Use Poetry to manage project dependencies

[madeinoz67]

Add poetry to the project to manage its dependencies

initial discussion found here: #27

[madeinoz67]

I'll look at this before doing #27 mkdocs as need to make sure all the actions, packages and deploy still work.

[madeinoz67]

There is a issue in the way the current project handles version numbers and how poetry handles versioning and want to know @davidlatwe that a solution discussed here is ok python-poetry/poetry#1036 (comment)

currently versions are managed in the _version.py and this is read in as an attr in setup.cfg. poetry doesn't allow this.

The proposed solution is to:

1. Manager project version in pyproject.toml by poetry
2. that _version.py Read the package version metadata thats available when package is built

another discussions around this issue:

• peotry version doesn't bump the value in __version__ python-poetry/poetry#144

[davidlatwe]

Thanks @madeinoz67 and the sum up. ❤️

Yeah.. I remember I bump into this issue when I was trying to adopt poetry a while back. Couldn't made up my mind which way to go at the time being.

I read both issues and that PyPA guy's solution seems to be the most solid one, let's do it. :)

[madeinoz67]

@davidlatwe this is ready for your review just as an overview of changes:

• poetry now used to manage project dependencies such as mkdocs (when I start doing documentation)
• poetry now responsible for build and publishing
• poetry uses a local virtual environment it creates automatically
• actions updated to reflect poetry
• python 2.7 removed, not poetry friendly plus you said you were removing it
• added bandit to CI so some static code security checking is now part of the CI
• using a makefile for common tasks

Regarding the package versioning....

To keep things simple I decided to go with a simpler solution posted in the thread I mentioned above that just checks versions are in sync so you need to update versions in the pyproject.toml and the _version.py file. Ive added tests around this so will fail before publishing if they're not the same, also part of the CI

The publishing action is the only thing I haven't been able to test, but should work as it's similar to what Ive done elsewhere.