feat: github action pinning with Ratchet

[JagjeevanAK]

Signed-off-by: Jagjeevan Kashid [email protected]

What

Most CI/CD systems are one layer of indirection away from curl | sudo bash. Unless you are specifically pinning CI workflows, containers, and base images to checksummed versions, everything is mutable: GitHub labels are mutable and Docker tags are mutable. This poses a substantial security and reliability risk.

Few Week earlier the most popular action was compromised with curl command pointing to an python script : Link

Documentation related to ratchet is added on openfoodfacts-server repo

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 5.87%. Comparing base (4d9c7fc) to head (aec0206).
Report is 834 commits behind head on develop.

Additional details and impacted files

@@            Coverage Diff             @@
##           develop   #6551      +/-   ##
==========================================
- Coverage     9.54%   5.87%   -3.68%     
==========================================
  Files          325     498     +173     
  Lines        16411   29651   +13240     
==========================================
+ Hits          1567    1743     +176     
- Misses       14844   27908   +13064     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[RahulNavneeth]

Hi @JagjeevanAK , just a quick thought, apart from the actual changes, it looks like there are quite a few formatting differences (like added or removed spaces). It might be helpful to minimize those in commits to keep the diffs cleaner.

[JagjeevanAK]

As to give you context the tool which I am using is using double spacing so we can't do anything with it as of now as they have said they will be solving that problem.