Update Snyk action to use Poetry for dependencies

[sowmiya-m-00]

PR Type

Enhancement

---

Description

• Replace setup.py with Poetry for dependency management

• Update Snyk action configuration to use Poetry

• Change Snyk command from file-based to test mode

---

Diagram Walkthrough

flowchart LR
  A["setup.py install"] -- "replaced with" --> B["Poetry install"]
  C["--file=setup.py"] -- "replaced with" --> D["test command"]
  B --> E["Snyk vulnerability check"]
  D --> E

Loading

File Walkthrough

	Relevant files
Configuration changes	main.yml Update Snyk workflow to use Poetry                                              .github/workflows/main.yml Replace setup.py install with Poetry installation command in Snyk action environment Update Snyk args from --file=setup.py to command: test Add Poetry configuration to disable virtual environment creation +2/-2

---

[qodo-code-review]

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
⚪	Unpinned tool install Description: The workflow installs Poetry via pip install poetry without pinning a specific version (and then runs poetry install), which creates a supply-chain risk where a malicious or compromised upstream release could be pulled and executed during CI. main.yml [11-11] Referred Code COMMAND: "pip install poetry && poetry config virtualenvs.create false && poetry install" SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Unpinned dependency install: The workflow installs poetry at runtime via pip install poetry without pinning or integrity verification, which may introduce supply-chain risk from an unvalidated external dependency source. Referred Code COMMAND: "pip install poetry && poetry config virtualenvs.create false && poetry install" SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} Learn more about managing compliance generic rules or creating your own custom rules

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

[qodo-code-review]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
General	Separate Poetry setup into its own step Move the Poetry installation and configuration from the COMMAND environment variable into a separate run step to improve readability and isolate potential failures. .github/workflows/main.yml [10-11] -env: - COMMAND: "pip install poetry && poetry config virtualenvs.create false && poetry install" +- name: Setup Poetry and install dependencies + run: | + pip install poetry + poetry config virtualenvs.create false + poetry install [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 6 __ Why: The suggestion improves the workflow's structure, readability, and maintainability by separating dependency installation into its own dedicated step, which is a common best practice.	Low
More