test.yml

name: Action Tests

on:
  workflow_dispatch:
  pull_request:
    branches:
      - main
  push:
    branches:
      - main

jobs:
  test-version:
    name: Test version
    runs-on: ${{ matrix.os }}-latest
    strategy:
      fail-fast: false
      matrix:
        os: [macos, ubuntu, windows]
        version: [latest, v0.7.1, 9de7397da9f1c00dad5213519366002376b8d5ed]
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

      - name: Setup regctl
        id: regctl
        uses: ./
        with:
          regctl-release: ${{ matrix.version }}
          cache: false

      - name: Test regctl
        shell: bash
        env:
          MATRIX_VERSION: ${{ matrix.version }}
          VERSION: ${{ steps.regctl.outputs.version }}
        run: |
          if ! which regctl ; then
            echo "::error::regctl not found in PATH"
            exit 1
          fi

          echo "EXPECTED=$MATRIX_VERSION"
          echo "VERSION=$VERSION"
          [ "$MATRIX_VERSION" != "latest" ] && VERSION=$MATRIX_VERSION
          if ! regctl version | grep "$VERSION" ; then
            echo "::error::regctl $VERSION does not appear to be installed"
            exit 1
          fi

  test-bad-version:
    name: Test bad version
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        version:
          - v0.0.0
          - foobar
          - 7e1e47d
          - ffffffffffffffffffffffffffffffffffffffff
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

      - name: Setup regctl
        id: regctl
        uses: ./
        continue-on-error: true
        with:
          regctl-release: ${{ matrix.version }}

      - name: Test slsa-verifier
        shell: bash
        env:
          FAILURE: ${{ steps.regctl.outcome  == 'failure' }}
        run: |
          if which regctl ; then
            echo "::error::regctl was found in PATH"
            exit 1
          fi

          if [ "$FAILURE" != "true" ]; then
            echo "::error::Expected Action to fail but didn't"
            exit 1
          fi

  test-invalid-version:
    name: Test invalid version
    runs-on: ${{ matrix.os }}-latest
    strategy:
      fail-fast: false
      matrix:
        os: [macos, windows]
        version:
          - v0.0.1
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

      - name: Setup regctl
        id: regctl
        uses: ./
        continue-on-error: true
        with:
          regctl-release: ${{ matrix.version }}

      - name: Test slsa-verifier
        shell: bash
        env:
          FAILURE: ${{ steps.regctl.outcome  == 'failure' }}
        run: |
          if which regctl ; then
            echo "::error::regctl was found in PATH"
            exit 1
          fi

          if [ "$FAILURE" != "true" ]; then
            echo "::error::Expected Action to fail but didn't"
            exit 1
          fi

  test-cache:
    name: Test cache & cosign
    runs-on: ${{ matrix.os }}-latest
    strategy:
      fail-fast: false
      matrix:
        os: [macos, ubuntu, windows]
        cache: [true, false]
        verify: [true, false]
    permissions:
      contents: read
    steps:
      - name: Checkout repo
        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0

      - name: Install Cosign
        if: matrix.verify
        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

      - name: Setup regctl (cache)
        if: matrix.cache == true
        uses: ./

      - name: Setup regctl
        id: regctl
        uses: ./
        with:
          cache: ${{ matrix.cache }}
          verify: ${{ matrix.verify }}

      - name: Test regctl
        shell: bash
        env:
          CACHE_HIT: ${{ steps.regctl.outputs.cache-hit }}
          MATRIX_CACHE: ${{ matrix.cache }}
        run: |
          if ! which regctl ; then
            echo "::error::regctl not found in PATH"
            exit 1
          fi

          echo "EXPECTED=$MATRIX_CACHE"
          echo "CACHE_HIT=$CACHE_HIT"
          if [ "$MATRIX_CACHE" != "$CACHE_HIT" ]; then
            echo "::error::Cache hit is not what was expected"
            exit 1
          fi