From 1029a79d4d4f104f1f93b37f83330186f202e1a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Batuhan=20Apayd=C4=B1n?= <batuhan.apaydin@trendyol.com>
Date: Mon, 3 Jan 2022 05:31:44 -0800
Subject: [PATCH] chore(ci): support go install from main
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
Co-authored-by: Furkan Türkal <furkan.turkal@trendyol.com>
Co-authored-by: Necatican Yıldırım <necaticanyildirim@gmail.com>
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
---
 .github/workflows/test-action.yml | 28 +++++++++++++++++++++++++++-
 README.md                         | 26 ++++++++++++++++++++++++++
 action.yml                        | 12 +++++++++++-
 3 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-action.yml b/.github/workflows/test-action.yml
index ec2afda..fc076be 100644
--- a/.github/workflows/test-action.yml
+++ b/.github/workflows/test-action.yml
@@ -1,6 +1,6 @@
 name: test-cosign
 
-on: [pull_request]
+on: [push]
 
 jobs:
   test_cosign_action:
@@ -241,3 +241,29 @@ jobs:
             exit 0
           fi
 
+  test_cosign_with_go_install:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: none
+      checks: none
+      contents: none
+      deployments: none
+      issues: none
+      packages: none
+      pull-requests: none
+      repository-projects: none
+      security-events: none
+      statuses: none
+    name: Try to install cosign with go
+    steps:
+    - uses: actions/checkout@v2
+    - uses: actions/setup-go@v2
+      with:
+        go-version: '1.17.x'
+    - name: Install Cosign
+      uses: ./
+      with:
+        cosign-release: 'main'
+    - name: Check install!
+      run: cosign version
+
diff --git a/README.md b/README.md
index a27c0ba..98ae2b8 100644
--- a/README.md
+++ b/README.md
@@ -56,6 +56,32 @@ jobs:
         run: cosign version
 ```
 
+If you want to install cosign from its main version by using 'go install' under the hood, you can set 'cosign-release' as 'main'. Once you did that, cosign will be installed via 'go install' which means that please ensure that go is installed.
+
+Example of installing cosign via go install:
+
+```yaml
+jobs:
+  test_cosign_action:
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: none
+
+    name: Install Cosign via go install
+    steps:
+      - name: Install go
+        uses: actions/setup-go@v2
+        with:
+          go-version: '1.17.x'
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@main
+        with:
+          cosign-release: main
+      - name: Check install!
+        run: cosign version
+```
+
 This action does not need any GitHub permission to run, however, if your workflow needs to update, create or perform any
 action against your repository, then you should change the scope of the permission appropriately.
 
diff --git a/action.yml b/action.yml
index 5487c24..b3fd8c3 100644
--- a/action.yml
+++ b/action.yml
@@ -33,6 +33,17 @@ runs:
           alias log_error="echo \"ERROR:\""
         fi
         set -e
+        
+        mkdir -p ${{ inputs.install-dir }}
+
+        if [[ ${{ inputs.cosign-release }} == "main" ]]; then
+          log_info "installing cosign via 'go install' from its main version"
+          GOBIN=$(go env GOPATH)/bin
+          go install github.com/sigstore/cosign/cmd/cosign@main
+          ln -s $GOBIN/cosign ${{ inputs.install-dir}}/cosign
+          echo "${{ inputs.install-dir }}" >> $GITHUB_PATH
+          exit 0
+        fi
 
         bootstrap_version='v1.4.1'    
         bootstrap_linux_amd64_sha='08ba779a4e6ff827079abed1a6d1f0a0d9e48aea21f520ddeb42ff912f59d268'
@@ -43,7 +54,6 @@ runs:
 
         trap "popd" EXIT
 
-        mkdir -p ${{ inputs.install-dir }}
         pushd ${{ inputs.install-dir }} > /dev/null
 
         case ${{ runner.os }} in