43 releases 48 tags

RSS feed

• v3.1.2 f49e738772

  Compare

  v3.1.2 Stable

  damian-buho released this 2026-10-21 11:00:52 +00:00 | 0 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  4 commits, 1 contributor, 1 day since v3.1.1.

  Bug fixes

  • render: resolve Forgejo artifact actions through the instance's default actions URL (0f35d77)

  Performance

  • render: lower Forgejo artifact hand-offs to Forgejo's v4 actions (eab7d74)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v3.1.2
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v3.1.2
  

  Go toolchain

  Install with the Go toolchain:

  go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.2
  

  Then run pf-ci --help.

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v3.1.2/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v3.1.2
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v3.1.2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v3.1.2
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v3.1.2
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v3.1.2/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc ~/.local/bin/pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v3.1.2

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v3.1.2

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-21 11:21:03 +00:00 · 11 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-21 11:21:03 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-21 11:21:03 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-21 11:21:04 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-21 11:21:05 +00:00 · 11 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-21 11:21:05 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-21 11:21:05 +00:00 · 11 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-21 11:21:06 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-21 11:21:06 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-21 11:21:06 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-21 11:21:02 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-21 11:21:02 +00:00 · 228 B
  • projectfile-ci-v3.1.2.magnet
    1 download · 2026-10-21 11:21:07 +00:00 · 188 B
  • projectfile-ci-v3.1.2.torrent
    0 downloads · 2026-10-21 11:21:07 +00:00 · 9.8 KiB
• v3.1.1 cc388a3b5f

  Compare

  v3.1.1 Stable

  damian-buho released this 2026-10-19 12:02:30 +00:00 | 5 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  3 commits, 1 contributor, 5 hours since v3.1.0.

  Bug fixes

  • workflows: move pins (92e135a)
  • workflows: fix preflights (dc829a1)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v3.1.1
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v3.1.1
  

  Go toolchain

  Install with the Go toolchain:

  go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.1
  

  Then run pf-ci --help.

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v3.1.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v3.1.1
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v3.1.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v3.1.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v3.1.1
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v3.1.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc ~/.local/bin/pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v3.1.1

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v3.1.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-20 00:37:47 +00:00 · 11 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-20 00:37:47 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-20 00:37:47 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-20 00:37:48 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-20 00:37:48 +00:00 · 11 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-20 00:37:48 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-20 00:37:49 +00:00 · 11 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-20 00:37:49 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-20 00:37:49 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-20 00:37:50 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-20 00:37:46 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-20 00:37:46 +00:00 · 228 B
  • projectfile-ci-v3.1.1.magnet
    1 download · 2026-10-20 00:37:50 +00:00 · 188 B
  • projectfile-ci-v3.1.1.torrent
    0 downloads · 2026-10-20 00:37:51 +00:00 · 9.8 KiB
• v3.1.0 a75d4806b6

  Compare

  v3.1.0 Stable

  damian-buho released this 2026-10-19 02:28:57 +00:00 | 9 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  17 commits, 1 contributor, 21 hours since v3.0.1.

  Features

  • render: contract tool-less joins and judge each goal in a verdict job (e29ef99)

  Bug fixes

  • refactor CI workflows (new goals + preflight checks) (bc663b5)
  • workflows: move pins (f2ed7e7, 6a9589f)
  • workflows: enable checks (3f8805f)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v3.1.0
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v3.1.0
  

  Go toolchain

  Install with the Go toolchain:

  go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.0
  

  Then run pf-ci --help.

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v3.1.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v3.1.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v3.1.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v3.1.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v3.1.0
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v3.1.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc ~/.local/bin/pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v3.1.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v3.1.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-19 02:48:48 +00:00 · 11 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-19 02:48:48 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-19 02:48:49 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-19 02:48:49 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-19 02:48:50 +00:00 · 11 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-19 02:48:51 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-19 02:48:52 +00:00 · 11 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-19 02:48:52 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-19 02:48:53 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-19 02:48:53 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-19 02:48:48 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-19 02:48:48 +00:00 · 228 B
  • projectfile-ci-v3.1.0.magnet
    1 download · 2026-10-19 02:48:53 +00:00 · 188 B
  • projectfile-ci-v3.1.0.torrent
    0 downloads · 2026-10-19 02:48:54 +00:00 · 9.8 KiB
• v3.0.1 17288c057a

  Compare

  v3.0.1 Stable

  damian-buho released this 2026-10-18 00:54:47 +00:00 | 27 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  1 commit, 1 contributor, 7 minutes since v3.0.0.

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v3.0.1
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v3.0.1
  

  Go toolchain

  Install with the Go toolchain:

  go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.0.1
  

  Then run pf-ci --help.

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v3.0.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v3.0.1
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v3.0.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v3.0.1
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v3.0.1
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v3.0.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc ~/.local/bin/pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v3.0.1

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v3.0.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-18 03:29:24 +00:00 · 11 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-18 03:29:24 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-18 03:29:24 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-18 03:29:25 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-18 03:29:25 +00:00 · 11 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-18 03:29:25 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-18 03:29:25 +00:00 · 11 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-18 03:29:25 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-18 03:29:25 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-18 03:29:25 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-18 03:29:24 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-18 03:29:24 +00:00 · 228 B
  • projectfile-ci-v3.0.1.magnet
    1 download · 2026-10-18 03:29:26 +00:00 · 188 B
  • projectfile-ci-v3.0.1.torrent
    0 downloads · 2026-10-18 03:29:26 +00:00 · 9.8 KiB
• v2.9.0 1039a32d07

  Compare

  v2.9.0 Stable

  damian-buho released this 2026-10-17 03:55:18 +00:00 | 47 commits to main since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  14 commits, 1 contributor, 8 hours since v2.8.0.

  Features

  • render: release from the stable branch run through a release-tag job (7b0ea2d)

  Bug fixes

  • deps: bump projectfile/core to v2.18.2 (c8ca0fc)
  • render: keep tag runs for a stable branch that declares no release-tag node (dd0b7cc)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v2.9.0
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v2.9.0
  

  Go toolchain

  Install with the Go toolchain:

  go install projectfile.org/projectfile/ci/v2/cmd/pf-ci@v2.9.0
  

  Then run pf-ci --help.

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v2.9.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v2.9.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v2.9.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v2.9.0
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v2.9.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v2.9.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-17 04:17:03 +00:00 · 11 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-17 04:17:03 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-17 04:17:03 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-17 04:17:04 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-17 04:17:04 +00:00 · 11 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-17 04:17:04 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-17 04:17:04 +00:00 · 11 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-17 04:17:04 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-17 04:17:05 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-17 04:17:05 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-17 04:17:03 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-17 04:17:03 +00:00 · 228 B
  • projectfile-ci-v2.9.0.magnet
    1 download · 2026-10-17 04:17:05 +00:00 · 188 B
  • projectfile-ci-v2.9.0.torrent
    0 downloads · 2026-10-17 04:17:05 +00:00 · 9.3 KiB
• v2.8.0 bc6a4607a9

  Compare

  v2.8.0 Stable

  damian-buho released this 2026-10-16 19:15:18 +00:00 | 63 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  13 commits, 1 contributor, 23 hours since v2.7.0.

  Features

  • render: name a fused job after a node that runs whenever it runs (2c68a5c)
  • matrix: lower matrix: {artifact: NAME} to TARGET_OS/TARGET_ARCH cells from the record (6c0925b)
  • render: leave tag runs to the stable branch when release.stable-dispatch opts in (bf06d66)
  • render: lower an action without a dedicated fragment to a generic uses step (4033bf3)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v2.8.0
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v2.8.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v2.8.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v2.8.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v2.8.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v2.8.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v2.8.0
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v2.8.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v2.8.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v2.8.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-16 19:23:07 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-16 19:23:07 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-16 19:23:08 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-16 19:23:08 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-16 19:23:08 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-16 19:23:08 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-16 19:23:08 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-16 19:23:08 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-16 19:23:09 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-16 19:23:09 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-16 19:23:07 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-16 19:23:07 +00:00 · 228 B
  • projectfile-ci-v2.8.0.magnet
    1 download · 2026-10-16 19:23:09 +00:00 · 188 B
  • projectfile-ci-v2.8.0.torrent
    0 downloads · 2026-10-16 19:23:09 +00:00 · 8.9 KiB
• v2.7.0 ce7e3800c6

  Compare

  v2.7.0 Stable

  damian-buho released this 2026-10-15 19:21:28 +00:00 | 77 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  435 commits, 1 contributor.

  Upgrade notes

  • interp: resolve references through core, not a third basename split (764d890)

  • deps: move to core v2.14.0 (e158a88)

    result lines move from stderr to stdout.

  Features

  • ci: subtract matrix.exclude cells from the product (6458f01)
  • publish: render one push per declared sink, not one OUTPUT_REGISTRY (71e1367)
  • publish: make the destination a matrix axis on both planes (b284438)
  • ci: mint the M6E_ARCH matrix axis from the declared architecture set (17ad9b7)
  • ci: bind the arch axis to the build and push actions (9f53936)
  • ci: let a node drop a global axis with matrix.without (d1d292e)
  • ci: bind the declared arch set to the manifest assembly action (f7d9cd6)
  • ci: route each arch cell to the runner its target declares (ec3ed09)
  • ci: let a node narrow a global axis to one value with matrix.pin (19ff903)
  • render: hand every architecture's archive to one publish cell (f130002)
  • render: gate each publish cell on a forge-level sink allow-list (fa50866)
  • i18n: translate feature fragments to Spanish and Ukrainian (e38f3bc)
  • i18n: localize identity summary and description (bf1787c)
  • images: compose foreign images from the target pull sink (a88aefe)
  • ci: serialise matrix cells with needs, the cap Forgejo honours (f64dad4)
  • when: add the preview event, gating a publish on a non-primary branch (c075edc)
  • sinks: split the own-artifact and foreign-image sink planes (69e2443)
  • render: lower advisory by step kind (7a96c16)
  • release: add riscv64 binary to published matrix (89afca0)
  • interp: resolve a ${list[]} projection to its joined elements (ca9134c)
  • release: let a project with no binary mint a release (653d3ae)
  • render: name the build-artifact edge off the producer's axes (a30cc54)
  • render: pin GHA action refs and lower least-privilege token scopes (ab0b9ac)
  • ci: add the primary trigger token for trunk publishes (872c498)
  • platform: declare whether a target's caches are fleet-shared (5390e7c)
  • ci: gate cloud workflow rendering on org.projectfile.ci.targets (6fb1a71)
  • images: per-entry sink template on the foreign plane (bb2ae5f)
  • render: route a tool that executes its cell architecture (dfcd8e9)
  • render: persist build cache mounts on an ephemeral target (f76633b)
  • render: forge-instance override family on every step (c9bb30d)
  • forge: declare Codeberg and GitHub mirrors and enable GitHub CI (d8cac08)
  • ci: build linux/amd64, arm64 and riscv64 images (446b7f6)
  • ci: sign and attest the published image with cosign (0805911)
  • ci: sign released binaries with the org GPG key (4e5c2bb)
  • publish: push to Docker Hub (1ca43d8)
  • build: resolve document references in build-arg defaults (625153d)
  • cli: add -quiet/-q to resolve and generate (71dac83)
  • generate: add -dry-run/-n and -force/-f (ffff607)
  • lefthook: stream hook output with follow (e9215a6)
  • matrix: build only the architectures a forge’s publish route declares (d2f4eff)
  • render: bind declared image tag rules to oci-push (49680fb)
  • render: lower tool keep-going to a status-function step gate (32adde3)
  • ci: let a node follow another node's when events (3644757)
  • render: roll named-cache keys by period and skip saves on a hit (218a020)
  • render: add an N-hour cache-key roll and default to 8h (1dfed64)
  • render: skip same-repo pull requests in favour of the push run (5747599)
  • render: leave the declared stable branch out of the push surface (1d30a68)
  • render: read the trunk from org.projectfile.release.trunk first (4745558)
  • version: fall back to the go install module version (8c8e8d3)
  • release: torrent every signed binary on kiota (fc446a7)
  • module: move the module to projectfile.org/projectfile/ci/v2 (6fad09d)
  • release: tag releases with a v prefix (faa378e)

  Bug fixes

  • audit: target the declared pull sink, not a registry prefix (daf784b)
  • ci: scope the self-image ref and the live stack to the cell architecture (73d7b00)
  • images: compose a run-image from its declared parts (7e06c0a)
  • render: keep the loaded image ref arch-scoped when the publish node is not (9e9ff81)
  • render: gate publish cells on the step, not the job (328ecae)
  • ci: count only the axes a publish node actually fans (d179bde)
  • dockerfile: key apt cache mounts by arch, not just series (fb1122a)
  • render: load the build archive only for the live fuse (9219c46)
  • go: bump toolchain directive to 1.26.6 (42af940)
  • deps: bump projectfile/core to v2.9.4 (b8ef390)
  • render: load the cell archive via container-load, not an inline docker load (2c0b160)
  • ci: stop warning about image sinks on projects with no image (07a397a)
  • ci: interpolate the forgejo-release asset path (c7ff049)
  • container: declare the full b19 build-arg surface (f2ea755)
  • ci: add gsa node to enforce build-binaries before auto-gsa (e473f85)
  • update .makefile/library submodule (disable check-outdated-go memoisation) (1c946c4)
  • ci: opt into the binary release pipeline explicitly (478f2db)
  • interp: scan a ${…} reference with balanced braces (abc25cb)
  • render: emit an explicit empty scalar for a valueless env entry (ab78105)
  • deps: bump kiota.ch/projectfile/core/v2 to v2.9.7 (7094a30)
  • render: give ci.env a declared-image fallback tier (5ab3c3b)
  • build-binaries: stop writing a duplicate unsuffixed dist/pf-ci (8d48a84)
  • render: hang the sink gate on the cell, not on the push step (b094558)
  • render: drop permissions: from Forgejo workflow lowering (98225db)
  • render: enable containerd image store before GHA buildx builds (3121b88)
  • render: guard docker restart when systemd is unavailable (28e3e4a)
  • render: use an isolated buildx builder on gha instead of reconfiguring the daemon (4ee2cad)
  • bump core to 2.10.3 (0612f10)
  • render: restore every producer's artifact into a consumer job (fc4f2bf)
  • render: apply the arch→runner map only to a job that builds (fb4f560)
  • render: pin actions/cache sub-actions to v5.1.0 (03b66b2)
  • forge: declare only existing forges (6f42759)
  • pf-cli optimize fuckup (ff87bf9)
  • deps: bump projectfile/core to v2.11.1 (8837320)
  • ci: run lefthook hooks with TERM=dumb (e3ecb29)
  • render: spell the live-stack identity with compose-safe axis values (ed6949e)
  • render: derive CI_SKIP names by the m6e-run rule (8416755)
  • deps: bump projectfile/core to v2.11.2 (7ea2b5e)
  • deps: bump projectfile/core to v2.12.0 (ac43e59)
  • render: gate an artifact download on its producer's mutes (ceb9b93)
  • ci: drop capacity hints on matrix cell allocations (a1dc86b)
  • ci: matrix the binaries-are-signed node (d0cb904)
  • deps: bump projectfile/core to v2.12.3 (156382a)
  • deps: bump projectfile/core to v2.13.0 (5c070ff)
  • render: default a build-arg series inside a tool image path (af62f0f)
  • cli: print subcommand help on -h, --help and help (cdd34e5)
  • cli: read -pf - from stdin and refuse -o - (dfac433)
  • deps: update projectfile core to v2.15.0 (666bb10)
  • render: keep build-arg default in a tool image tag ref (7e055f1)
  • render: tell cells of one image apart by their variant tag (6da3666)
  • ci: narrow tool-executed arch axes to the publish route (9ac9c00)
  • render: keep each fused member's event gate (b476a6e)
  • container: restore M6E_VERSION in final image (77be8d7)
  • deps: bump projectfile/core to v2.16.0 (6e21f5f)
  • render: let every job accept a skip from a narrower-gated need (1219013)
  • deps: bump core to 2.17.0 (f29625d)
  • deps: bump core to 2.18.0 (8f383ac)
  • deps: bump projectfile/core to v2.18.1 for retried network fetches (a69cc98)
  • ci: sign every binary cell in one job (b27e9d1)
  • build: fetch public Go modules through proxy.golang.org (d54fe18)

  Performance

  • render: restore and save each named cache once per job (8338d86)
  • container: declare M6E_VERSION next to the user stage (4555523)

  Reverts

  • undo local submodule edit (fix belongs in m6e/library) (e11e5c8)

  Dependencies

  • 8 dependency updates

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v2.7.0
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v2.7.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v2.7.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v2.7.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v2.7.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v2.7.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v2.7.0
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v2.7.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v2.7.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v2.7.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-15 23:44:10 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-15 23:44:10 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-15 23:44:10 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • projectfile-ci-v2.7.0.magnet
    1 download · 2026-10-15 23:44:12 +00:00 · 188 B
  • projectfile-ci-v2.7.0.torrent
    0 downloads · 2026-10-15 23:44:12 +00:00 · 8.9 KiB
• 2.6.1 a4b924990c

  Compare

  2.6.1 Stable

  damian-buho released this 2026-10-15 03:06:38 +00:00 | 80 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  2 commits, 1 contributor, 2 hours since 2.6.0.

  Bug fixes

  • ci: sign every binary cell in one job (b27e9d1)
  • build: fetch public Go modules through proxy.golang.org (d54fe18)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:2.6.1
  

  This release also publishes the 2.6 and 2 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:2.6.1
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  docker pull kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  

  Platform	Digest	Size
  linux/amd64	sha256:91a6766809129215500a1266cd8c2209ebde2752310a5900d0ad87c96fac9f96	94.2 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-2.6.1

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.0...2.6.1

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-15 03:14:30 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-15 03:14:30 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-15 03:14:31 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-15 03:14:31 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-15 03:14:31 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-15 03:14:31 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-15 03:14:31 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-15 03:14:32 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-15 03:14:32 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-15 03:14:32 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    1 download · 2026-10-15 03:14:30 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-15 03:14:30 +00:00 · 228 B
  • projectfile-ci-2.6.1.magnet
    1 download · 2026-10-15 03:14:32 +00:00 · 187 B
  • projectfile-ci-2.6.1.torrent
    0 downloads · 2026-10-15 03:14:32 +00:00 · 8.9 KiB
• 2.6.0 461033c614

  Compare

  2.6.0 Stable

  damian-buho released this 2026-10-15 00:16:17 +00:00 | 83 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  6 commits, 1 contributor, 19 hours since 2.5.0.

  Features

  • version: fall back to the go install module version (8c8e8d3)
  • release: torrent every signed binary on kiota (fc446a7)

  Bug fixes

  • deps: bump projectfile/core to v2.18.1 for retried network fetches (a69cc98)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:2.6.0
  

  This release also publishes the 2.6 and 2 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:2.6.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/2.6.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/projectfile-ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  docker pull kiota.ch/projectfile/ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  

  Platform	Digest	Size
  linux/amd64	sha256:1f35e338b2740da7bf239eb4110b5dc86644cbe7d906aa7b88600e51b699bf25	94.2 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci@sha256:c61a4760a7c53662fd180cf7cbaae2e57c08112d0552befdaa297d768a4a793c
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/2.6.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-2.6.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.5.0...2.6.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-15 00:23:06 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-15 00:23:06 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-15 00:23:06 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-15 00:23:06 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-15 00:23:07 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-15 00:23:07 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-15 00:23:07 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-15 00:23:07 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-15 00:23:07 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-15 00:23:07 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    1 download · 2026-10-15 00:23:06 +00:00 · 86 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-15 00:23:06 +00:00 · 228 B
  • projectfile-ci-2.6.0.magnet
    1 download · 2026-10-15 00:23:07 +00:00 · 187 B
  • projectfile-ci-2.6.0.torrent
    0 downloads · 2026-10-15 00:23:08 +00:00 · 8.9 KiB
• 2.5.0 b61bbc6b22

  Compare

  2.5.0 Stable

  damian-buho released this 2026-10-14 03:29:49 +00:00 | 90 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  17 commits, 1 contributor, 3 days since 2.4.0.

  Features

  • render: skip same-repo pull requests in favour of the push run (5747599)
  • render: leave the declared stable branch out of the push surface (1d30a68)
  • render: read the trunk from org.projectfile.release.trunk first (4745558)

  Bug fixes

  • render: let every job accept a skip from a narrower-gated need (1219013)
  • deps: bump core to 2.17.0 (f29625d)
  • deps: bump core to 2.18.0 (8f383ac)

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:2.5.0
  

  This release also publishes the 2.5 and 2 tags — pull the precision you want to pin.

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:2.5.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/2.5.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Image digests

  A tag can move; a digest cannot. Pull this exact build:

  docker pull docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  docker pull kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  

  Platform	Digest	Size
  linux/amd64	sha256:af8ee8988d6c214ecadd309541303f4d4b26a904635a4762bd01595826b9ce3a	94.2 MB

  Sizes are compressed layer bytes as stored in the registry.

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/2.5.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  

  Full changes: https://kiota.ch/projectfile/ci/compare/2.4.0...2.5.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-14 03:37:00 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-14 03:37:00 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-14 03:37:01 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-14 03:37:01 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-14 03:37:01 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-14 03:37:01 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-14 03:37:02 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-14 03:37:02 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-14 03:37:02 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-14 03:37:02 +00:00 · 228 B