml file. The yq tool is used for this purpose.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 99.81%. Comparing base (1719ade) to head (e5f98c3).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #294   +/-   ##
=======================================
  Coverage   99.81%   99.81%           
=======================================
  Files           2        2           
  Lines        1623     1623           
=======================================
  Hits         1620     1620           
  Misses          3        3           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.