38 releases 47 tags

RSS feed

• 3.5.0 64ee135b5b

  Compare

  3.5.0 Stable

  damian-buho released this 2026-10-08 03:59:47 +00:00 | 144 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  11 commits, 1 contributor, 13 hours since 3.4.1.

  Features

  • release-notes: pin images by digest and list per-platform digests (59885fc)
  • release-notes: show per-platform size change against the previous release (dd109cf)
  • release-notes: list package changes from the attested SBOM (5fae330)
  • release-notes: configure shown commit sections from the projectfile (27b5866)
  • release-notes: attach files named by release.attach to the release (2886863)

  Bug fixes

  • assert on a here-string, not a grep -q pipeline (62a8d75)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-bridge:3.5.0
  

  This release also publishes the 3.5 and 3 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/bridge:3.5.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-bridge
  ~/.local/bin/pf-bridge --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  pf-bridge

  $ pf-bridge --help
  pf-bridge — keep every project file in sync with your projectfile document
  
  A projectfile (projectfile.yaml) is the single source of truth for a project:
  identity, people, links, and tool config. pf-bridge copies that data out
  into the files each tool already reads — README.md, package.json,
  CITATION.cff, forge settings — and reads two-way files back.
  Spec: https://projectfile.org/specification/
  
  Usage:
    pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
    pf-bridge all [flags]       update every file from the projectfile [rw]
    pf-bridge check [flags]     verify declared files match, write nothing [ro]
    pf-bridge to all            write projectfile out to every file [rw]
    pf-bridge from all          read every two-way file back in [rw]
    pf-bridge --list            list installed bridges
    pf-bridge completion SHELL  print completion script (bash|zsh|fish)
  
  [rw] updates files, [ro] only reads or compares. `check` without names
  covers the bridges this project declares; `check <name>…` narrows it,
  `check --all` covers every installed bridge instead.
  
  Shared flags (also accepted after a bridge name):
    --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
    --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
    Drift warns by default; --fail-on-drift makes it fatal.
  
  Tools:
    cache                Manage the local SPDX and include cache
    forge                Push projectfile metadata out to the repository forge
    init                 Scaffold a new projectfile document (prefer pf-cli init)
    release-notes        Render release notes from git
    scan                 Run scanners to refresh projectfile metadata from filesystem signals
  Package manifests:
    composer   [rw]  composer.json — two-way sync
    npm        [rw]  package.json — two-way sync
    pyproject  [rw]  pyproject.toml — two-way sync
    shard      [rw]  shard.yml — two-way sync
  Citation and ownership:
    cff          [rw]  CITATION.cff — two-way sync
    codeowners   [rw]  CODEOWNERS — two-way sync
    funding      [ro]  FUNDING.yml — one-way render
    fundingjson  [ro]  funding.json — one-way render
  Documentation:
    ai-policy     [ro]  AI_POLICY.md — one-way render
    coc           [ro]  CODE_OF_CONDUCT.md — one-way render
    contributing  [ro]  CONTRIBUTING.md — one-way render
    dei           [ro]  DEI.md — one-way render
    fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
    readme        [ro]  README.md — one-way render
    security      [ro]  SECURITY.md — one-way render
    support       [ro]  SUPPORT.md — one-way render
  Repository setup:
    browserslist     [ro]  .browserslistrc — one-way render
    gitattributes    [ro]  .gitattributes — one-way render
    ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
    license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
    releaserc        [ro]  .releaserc.yaml — one-way render
    vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
    yamllint         [ro]  .yamllint — one-way render
  
  Help per bridge: pf-bridge <bridge> --help
  

  Examples and every command’s help are in Usage.

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  docker pull kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  

  Platform	Digest	Size
  linux/amd64	sha256:ff381969ceae4d5ac017e5e9b158eff920f2cd66d1e1b35c70a179197798a48d	241.4 MB

  Sizes are compressed layer bytes as stored in the registry.

  Packages since the previous release: 1 updated, 0 added, 0 removed.

  • projectfile.org/projectfile/bridge v3.4.1 → v3.5.0

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:77a74012cdba9d3d53185fe3d0e933021d91b555a5c6e0ff57dddfd9fffbda3a
  

  Full changes: https://kiota.ch/projectfile/bridge/compare/3.4.1...3.5.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-bridge-darwin-arm64
    1 download · 2026-10-08 04:20:37 +00:00 · 8 MiB
  • pf-bridge-darwin-x86_64
    1 download · 2026-10-08 04:20:36 +00:00 · 8.6 MiB
  • pf-bridge-linux-aarch64
    1 download · 2026-10-08 04:20:37 +00:00 · 7.9 MiB
  • pf-bridge-linux-riscv64
    1 download · 2026-10-08 04:20:37 +00:00 · 7.5 MiB
  • pf-bridge-linux-x86_64
    1 download · 2026-10-08 04:20:37 +00:00 · 8.5 MiB