-
3.6.0
StableAll checks were successfulpublished / fetched (push) Successful in 1spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 4spublished / signing-is-ready (push) Successful in 4spublished / source-is-compliant (push) Successful in 6spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-tested (push) Successful in 11spublished / source-is-secure (push) Successful in 19spublished / documentation-passes-lint (push) Successful in 54spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 55spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, linux) (push) Successful in 41spublished / binaries-are-built (riscv64, linux) (push) Successful in 42spublished / binaries-are-built (amd64, linux) (push) Successful in 42spublished / binaries-are-built (arm64, darwin) (push) Successful in 45spublished / binaries-are-built (amd64, darwin) (push) Successful in 45spublished / gsa (amd64, linux) (push) Successful in 19spublished / gsa (amd64, darwin) (push) Successful in 19spublished / gsa (riscv64, linux) (push) Successful in 18spublished / gsa (arm64, linux) (push) Successful in 20spublished / gsa (arm64, darwin) (push) Successful in 20spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (riscv64, linux) (push) Successful in 22spublished / binaries-are-signed (arm64, linux) (push) Successful in 25spublished / binaries-are-signed (arm64, darwin) (push) Successful in 25spublished / binaries-are-signed (amd64, darwin) (push) Successful in 28spublished / binaries-are-signed (amd64, linux) (push) Successful in 28spublished / image-is-built (amd64) (push) Successful in 1m52spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 1spublished / image-has-sbom (amd64) (push) Successful in 9spublished / container-is-diagnosed (push) Successful in 1spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 31spublished / image-is-ready (push) Successful in 1spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 1spublished / image-is-attested (kiota) (push) Successful in 30spublished / image-is-attested (dockerhub) (push) Successful in 55spublished / release-is-published (push) Successful in 1m33spublished / release-notes-are-published (push) Successful in 16spublished / published (push) Successful in 0sdamian-buho released this
2026-10-12 18:52:38 +00:00 | 103 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB5 commits, 1 contributor, 6 hours since 3.5.3.
Features
- bridge: name the repositories[].packages entry as the package manifest source (
ff301a8) - npm: take cpu and os from the npm artifact before the project-level platform lists (
01651c4)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.6.0This release also publishes the
3.6and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.6.0Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.6.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 docker pull kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9Platform Digest Size linux/amd64 sha256:ab3e701e04f49a6fd6e7d6373b248963d6412469d62bc3ffaccd2e39dbe0736b242.0 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:cdeefa5255caac6a216dd46bcd56cccfc8e7eb784a296d34f72fc7046b69c9d9Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.6.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeFull changes: https://kiota.ch/projectfile/bridge/compare/3.5.3...3.6.0
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- bridge: name the repositories[].packages entry as the package manifest source (
