Merge pull request #279 from NHSDigital/mesh-2876-dependabot

mesh-2876: dependabot and sonar updates

Author: johnwilliams57-nhs

.github/workflows/pull-request.yml

@@ -49,7 +49,7 @@ jobs:
         run: make up
 
       - name: install dependencies
-        run: pip install tox tox-gh-actions
+        run: pip install --prefer-binary tox==4.58.0 tox-gh-actions==3.5.0
 
       - name: tox
         run: tox
@@ -319,8 +319,8 @@ jobs:
 
       - name: install and test
         run: |
-          poetry export -f requirements.txt -o requirements.txt
-          python3 -m pip install -r requirements.txt
+          poetry export --only main -f requirements.txt -o requirements.txt
+          python3 -m pip install --require-hashes -r requirements.txt
           python3 -m pip install --index-url https://test.pypi.org/simple/ "mesh-client==${RELEASE_VERSION}"
           INSTALLED_VERSION="$(python3 -c 'import mesh_client; print(mesh_client.__version__)')"
           if [[ "${INSTALLED_VERSION}" != "${RELEASE_VERSION}" ]]; then