Use matrix for build, include windows, and unify SHA256 hash with powershell

.github/workflows/cross.yaml

@@ -4,63 +4,57 @@ on:
       - main
       - release-*
     tags:
-      - '*'
+      - "*"
+  pull_request:
 name: Cross
 jobs:
-  linux:
-    name: build
-    runs-on: ubuntu-latest
+  build:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [macos-latest, ubuntu-latest, windows-latest]
+        include:
+          - os: macos-latest
+            TARGET: darwin
+            COSIGN_PASSWORD: COSIGN_PASSWORD
+          - os: ubuntu-latest
+            TARGET: linux
+            COSIGN_PASSWORD: COSIGN_PASSWORD
+          - os: windows-latest
+            TARGET: windows
+            COSIGN_PASSWORD: COSIGN_PASSWORD
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.16.3
-    - uses: sigstore/[email protected]
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: install deps
-      run: sudo apt-get update && sudo apt-get install -yq libpcsclite-dev
-    - name: build
-      run: make cosign && mv ./cosign ./cosign-linux-amd64
-    - name: sign
-      run: |
-          echo -n "${{secrets.COSIGN_PASSWORD}}" | cosign sign-blob -key ./.github/workflows/cosign.key ./cosign-linux-amd64 > cosign-linux-amd64.sig
-    - name: Print Info
-      run: shasum -a 256 ./cosign-linux-amd64 > cosign-linux-amd64.sha256 && cat cosign-linux-amd64.sha256
-    - name: verify
-      run: cosign verify-blob -key ./.github/workflows/cosign.pub -signature cosign-linux-amd64.sig ./cosign-linux-amd64
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: artifacts
-        path: |
-          cosign-*
-          cosign.-*sha256
-          cosign-*.sig
-  darwin:
-    name: build
-    runs-on: macos-latest
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.16.3
-    - name: Checkout code
-      uses: actions/checkout@v2
-    - name: build
-      run: make cosign && mv ./cosign ./cosign-darwin-amd64
-    - name: sign
-      run: |
-          echo -n "${{secrets.COSIGN_PASSWORD}}" | ./cosign-darwin-amd64 sign-blob -key ./.github/workflows/cosign.key ./cosign-darwin-amd64 > cosign-darwin-amd64.sig
-    - name: Print Info
-      run: shasum -a 256 ./cosign-darwin-amd64 > cosign-darwin-amd64.sha256 && cat cosign-darwin-amd64.sha256
-    - name: verify
-      run: ./cosign-darwin-amd64 verify-blob -key ./.github/workflows/cosign.pub -signature cosign-darwin-amd64.sig ./cosign-darwin-amd64
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v2
-      with:
-        name: artifacts
-        path: |
-          cosign-*
-          cosign.-*sha256
-          cosign-*.sig
+      - name: Install Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.16.3
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: install deps
+        if: matrix.os == 'ubuntu-latest'
+        run: sudo apt-get update && sudo apt-get install -yq libpcsclite-dev
+      - name: build
+        run: make cosign && mv ./cosign ./cosign-${{matrix.TARGET}}-amd64
+      - name: Print Info
+        shell: pwsh
+        run: |
+          $(Get-FileHash -Path ./cosign-${{matrix.TARGET}}-amd64).Hash | Tee-Object -Path cosign-${{matrix.TARGET}}-amd64.sha256
+      - name: sign
+        shell: bash
+        env:
+          COSIGN_PASSWORD: ${{secrets[matrix.COSIGN_PASSWORD]}}
+        if: github.event_name != 'pull_request'
+        run: |
+          ./cosign-${{matrix.TARGET}}-amd64 sign-blob -key ./.github/workflows/cosign.key ./cosign-${{matrix.TARGET}}-amd64 > cosign-${{matrix.TARGET}}-amd64.sig
+      - name: verify
+        if: github.event_name != 'pull_request'
+        run: ./cosign-${{matrix.TARGET}}-amd64 verify-blob -key ./.github/workflows/cosign.pub -signature cosign-${{matrix.TARGET}}-amd64.sig ./cosign-${{matrix.TARGET}}-amd64
+      - name: Upload artifacts
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v2
+        with:
+          name: artifacts
+          path: |
+            cosign-*
+            cosign.-*sha256
+            cosign-*.sig