Merge pull request #24 from Venafi/dependabot/go_modules/github.com/a… #45

	name: ORAS project registry tests
	# Run on every push, and allow it to be run manually.
	on:
	workflow_dispatch:
	push:
	branches: ['main', 'v*']
	pull_request:

	env:
	REGISTRY: localhost:5002

	jobs:
	docker-registry-v2-tests:
	# Skip if running in a fork that might not have secrets configured.
	if: ${{ github.repository == 'venafi/sigscan' }}
	name: Run tests
	runs-on: ubuntu-latest

	permissions:
	contents: read

	steps:
	- uses: actions/checkout@v3.1.0
	- uses: actions/setup-go@v3.3.0
	with:
	go-version: '1.22'
	check-latest: true
	- name: Install Cosign
	uses: sigstore/cosign-installer@main
	- name: Run oras project registry and publish test image
	run: \|
	docker run -d -p 5002:5000 --name orasregistry ghcr.io/oras-project/registry:v1.0.0-rc.4
	docker pull alpine:latest
	docker image tag alpine:latest ${{ env.REGISTRY }}/alpine:signed
	docker image push ${{ env.REGISTRY }}/alpine:signed
	# skopeo --insecure-policy copy --dest-tls-verify=false --src-tls-verify=false --format=oci docker://docker.io/alpine:latest docker://${{ env.REGISTRY }}/alpine:signed
	- name: Sign with cosign
	run: \|
	COSIGN_PASSWORD=1234 cosign sign --tlog-upload=false --allow-http-registry --allow-insecure-registry --key test/identities/signer1.key --certificate test/identities/signer1.crt ${{ env.REGISTRY }}/alpine:signed
	- name: build sigscan and check
	shell: bash
	run: \|
	set -e
	make sigscan
	./sigscan repo ${{ env.REGISTRY }} --output json --insecure \| jq

Provide feedback