test-action.yml

name: test-cosign

on:
  pull_request:
  push:
    branches:
      - 'main'

jobs:
  get_all_cosign_releases:
    runs-on: ubuntu-latest
    permissions: {}
    name: Fetch current list of all Cosign releases for testing
    outputs:
      releases: ${{ steps.get_tags.outputs.result }}
    steps:
      - name: Get release tags
        id: get_tags
        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          retries: 3
          script: |
            const response = await github.rest.repos.listReleases({'sigstore','cosign'});
            return response.data.map(release => release.tag_name);
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  test_default_version_cosign_action:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    permissions: {}
    name: Install Cosign and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi
        shell: bash

  test_existing_release_action:
    # this does not run on macOS as the support for multi-arch was not added yet
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
    permissions: {}
    name: Install existing release of Cosign and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi

  test_cosign_action_custom:
    runs-on: ${{ matrix.os }}
    needs: get_all_cosign_releases
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
        cosign_release: ${{ fromJson(needs.get_all_cosign_releases.outputs.releases) }}
    permissions: {}
    name: Install Custom Cosign and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: ${{ matrix.cosign_release }}
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi
        shell: bash

  test_cosign_action_0_5_0:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
    permissions: {}
    name: Install Cosign v0.5.0 and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: 'v0.5.0'
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi
        shell: bash

  test_cosign_action_0_6_0:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    permissions: {}
    name: Install Cosign v0.6.0 and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: 'v0.6.0'
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi
        shell: bash

  test_cosign_action_0_6_0_with_pre_installed_libpcsclite1_package:
    # this test is specifically for linux and pcsclite1 dependencies
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
    permissions: {}
    name: Install Cosign v0.6.0 and test presence in path with pre installed libpcsclite1 package
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install libpcsclite1
        run: |
          sudo apt-get update -q
          sudo apt-get install -yq libpcsclite1
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: 'v0.6.0'
      - name: Check install!
        run: cosign version
      - name: Check root directory
        run: |
          if [[ $(git diff --stat) != '' ]]; then
            echo 'should be clean'
            exit 1
          else
            exit 0
          fi

  test_cosign_action_wrong:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    permissions: {}
    name: Try to install a wrong Cosign
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: 'honk'
        continue-on-error: true

  test_cosign_action_custom_dir:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    permissions: {}
    name: Install Custom Cosign and test presence in path
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          install-dir: "$HOME/.cosigntest"
      - name: Check install!
        run: cosign version
      - name: Check install dir!
        run: |
          [[ $(dirname "$(which cosign)") == "$HOME/.cosigntest" ]]
        shell: bash
      - name: Check root directory
        run: |
          [[ -z $(git diff --stat) ]]
        shell: bash

  test_cosign_action_custom_dir_root:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest]
    permissions: {}
    name: Install Custom Cosign and test presence in path with custom root dir
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Install Cosign
        uses: ./
        with:
          install-dir: /usr/bin
          use-sudo: true
      - name: Check install!
        run: cosign version
      - name: Check install dir!
        run: |
          [[ $(dirname "$(which cosign)") == /usr/bin ]]
        shell: bash
      - name: Check root directory
        run: |
          [[ -z $(git diff --stat) ]]
        shell: bash

  test_cosign_with_go_install:
    permissions: {}
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os:
          - macos-latest
          - ubuntu-latest
          - windows-latest
        go_version:
          - '1.21'
          - '1.22'
    name: Try to install cosign with go ${{ matrix.go_version }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ matrix.go_version }}
          check-latest: true
      - name: Install Cosign
        uses: ./
        with:
          cosign-release: 'main'
      - name: Check install!
        run: cosign version