build(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.2 #87

	name: Container CI pipeline

	on:
	# Triggers the workflow on push or pull request events but only for the
	# master branch
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	# Allows to run this workflow manually from the Actions tab
	workflow_dispatch:

	jobs:
	ci:
	runs-on: ubuntu-latest
	steps:
	# Check out repo under $GITHUB_WORKSPACE
	- name: Check out expander
	uses: actions/checkout@v4

	- name: Bring up the environment
	run: \|
	docker compose -f docker-compose.yml -f docker-compose.dev.yml \
	up --build --detach

	# curl and jq are preinstalled on Github ubuntu-latest runner
	- name: Prepare test job
	run: \|
	zip -9r inside.zip README.md docs
	zip -9r outside.zip expander inside.zip

	- name: Wait for API to come up
	run: \|
	for try in $(seq 1 320) ; do
	curl -s http://127.0.0.1:8200/ping \| \
	jq -r .answer \| \
	grep '^pong$' >/dev/null && break
	sleep 1
	echo -n "."
	done
	echo

	- name: Submit and wait for test job
	run: \|
	echo "Submitting test job..."
	job_id=$(curl -s -F file=@outside.zip \
	http://127.0.0.1:8200/v1/scan \| \
	jq -r .job_id)

	echo "Waiting for job to finish..."
	for try in $(seq 1 320) ; do
	code=$(curl -s -w "%{stderr}%{http_code}" \
	http://127.0.0.1:8200/v1/report/"$job_id" 2>&1 >/dev/null)
	[ "$code" -eq 404 ] \|\| break
	sleep 1
	echo -n "."
	done
	echo

	echo "Job report:"
	curl -s http://127.0.0.1:8200/v1/report/$job_id \| jq
	[ "$try" -lt 320 ] \|\| exit 1

	- name: Get logs
	if: always()
	run: docker compose logs

	- name: Bring down the environment
	if: always()
	run: docker compose -f docker-compose.yml -f docker-compose.dev.yml down

Provide feedback