38 releases 47 tags

RSS feed

• 3.4.0 d61b061393

  Compare

  Readable release notes Stable

  damian-buho released this 2026-10-07 05:02:46 +00:00 | 162 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  9 commits, 1 contributor, 3 hours since 3.3.1.

  The release page now names the image tags this release actually published, renders magnet links as links, and splits “Verify” into one block per artifact kind.

  The org.projectfile.semver field listed under Features was replaced within this release: the tag ladder is now worded by an installation entry’s release.postfix, and the README keeps its version-free sentence.

  Features

  • derive: expose stable version parts as org.projectfile.semver (7ce9e4a)
  • release-notes: split Verify per artifact kind and check the installed binary (fd74162)
  • release-notes: apply an installation entry’s release prefix and postfix on the release page (d42db3d)

  Bug fixes

  • release-notes: render magnets as links, fenced where the forge strips the scheme (36f1356)
  • dispatch: skip -<uname -m> release copies during discovery (1b8bba2)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-bridge:3.4.0
  

  This release also publishes the 3.4 and 3 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/bridge:3.4.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  curl --fail --location --output pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.4.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m | sed -e s/x86_64/amd64/ -e s/aarch64/arm64/) && chmod +x pf-bridge
  ./pf-bridge --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  pf-bridge

  $ pf-bridge --help
  pf-bridge — keep every project file in sync with your projectfile document
  
  A projectfile (projectfile.yaml) is the single source of truth for a project:
  identity, people, links, and tool config. pf-bridge copies that data out
  into the files each tool already reads — README.md, package.json,
  CITATION.cff, forge settings — and reads two-way files back.
  Spec: https://projectfile.org/specification/
  
  Usage:
    pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
    pf-bridge all [flags]       update every file from the projectfile [rw]
    pf-bridge check [flags]     verify declared files match, write nothing [ro]
    pf-bridge to all            write projectfile out to every file [rw]
    pf-bridge from all          read every two-way file back in [rw]
    pf-bridge --list            list installed bridges
    pf-bridge completion SHELL  print completion script (bash|zsh|fish)
  
  [rw] updates files, [ro] only reads or compares. `check` without names
  covers the bridges this project declares; `check <name>…` narrows it,
  `check --all` covers every installed bridge instead.
  
  Shared flags (also accepted after a bridge name):
    --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
    --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
    Drift warns by default; --fail-on-drift makes it fatal.
  
  Tools:
    cache                Manage the local SPDX and include cache
    forge                Push projectfile metadata out to the repository forge
    init                 Scaffold a new projectfile document (prefer pf-cli init)
    release-notes        Render release notes from git
    scan                 Run scanners to refresh projectfile metadata from filesystem signals
  Package manifests:
    composer   [rw]  composer.json — two-way sync
    npm        [rw]  package.json — two-way sync
    pyproject  [rw]  pyproject.toml — two-way sync
    shard      [rw]  shard.yml — two-way sync
  Citation and ownership:
    cff          [rw]  CITATION.cff — two-way sync
    codeowners   [rw]  CODEOWNERS — two-way sync
    funding      [ro]  FUNDING.yml — one-way render
    fundingjson  [ro]  funding.json — one-way render
  Documentation:
    ai-policy     [ro]  AI_POLICY.md — one-way render
    coc           [ro]  CODE_OF_CONDUCT.md — one-way render
    contributing  [ro]  CONTRIBUTING.md — one-way render
    dei           [ro]  DEI.md — one-way render
    fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
    readme        [ro]  README.md — one-way render
    security      [ro]  SECURITY.md — one-way render
    support       [ro]  SUPPORT.md — one-way render
  Repository setup:
    browserslist     [ro]  .browserslistrc — one-way render
    gitattributes    [ro]  .gitattributes — one-way render
    ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
    license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
    releaserc        [ro]  .releaserc.yaml — one-way render
    vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
    yamllint         [ro]  .yamllint — one-way render
  
  Help per bridge: pf-bridge <bridge> --help
  

  Examples and every command’s help are in Usage.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge:3.4.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge:3.4.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge:3.4.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge:3.4.0
  

  Full changes: https://kiota.ch/projectfile/bridge/compare/3.3.1...3.4.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-bridge-darwin-amd64
    1 download · 2026-10-07 05:15:11 +00:00 · 8.6 MiB
  • pf-bridge-darwin-arm64
    1 download · 2026-10-07 05:15:11 +00:00 · 8 MiB
  • pf-bridge-linux-amd64
    1 download · 2026-10-07 05:15:10 +00:00 · 8.5 MiB
  • pf-bridge-linux-arm64
    2 downloads · 2026-10-07 05:15:12 +00:00 · 7.9 MiB
  • pf-bridge-linux-riscv64
    2 downloads · 2026-10-07 05:15:11 +00:00 · 7.5 MiB