install and use cosign from the main branch

Author: cpanato

.github/workflows/release.yml

@@ -24,7 +24,11 @@ jobs:
         with:
           go-version: 1.17.x
 
-      - uses: sigstore/cosign-installer@main
+      - name: install head cosign
+        run: go install github.com/sigstore/cosign@main
+
+      - name: check cosign
+        run: cosign version
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v2

.goreleaser.yml

@@ -9,7 +9,7 @@ before:
   hooks:
     - make clean
     - make dist
-    - sh -c "cosign sign-blob --timeout 360s dist/alertmanager-{{ .Version }}.tar.gz > dist/alertmanager-{{ .Version }}.sig"
+    - sh -c "cosign sign-blob --timeout 360s --output dist/alertmanager-{{ .Version }}.sig dist/alertmanager-{{ .Version }}.tar.gz"
 
 checksum:
   extra_files: