-
3.7.0
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / projectfile-is-valid (push) Successful in 4spublished / gpg-is-ready (push) Successful in 4spublished / signing-is-ready (push) Successful in 5spublished / source-is-compliant (push) Successful in 6spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-tested (push) Successful in 11spublished / source-is-secure (push) Successful in 22spublished / documentation-passes-lint (push) Successful in 1m0spublished / documentation-is-ok (push) Successful in 0spublished / source-passes-lint (push) Successful in 1m7spublished / source-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, linux) (push) Successful in 40spublished / binaries-are-built (arm64, darwin) (push) Successful in 41spublished / binaries-are-built (amd64, darwin) (push) Successful in 42spublished / binaries-are-built (arm64, linux) (push) Successful in 36spublished / binaries-are-built (riscv64, linux) (push) Successful in 33spublished / gsa (arm64, darwin) (push) Successful in 8spublished / gsa (amd64, darwin) (push) Successful in 10spublished / gsa (amd64, linux) (push) Successful in 10spublished / gsa (arm64, linux) (push) Successful in 6spublished / gsa (riscv64, linux) (push) Successful in 6spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (arm64, linux) (push) Successful in 24spublished / binaries-are-signed (arm64, darwin) (push) Successful in 24spublished / binaries-are-signed (amd64, linux) (push) Successful in 24spublished / binaries-are-signed (amd64, darwin) (push) Successful in 25spublished / image-is-built (amd64) (push) Successful in 1m29spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / binaries-are-signed (riscv64, linux) (push) Successful in 19spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / container-is-diagnosed (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 11spublished / image-is-secure (amd64) (push) Successful in 14spublished / container-is-verified (amd64) (push) Successful in 35spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 27spublished / image-is-attested (dockerhub) (push) Successful in 45spublished / binaries-are-torrented (push) Successful in 1m54spublished / release-is-published (push) Successful in 1m3spublished / release-notes-are-published (push) Successful in 5spublished / published (push) Successful in 0sdamian-buho released this
2026-10-15 01:22:58 +00:00 | 82 commits to dev since this releaseGPG key ID: 87B15EAD49FD22AB11 commits, 1 contributor, 21 hours since 3.6.1.
Features
- forge: push branch and tag protection derived from release branches (
2b2702c) - forge: set the origin default branch to release.trunk (
c06adaf)
Bug fixes
- npm: skip a non-SemVer identity.version instead of writing it (
87f0f5c) - net: retry every network crossing on core's shared policy (
251e0eb) - security: suppress CVE-2026-92392 in the Ubuntu cURL (
5dfaa8e) - security: generate the scanner ignore files from the projectfile (
a5e54da)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-bridge:3.7.0This release also publishes the
3.7and3tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/bridge:3.7.0Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-bridge https://kiota.ch/projectfile/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-bridge ~/.local/bin/pf-bridge --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
pf-bridge
$ pf-bridge --help pf-bridge — keep every project file in sync with your projectfile document A projectfile (projectfile.yaml) is the single source of truth for a project: identity, people, links, and tool config. pf-bridge copies that data out into the files each tool already reads — README.md, package.json, CITATION.cff, forge settings — and reads two-way files back. Spec: https://projectfile.org/specification/ Usage: pf-bridge <bridge> [args] run one bridge (e.g. readme, npm, forge) pf-bridge all [flags] update every file from the projectfile [rw] pf-bridge check [flags] verify declared files match, write nothing [ro] pf-bridge to all write projectfile out to every file [rw] pf-bridge from all read every two-way file back in [rw] pf-bridge --list list installed bridges pf-bridge completion SHELL print completion script (bash|zsh|fish) [rw] updates files, [ro] only reads or compares. `check` without names covers the bridges this project declares; `check <name>…` narrows it, `check --all` covers every installed bridge instead. Shared flags (also accepted after a bridge name): --check, --dry-run, --force, --create-all, --fail-on-drift, --offline, --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent. Drift warns by default; --fail-on-drift makes it fatal. Tools: cache Manage the local SPDX and include cache forge Push projectfile metadata out to the repository forge init Scaffold a new projectfile document (prefer pf-cli init) release-notes Render release notes from git scan Run scanners to refresh projectfile metadata from filesystem signals Package manifests: composer [rw] composer.json — two-way sync npm [rw] package.json — two-way sync pyproject [rw] pyproject.toml — two-way sync shard [rw] shard.yml — two-way sync Citation and ownership: cff [rw] CITATION.cff — two-way sync codeowners [rw] CODEOWNERS — two-way sync funding [ro] FUNDING.yml — one-way render fundingjson [ro] funding.json — one-way render Documentation: ai-policy [ro] AI_POLICY.md — one-way render coc [ro] CODE_OF_CONDUCT.md — one-way render contributing [ro] CONTRIBUTING.md — one-way render dei [ro] DEI.md — one-way render fragments [ro] FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render) readme [ro] README.md — one-way render security [ro] SECURITY.md — one-way render support [ro] SUPPORT.md — one-way render Repository setup: browserslist [ro] .browserslistrc — one-way render gitattributes [ro] .gitattributes — one-way render ignore [ro] .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render license [ro] LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite) releaserc [ro] .releaserc.yaml — one-way render vulnerabilities [ro] .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render yamllint [ro] .yamllint — one-way render Help per bridge: pf-bridge <bridge> --helpExamples and every command’s help are in Usage.
Image digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b docker pull kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097bPlatform Digest Size linux/amd64 sha256:bf2808b00c4c5d357e62e516921edb077a31dbe2e067846defba85e7b9bcc212242.1 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097b cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/bridge@sha256:22dc2c16b663cb92491bda93177ee63b338da975cbcf2c2d6fafccbd1ccc097bPrebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-bridge.asc https://kiota.ch/projectfile/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-bridge.asc pf-bridgeDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/bridge/compare/3.6.1...3.7.0
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- forge: push branch and tag protection derived from release branches (
