cross.yaml

on:
  push:
    paths:
      - '**'
      - '!**.md'
      - '!doc/**'
      - '!**.txt'
      - '!images/**'
      - '!LICENSE'
      - 'test/**'
    branches:
      - main
      - release-*
  pull_request:

permissions: read-all

name: Cross
jobs:
  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
        include:
          - os: macos-latest
            COSIGN_TARGET: cosign-darwin-amd64
            COSIGN_PASSWORD: COSIGN_PASSWORD
          - os: ubuntu-latest
            COSIGN_TARGET: cosign-linux-amd64
            COSIGN_PASSWORD: COSIGN_PASSWORD
          - os: windows-latest
            COSIGN_TARGET: cosign-windows-amd64.exe
            COSIGN_PASSWORD: COSIGN_PASSWORD
    steps:
      - name: Install Go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          go-version: '1.20.x'
          check-latest: true
      - name: Checkout code
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: build cosign
        run: |
          make cosign && mv ./cosign ./${{matrix.COSIGN_TARGET}}
      - name: Create checksum file
        shell: pwsh
        run: |
          $hash=Get-FileHash -Path ./${{matrix.COSIGN_TARGET}}
          Write-Output $($hash.Hash + " " + $(([io.fileinfo]$hash.path).basename)) | Tee-Object -Path ${{matrix.COSIGN_TARGET}}.sha256
      - name: sign
        shell: bash
        env:
          COSIGN_PASSWORD: ${{secrets[matrix.COSIGN_PASSWORD]}}
        if: github.event_name != 'pull_request'
        run: |
          ./${{matrix.COSIGN_TARGET}} sign-blob --yes --key ./.github/workflows/cosign-test.key ./${{matrix.COSIGN_TARGET}} > ${{matrix.COSIGN_TARGET}}.sig
      - name: verify
        if: github.event_name != 'pull_request'
        run: |
          ./${{matrix.COSIGN_TARGET}} verify-blob --key ./.github/workflows/cosign-test.pub --signature ${{matrix.COSIGN_TARGET}}.sig ./${{matrix.COSIGN_TARGET}}
      - name: Upload artifacts
        if: github.event_name != 'pull_request'
        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
        with:
          name: artifacts
          path: |
            cosign-*
            cosign.-*sha256
            cosign-*.sig