-
3.6.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 4spublished / signing-is-ready (push) Successful in 5spublished / source-is-compliant (push) Successful in 8spublished / source-is-tested (push) Successful in 12spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-secure (push) Successful in 23spublished / documentation-passes-lint (push) Successful in 57spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m1spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (arm64, linux) (push) Successful in 39spublished / binaries-are-built (arm64, darwin) (push) Successful in 39spublished / binaries-are-built (amd64, linux) (push) Successful in 39spublished / binaries-are-built (riscv64, linux) (push) Successful in 39spublished / binaries-are-built (amd64, darwin) (push) Successful in 42spublished / gsa (arm64, darwin) (push) Successful in 8spublished / gsa (amd64, linux) (push) Successful in 8spublished / gsa (riscv64, linux) (push) Successful in 8spublished / gsa (arm64, linux) (push) Successful in 8spublished / gsa (amd64, darwin) (push) Successful in 8spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, darwin) (push) Successful in 23spublished / binaries-are-signed (riscv64, linux) (push) Successful in 23spublished / binaries-are-signed (arm64, linux) (push) Successful in 23spublished / binaries-are-signed (amd64, linux) (push) Successful in 24spublished / binaries-are-signed (amd64, darwin) (push) Successful in 24spublished / image-is-built (amd64) (push) Successful in 1m32spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / container-is-ok (push) Successful in 1spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 10spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 28spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 24spublished / image-is-attested (dockerhub) (push) Successful in 45spublished / release-is-published (push) Successful in 53spublished / release-notes-are-published (push) Successful in 4spublished / published (push) Successful in 0sdamian-buho released this
2026-10-14 03:32:05 +00:00 | 94 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB8 commits, 1 contributor, 1 day since 3.6.0.
Bug fixes
- deps: bump core to 2.18.0 (
46ed1d4)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.6.1This release also publishes the
3.6and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.6.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.6.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 docker pull kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276Platform Digest Size linux/amd64 sha256:c1db8957bd85019ab35f52e8ae7e2d457ba1fcc7bf65eaeca1c29540cb03adc3242.1 MB (+0.1 MB) Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:3051806d8fff718ad2183f8b18ce923cb8a11dd72f952c1851d4e01dc78b7276Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.6.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeFull changes: https://kiota.ch/projectfile/bridge/compare/3.6.0...3.6.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- deps: bump core to 2.18.0 (
