[Aikido] Pin Poetry and poetry-core versions to mitigate supply-chain vulnerability

.github/workflows/publish.yml

@@ -60,7 +60,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Install poetry
-      run: pip install poetry
+      run: pip install poetry==1.8.5
     - name: Set the version for this release
       run: |
         TAG_NAME=${GITHUB_REF##*/}

.github/workflows/test-publish.yml

@@ -62,7 +62,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Install poetry
-      run: pip install poetry
+      run: pip install poetry==1.8.5
     - name: Set the version for this release
       run: |
         TAG_NAME=${GITHUB_REF##*/}

Makefile

@@ -19,7 +19,7 @@ lint:
 	poetry run black aikido_zen/
 	poetry run pylint aikido_zen/
 install: check_binaries
-	pip install poetry
+	pip install poetry==1.8.5
 	poetry install
 .PHONY: dev_install
 dev_install: install

pyproject.toml

@@ -108,7 +108,7 @@ requests = "^2.32.3"
 groq = "^0.31.1"
 
 [build-system]
-requires = ["poetry-core>=1.0.0"]
+requires = ["poetry-core==1.9.1"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.black]

sample-apps/lambda-mongo/Makefile

@@ -1,7 +1,7 @@
 .PHONY: install
 install:
 	pip install -r requirements.txt
-	pip install poetry
+	pip install poetry==1.8.5
 	rm -rf ../../dist
 
 	cd ../../ && $(MAKE) build