Back up sigstore to 1.8.9 for go 1.22.7 or older #287

	name: ci
	on:
	workflow_dispatch: {}
	pull_request:
	push:
	branches:
	- master
	tags:
	- 'v..*'

	jobs:
	build_and_test:
	name: build_and_test
	runs-on: ubuntu-22.04
	steps:
	- uses: actions/checkout@v2

	- name: Check for markdown Lint
	run: \|
	sudo npm install -g markdownlint-cli
	markdownlint .

	- name: Set up Go
	uses: actions/setup-go@v1
	with:
	go-version: '1.22.8'

	- name: Check go.mod and go.sum are tidy
	run: \|
	go mod tidy
	git diff --exit-code -- go.mod go.sum

	- name: Install govulncheck
	run: go install golang.org/x/vuln/cmd/govulncheck@latest

	- name: Check for vulnerabilities
	run: $HOME/go/bin/govulncheck ./...

	- name: Build Source
	run: go build ./...

	- name: Install Lint
	uses: golangci/golangci-lint-action@v2
	with:
	version: v1.61
	skip-pkg-cache: true
	skip-build-cache: true

	- name: Run Lint
	run: \|
	golangci-lint run

	- name: Install Cosign
	run: go install github.com/sigstore/cosign/v2/cmd/cosign@latest

	- name: Run Tests
	run: go test -coverprofile cover.out -race ./...

	- name: Upload coverage report
	uses: codecov/codecov-action@v2
	with:
	files: cover.out
	flags: unittests
	name: codecov

	- name: Install syft
	run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \| sh -s -- -b /usr/local/bin

	- name: Check Configuration
	run: curl -sSfL https://goreleaser.com/static/run \| bash -s -- check

	- name: Test Release
	run: curl -sSfL https://goreleaser.com/static/run \| bash -s -- --snapshot --skip=publish

Provide feedback