test action against all non-rc releases, verify entry in rekor log #385

Workflow file for this run

.github/workflows/test-action.yml at 659ab63

	name: test-cosign

	on:
	pull_request:
	push:
	branches:
	- 'main'

	jobs:
	get_all_cosign_releases:
	runs-on: ubuntu-latest
	permissions: {}
	name: Fetch current list of all Cosign releases for testing
	outputs:
	releases: ${{ steps.get_tags.outputs.result }}
	steps:
	- name: Get release tags
	id: get_tags
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
	with:
	retries: 3
	script: \|
	const response = await github.rest.repos.listReleases({owner:'sigstore',repo:'cosign'});
	const releases = response.data.map(release => release.tag_name);
	console.log("Found releases: " + releases);
	// omits 0.5.0 and 0.6.0 releases because they are tested separately
	return releases.filter(rel => !['0.5.0', '0.6.0'].includes(rel));
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	test_default_version_cosign_action:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [macos-latest, ubuntu-latest, windows-latest]
	permissions: {}
	name: Install default version Cosign and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi
	shell: bash

	test_existing_release_action:
	# this does not run on macOS as the support for multi-arch was not added yet
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [ubuntu-latest]
	permissions: {}
	name: Install existing release of Cosign and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi

	test_cosign_action_custom:
	runs-on: ${{ matrix.os }}
	needs: get_all_cosign_releases
	strategy:
	matrix:
	os: [macos-latest, ubuntu-latest, windows-latest]
	cosign_release: ${{ fromJson(needs.get_all_cosign_releases.outputs.releases) }}
	permissions: {}
	name: Install Cosign ${{ matrix.cosign_release }} on ${{ matrix.os }} and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: ${{ matrix.cosign_release }}
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi
	shell: bash

	test_cosign_action_0_5_0:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [ubuntu-latest, windows-latest]
	permissions: {}
	name: Install Cosign v0.5.0 and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: 'v0.5.0'
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi
	shell: bash

	test_cosign_action_0_6_0:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [macos-latest, ubuntu-latest, windows-latest]
	permissions: {}
	name: Install Cosign v0.6.0 and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: 'v0.6.0'
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi
	shell: bash

	test_cosign_action_0_6_0_with_pre_installed_libpcsclite1_package:
	# this test is specifically for linux and pcsclite1 dependencies
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [ubuntu-latest]
	permissions: {}
	name: Install Cosign v0.6.0 and test presence in path with pre installed libpcsclite1 package
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install libpcsclite1
	run: \|
	sudo apt-get update -q
	sudo apt-get install -yq libpcsclite1
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: 'v0.6.0'
	- name: Check install!
	run: cosign version
	- name: Check root directory
	run: \|
	if [[ $(git diff --stat) != '' ]]; then
	echo 'should be clean'
	exit 1
	else
	exit 0
	fi

	test_cosign_action_wrong:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [macos-latest, ubuntu-latest, windows-latest]
	permissions: {}
	name: Try to install a wrong Cosign
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: 'honk'
	continue-on-error: true

	test_cosign_action_custom_dir:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [macos-latest, ubuntu-latest, windows-latest]
	permissions: {}
	name: Install Custom Cosign and test presence in path
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	install-dir: "$HOME/.cosigntest"
	- name: Check install!
	run: cosign version
	- name: Check install dir!
	run: \|
	[[ $(dirname "$(which cosign)") == "$HOME/.cosigntest" ]]
	shell: bash
	- name: Check root directory
	run: \|
	[[ -z $(git diff --stat) ]]
	shell: bash

	test_cosign_action_custom_dir_root:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [ubuntu-latest]
	permissions: {}
	name: Install Custom Cosign and test presence in path with custom root dir
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- name: Install Cosign
	uses: ./
	with:
	install-dir: /usr/bin
	use-sudo: true
	- name: Check install!
	run: cosign version
	- name: Check install dir!
	run: \|
	[[ $(dirname "$(which cosign)") == /usr/bin ]]
	shell: bash
	- name: Check root directory
	run: \|
	[[ -z $(git diff --stat) ]]
	shell: bash

	test_cosign_with_go_install:
	permissions: {}
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os:
	- macos-latest
	- ubuntu-latest
	- windows-latest
	go_version:
	- '1.22'
	- '1.23'
	name: Try to install cosign with go ${{ matrix.go_version }} on ${{ matrix.os }}
	steps:
	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	with:
	persist-credentials: false
	- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
	with:
	go-version: ${{ matrix.go_version }}
	check-latest: true
	- name: Install Cosign
	uses: ./
	with:
	cosign-release: 'main'
	- name: Check install!
	run: cosign version

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

test action against all non-rc releases, verify entry in rekor log #385

Workflow file

test action against all non-rc releases, verify entry in rekor log #385

Jobs

Run details

Workflow file for this run