* fix path that was unix-centric

Signed-off-by: Bob Callaway <[email protected]>

* add back missing ./

Signed-off-by: Bob Callaway <[email protected]>

---------

Signed-off-by: Bob Callaway <[email protected]>

Signed-off-by: Carlos Panato <[email protected]>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@1af3b93...8e8c483)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: use env vars for template expansions; show curl errors

* Use environment variables to avoid template expansions in code
  contexts, which could potentially result in code injection.
* Use `-S` option with `curl` so error output is not suppressed, which
  should result in more informative output when the installer fails due
  to network issues.
* Double-quote shell variable expansions to prevent unintended word
  splitting and globbing.

Signed-off-by: Daniel Hast <[email protected]>

* fix: substitute env vars in inputs.install-dir

Signed-off-by: Daniel Hast <[email protected]>

---------

Signed-off-by: Daniel Hast <[email protected]>

Signed-off-by: Carlos Alexandro Becker <[email protected]>

Signed-off-by: MaineK00n <[email protected]>

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@8e8c483...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Upgrade to newest cosign version
* Also tweak README to mitigate issue #219: Do not promote the use of
  "cosign-release" argument

Signed-off-by: Jussi Kukkonen <[email protected]>

Transient network errors during the cosign download can cause the
action to fail. This is particularly problematic when the action runs
after images have been pushed to a registry, resulting in unsigned
images.

Add --retry 3 to all curl calls. By default, curl uses exponential
backoff: it waits 1 second before the first retry, then doubles the
wait time for each subsequent retry up to a maximum of 10 minutes. It
also respects Retry-After headers in the response.

Closes: #209

Signed-off-by: Jose Fernandez <[email protected]>