Update chart-testing-action to v2.6.0 and cosigin-installer to v3.1.1

[liangyuanpeng]

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

helm chart testing action is broken, https://github.com/karmada-io/karmada/actions/runs/6706548301/job/18223260799

xref:

• Unable to validate cosign version: 'v2.0.0' helm/chart-testing-action#132
• v2.5.0 is giving an error of targetBranch main does not exist helm/chart-testing-action#133

I have try to update to v2.5.0 and it's not working. https://github.com/liangyuanpeng/karmada/actions/runs/6714930957

And v2.6.0 can fix it.

Since we are using cosign separately, it is better to follow the notification to upgrade the installer version.

So this PR have two change:

• Update chart-testing-action to v2.6.0
• Update cosigin-installer to v3.1.1 see https://blog.sigstore.dev/cosign-releases-bucket-deprecation/

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[RainbowMango]

/assign
Seems this might be a blocker for the other's PR.
/priority important-soon

[RainbowMango]

Seems this is due to Sigstore no longer publishing cosign releases to GCS bucket.

There is an instruction for updating GitHub Actions if people using cosign-installer.

If you are using cosign-installer, our GitHub Action that installs Cosign, you may need to update the action only if you are pinned by hash to a version earlier than v3.1.0. The following example shows how to update the action:

Do we need to update them?

[liangyuanpeng]

Do we need to update them?

Thanks for remind and i have tested it with cosigin-installer@v3.0.3 and it's working for now,But I think it's better to follow the notification and upgrade the install version.

Also tested it with cosigin-installer@v3.1.1 and it's working.

So we can update the installer version and keep the same cosign version.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (bea718a) 52.85% compared to head (b261534) 52.82%.

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4201      +/-   ##
==========================================
- Coverage   52.85%   52.82%   -0.03%     
==========================================
  Files         239      239              
  Lines       23558    23558              
==========================================
- Hits        12451    12445       -6     
- Misses      10431    10436       +5     
- Partials      676      677       +1     

Flag	Coverage Δ
unittests	52.82% <ø> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 2 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[RainbowMango]

/lgtm
/approve

Actually we don't need to bump sigstore/cosign-installer as the action downloads the sigstore binary directly from GitHub(not the deprecated Google Bucket):
See the code for more details:
https://github.com/sigstore/cosign-installer/blob/main/action.yml#L184-L185

But it's not harm to bump it to a higher version.

[karmada-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liangyuanpeng]

Luckly, it is since 3.0.3 the cosign-installer download cosign from GitHub instead of GCS and karmada is using this version.

update v3.0.3 to download cosign from GitHub instead of GCS

Actually we don't need to bump sigstore/cosign-installer as the action downloads the sigstore binary directly from GitHub(not the deprecated Google Bucket):

It's true, and it's download from GCS when using csogin-installer with hash to a version earlier than v3.1.0. And karmada is using tag.

[RainbowMango]

I don't get why it is the v3.1.0. I think any hash version earlier than v3.0.3 also downloads from GCS.