• 2.5.0 b61bbc6b22

    2.5.0
    All checks were successful
    published / fetched (push) Successful in 0s
    published / gpg-is-ready (push) Successful in 3s
    published / projectfile-is-valid (push) Successful in 3s
    published / signing-is-ready (push) Successful in 5s
    published / source-is-compliant (push) Successful in 9s
    published / source-is-tested (push) Successful in 7s
    published / source-is-secure (push) Successful in 19s
    published / projectfile-is-ok (push) Successful in 6s
    published / documentation-passes-lint (push) Successful in 54s
    published / documentation-is-ok (push) Successful in 0s
    published / source-passes-lint (push) Successful in 47s
    published / source-is-ok (push) Successful in 0s
    published / inputs-are-ok (push) Successful in 0s
    published / binaries-are-built (amd64, darwin) (push) Successful in 5s
    published / binaries-are-built (amd64, linux) (push) Successful in 5s
    published / binaries-are-built (arm64, darwin) (push) Successful in 5s
    published / binaries-are-built (arm64, linux) (push) Successful in 5s
    published / binaries-are-built (riscv64, linux) (push) Successful in 6s
    published / gsa (amd64, darwin) (push) Successful in 4s
    published / gsa (amd64, linux) (push) Successful in 6s
    published / gsa (arm64, linux) (push) Successful in 6s
    published / gsa (arm64, darwin) (push) Successful in 6s
    published / gsa (riscv64, linux) (push) Successful in 5s
    published / binaries-are-ok (push) Successful in 0s
    published / binaries-are-signed (amd64, darwin) (push) Successful in 4s
    published / binaries-are-signed (arm64, linux) (push) Successful in 5s
    published / binaries-are-signed (riscv64, linux) (push) Successful in 5s
    published / binaries-are-signed (amd64, linux) (push) Successful in 5s
    published / binaries-are-signed (arm64, darwin) (push) Successful in 5s
    published / image-is-built (amd64) (push) Successful in 56s
    published / secrets-ready (push) Successful in 0s
    published / images-are-ok (push) Successful in 0s
    published / container-is-ok (push) Successful in 0s
    published / container-ready-to-test (push) Successful in 0s
    published / image-has-sbom (amd64) (push) Successful in 7s
    published / container-is-diagnosed (push) Successful in 0s
    published / image-is-secure (amd64) (push) Successful in 9s
    published / container-is-verified (amd64) (push) Successful in 29s
    published / image-is-ready (push) Successful in 0s
    published / artifacts-are-ok (push) Successful in 0s
    published / ready-to-publish (push) Successful in 0s
    published / publish-image (push) Successful in 0s
    published / image-is-signed (push) Successful in 0s
    published / image-is-attested (kiota) (push) Successful in 15s
    published / image-is-attested (dockerhub) (push) Successful in 38s
    published / release-is-published (push) Successful in 7s
    published / release-notes-are-published (push) Successful in 6s
    published / published (push) Successful in 0s
    Stable

    damian-buho released this 2026-10-14 03:29:49 +00:00 | 90 commits to dev since this release

    Signed by damian-buho
    GPG key ID: 87B15EAD49FD22AB

    17 commits, 1 contributor, 3 days since 2.4.0.

    Features

    • render: skip same-repo pull requests in favour of the push run (5747599)
    • render: leave the declared stable branch out of the push surface (1d30a68)
    • render: read the trunk from org.projectfile.release.trunk first (4745558)

    Bug fixes

    • render: let every job accept a skip from a narrower-gated need (1219013)
    • deps: bump core to 2.17.0 (f29625d)
    • deps: bump core to 2.18.0 (8f383ac)

    Installation

    Container image

    Pull the published container image:

    Pull from DockerHub — linux/amd64

    docker pull damianbuho/projectfile-ci:2.5.0
    

    This release also publishes the 2.5 and 2 tags — pull the precision you want to pin.

    If the registries above are unreachable, pull from the origin instead:

    Pull from Kiota — linux/amd64

    docker pull kiota.ch/projectfile/ci:2.5.0
    

    Prebuilt binary

    Download the prebuilt binary for your platform from this release:

    mkdir -p ~/.local/bin
    curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/2.5.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
    chmod +x ~/.local/bin/pf-ci
    ~/.local/bin/pf-ci --help
    

    Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

    Usage

    Lower the CI DAG to a forge’s workflow files:

    pf-ci resolve
    pf-ci generate -target forgejo
    pf-ci generate -target gha -check
    

    Image digests

    A tag can move; a digest cannot. Pull this exact build:

    docker pull docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    docker pull kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    
    Platform Digest Size
    linux/amd64 sha256:af8ee8988d6c214ecadd309541303f4d4b26a904635a4762bd01595826b9ce3a 94.2 MB

    Sizes are compressed layer bytes as stored in the registry.

    Verify

    Check that what you downloaded is what this project published.

    Container image

    The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

    COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci@sha256:ac8c2656dc226aebb54239b67d830f13d9b0840d0c64c18784bad4dca9a7068d
    

    Prebuilt binary

    The signature proves the binary is the one the maintainer’s release key signed.

    gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
    curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/2.5.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
    gpg --verify pf-ci.asc pf-ci
    

    Full changes: https://kiota.ch/projectfile/ci/compare/2.4.0...2.5.0

    Downloads