-
3.5.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 10spublished / signing-is-ready (push) Successful in 51spublished / source-is-compliant (push) Successful in 1m0spublished / source-is-tested (push) Successful in 31spublished / documentation-passes-lint (push) Successful in 1m31spublished / source-is-secure (push) Successful in 1m29spublished / projectfile-is-ok (push) Successful in 7spublished / source-passes-lint (push) Successful in 3m26spublished / documentation-is-ok (push) Successful in 0spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, darwin) (push) Successful in 46spublished / binaries-are-built (amd64, linux) (push) Successful in 47spublished / binaries-are-built (arm64, darwin) (push) Successful in 50spublished / binaries-are-built (arm64, linux) (push) Successful in 49spublished / binaries-are-built (riscv64, linux) (push) Successful in 51spublished / image-is-built (amd64) (push) Successful in 2m14spublished / gsa (amd64, darwin) (push) Successful in 10spublished / gsa (amd64, linux) (push) Successful in 10spublished / gsa (arm64, darwin) (push) Successful in 11spublished / gsa (arm64, linux) (push) Successful in 7spublished / gsa (riscv64, linux) (push) Successful in 5spublished / image-has-sbom (amd64) (push) Successful in 15spublished / secrets-ready (push) Successful in 0spublished / binaries-are-ok (push) Successful in 0spublished / image-is-secure (amd64) (push) Successful in 20spublished / images-are-ok (push) Successful in 0spublished / binaries-are-signed (amd64, darwin) (push) Successful in 22spublished / binaries-are-signed (amd64, linux) (push) Successful in 21spublished / binaries-are-signed (arm64, darwin) (push) Successful in 19spublished / binaries-are-signed (arm64, linux) (push) Successful in 20spublished / binaries-are-signed (riscv64, linux) (push) Successful in 24spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / container-is-verified (amd64) (push) Successful in 2m2spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 38spublished / image-is-attested (dockerhub) (push) Successful in 1m8spublished / release-is-published (push) Successful in 54spublished / release-notes-are-published (push) Successful in 5spublished / published (push) Successful in 0sdamian-buho released this
2026-10-08 23:59:15 +00:00 | 138 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB5 commits, 1 contributor, 4 hours since 3.5.0.
Performance
- container: declare M6E_VERSION next to the user stage (
3d74a7d)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.5.1This release also publishes the
3.5and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.5.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 docker pull kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85Platform Digest Size linux/amd64 sha256:b1abe18374754b31b7b81bef5885662f37fb8808fe063472c5c579129776b294241.5 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:80c2da51a250f7b4ab9e5d57dd26368c10d168cc28ef54772811aeade5e34d85Full changes: https://kiota.ch/projectfile/bridge/compare/3.5.0...3.5.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- container: declare M6E_VERSION next to the user stage (
