fix: sonar issues: Poetry binary only execution to avoid running arbirary code

.github/actions/lint/action.yml

@@ -15,6 +15,8 @@ runs:
 
     - name: Install dependencies
       shell: bash
+      env:
+        POETRY_INSTALLER_ONLY_BINARY: ":all:"
       run: poetry install --no-root --only=lint
 
     - name: Lint with black

.github/actions/test/action.yml

@@ -19,6 +19,8 @@ runs:
 
     - name: Install package
       shell: bash
+      env:
+        POETRY_INSTALLER_ONLY_BINARY: ":all:"
       run: poetry install -E all --only main,test
 
     - name: Check migrations are up to date
@@ -45,8 +47,10 @@ runs:
 
     - name: Merge test results
       shell: bash
+      env:
+        PIP_ONLY_BINARY: ":all:"
       run: |
-        pip install junitparser
+        pip install junitparser==5.0.1
         junitparser merge eda-server-default.xml eda-server-multithreaded.xml eda-server-test-results.xml
 
     # Verify coverage.xml exists and has content

.github/actions/validate-openapi-spec/action.yml

@@ -15,11 +15,15 @@ runs:
 
     - name: Install package
       shell: bash
+      env:
+        POETRY_INSTALLER_ONLY_BINARY: ":all:"
       run: poetry install -E all --only main
 
     - name: Install openapi-spec-validator
       shell: bash
-      run: pip install openapi-spec-validator
+      env:
+        PIP_ONLY_BINARY: ":all:"
+      run: pip install openapi-spec-validator==0.9.0
 
     - name: Generate OpenAPI specification and print report
       shell: bash

.github/workflows/autoupdate-poetry.yml

@@ -29,9 +29,11 @@ jobs:
           python-version: "3.11"
 
       - name: Install Poetry
+        env:
+          PIP_ONLY_BINARY: ":all:"
         run: |
           python -m pip install --upgrade pip
-          pip install poetry
+          pip install poetry==2.4.1
 
       - name: Run poetry lock
         run: poetry lock

.github/workflows/e2e-dispatch.yml

@@ -177,9 +177,12 @@ jobs:
 
       - name: Install dependencies
         working-directory: ${{ env.EDA_QA_PATH }}
+        env:
+          PIP_ONLY_BINARY: ":all:"
+          PIP_NO_BINARY: "eda-qa"
         run: |
           pip install .
-          pip install pytest-rerunfailures
+          pip install pytest-rerunfailures==16.4
 
       - name: Run tests
         working-directory: ${{ env.EDA_QA_PATH }}
@@ -196,8 +199,10 @@ jobs:
           fi
 
       - name: Setup jUnit reporter
+        env:
+          PIP_ONLY_BINARY: ":all:"
         run: |
-          pip install httpie
+          pip install httpie==3.2.4
           echo "GIT_SHA=$(git rev-parse "$GITHUB_SHA")" >> "$GITHUB_ENV"
 
       - name: Upload jUnit test results (APDE CI)
@@ -280,9 +285,12 @@ jobs:
 
       - name: Install dependencies
         working-directory: ${{ env.EDA_QA_PATH }}
+        env:
+          PIP_ONLY_BINARY: ":all:"
+          PIP_NO_BINARY: "eda-qa"
         run: |
           pip install .
-          pip install pytest-rerunfailures
+          pip install pytest-rerunfailures==16.4
 
       - name: Build eda-server images
         working-directory: .
@@ -302,8 +310,10 @@ jobs:
           pytest -vv -s eda_qa/tests/whitebox/upstream --junit-xml=eda-qa-e2e-multinode-test-results.xml --reruns ${{ env.PYTEST_RETRIES }}
 
       - name: Setup jUnit reporter
+        env:
+          PIP_ONLY_BINARY: ":all:"
         run: |
-          pip install httpie
+          pip install httpie==3.2.4
           echo "GIT_SHA=$(git rev-parse "$GITHUB_SHA")" >> "$GITHUB_ENV"
 
       - name: Upload jUnit test results (APDE CI)

.github/workflows/scheduled.yml

@@ -55,6 +55,9 @@ jobs:
 
       - name: Install dependencies
         working-directory: ${{ env.EDA_QA_PATH }}
+        env:
+          PIP_ONLY_BINARY: ":all:"
+          PIP_NO_BINARY: "eda-qa"
         run: pip install .
 
       - name: Run tests