PPONP-1178 Bump cosign to v2.2.0

cosign/download/action.yaml

@@ -4,12 +4,21 @@ inputs:
   version:
     required: false
     description: "Specific release id, selected from https://github.com/sigstore/cosign/releases"
-    default: "80120049" # v1.13.1
+    # Find ID by tag:
+    # curl https://api.github.com/repos/sigstore/cosign/releases | jq '.[] | select(.tag_name == "v2.2.0").id'
+    default: "119502144" # v2.2.0
 runs:
   using: "composite"
   steps:
+    - name: Cache cosign binary
+      id: cache-cosign
+      uses: actions/cache@v3
+      with:
+        path: ~/.local/bin
+        key: ${{ runner.os }}-cosign-${{ inputs.version }}
     - name: "Download binary"
       shell: bash
+      if: steps.cache-cosign.outputs.cache-hit != 'true'
       run: |
         URL=`curl -s https://api.github.com/repos/sigstore/cosign/releases/${{ inputs.version }} | jq -r '.assets[] | select(.name=="cosign-linux-amd64") | .browser_download_url'`;
         wget -q $URL --output-document cosign;