-
3.5.3
StableAll checks were successfulpublished / fetched (push) Successful in 1spublished / projectfile-is-valid (push) Successful in 10spublished / signing-is-ready (push) Successful in 9spublished / source-is-compliant (push) Successful in 11spublished / projectfile-is-ok (push) Successful in 7spublished / source-is-tested (push) Successful in 13spublished / source-is-secure (push) Successful in 37spublished / documentation-passes-lint (push) Successful in 1m5spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m5spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, darwin) (push) Successful in 38spublished / binaries-are-built (riscv64, linux) (push) Successful in 37spublished / binaries-are-built (arm64, linux) (push) Successful in 43spublished / binaries-are-built (amd64, linux) (push) Successful in 43spublished / binaries-are-built (amd64, darwin) (push) Successful in 43spublished / gsa (arm64, darwin) (push) Successful in 21spublished / gsa (amd64, linux) (push) Successful in 21spublished / gsa (riscv64, linux) (push) Successful in 20spublished / gsa (amd64, darwin) (push) Successful in 21spublished / gsa (arm64, linux) (push) Successful in 21spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, darwin) (push) Successful in 18spublished / binaries-are-signed (arm64, linux) (push) Successful in 17spublished / binaries-are-signed (amd64, linux) (push) Successful in 19spublished / binaries-are-signed (amd64, darwin) (push) Successful in 24spublished / image-is-built (amd64) (push) Successful in 2m25spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 1spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 9spublished / image-is-secure (amd64) (push) Successful in 13spublished / container-is-verified (amd64) (push) Successful in 31spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 25spublished / image-is-attested (dockerhub) (push) Successful in 53spublished / binaries-are-signed (riscv64, linux) (push) Successful in 3m17spublished / release-is-published (push) Successful in 1m2spublished / release-notes-are-published (push) Successful in 6spublished / published (push) Successful in 0sdamian-buho released this
2026-10-11 19:18:10 +00:00 | 109 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB2 commits, 1 contributor, 49 minutes since 3.5.2.
Features
- npm: name the package after a declared npm package artifact (
1c3e545)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.5.3This release also publishes the
3.5and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.5.3Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.5.3/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea docker pull kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554deaPlatform Digest Size linux/amd64 sha256:f929402782b6480a5c248e8a15d42378e51b2164cf05b6b46ba1bcc77ff676b2242.0 MB (+0.5 MB) Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554dea cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:5431221cce9780e3ccc1259dc151daf96b444a07c8bb0155ead222a195554deaFull changes: https://kiota.ch/projectfile/bridge/compare/3.5.1...3.5.3
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- npm: name the package after a declared npm package artifact (
