-
2.6.1
StableAll checks were successfulpublished / fetched (push) Successful in 0spublished / gpg-is-ready (push) Successful in 4spublished / projectfile-is-valid (push) Successful in 5spublished / signing-is-ready (push) Successful in 6spublished / source-is-compliant (push) Successful in 7spublished / source-is-tested (push) Successful in 5spublished / projectfile-is-ok (push) Successful in 6spublished / source-is-secure (push) Successful in 11spublished / source-passes-lint (push) Successful in 45spublished / source-is-ok (push) Successful in 0spublished / documentation-passes-lint (push) Successful in 53spublished / documentation-is-ok (push) Successful in 0spublished / inputs-are-ok (push) Successful in 0spublished / binaries-are-built (amd64, linux) (push) Successful in 5spublished / binaries-are-built (amd64, darwin) (push) Successful in 5spublished / binaries-are-built (arm64, linux) (push) Successful in 5spublished / binaries-are-built (arm64, darwin) (push) Successful in 5spublished / binaries-are-built (riscv64, linux) (push) Successful in 5spublished / gsa (amd64, darwin) (push) Successful in 8spublished / gsa (arm64, darwin) (push) Successful in 8spublished / gsa (arm64, linux) (push) Successful in 8spublished / gsa (amd64, linux) (push) Successful in 8spublished / gsa (riscv64, linux) (push) Successful in 4spublished / binaries-are-ok (push) Successful in 0spublished / binaries-are-signed (push) Successful in 8spublished / binaries-are-torrented (push) Successful in 8spublished / image-is-built (amd64) (push) Successful in 42spublished / secrets-ready (push) Successful in 0spublished / images-are-ok (push) Successful in 0spublished / image-has-sbom (amd64) (push) Successful in 9spublished / container-is-ok (push) Successful in 0spublished / container-ready-to-test (push) Successful in 0spublished / image-is-secure (amd64) (push) Successful in 12spublished / container-is-diagnosed (push) Successful in 0spublished / container-is-verified (amd64) (push) Successful in 26spublished / image-is-ready (push) Successful in 0spublished / artifacts-are-ok (push) Successful in 0spublished / ready-to-publish (push) Successful in 0spublished / publish-image (push) Successful in 0spublished / image-is-signed (push) Successful in 0spublished / image-is-attested (kiota) (push) Successful in 15spublished / image-is-attested (dockerhub) (push) Successful in 33spublished / release-is-published (push) Successful in 4spublished / release-notes-are-published (push) Successful in 4spublished / published (push) Successful in 0sreleased this
2026-10-15 03:06:38 +00:00 | 80 commits to dev since this release2 commits, 1 contributor, 2 hours since 2.6.0.
Bug fixes
- ci: sign every binary cell in one job (
b27e9d1) - build: fetch public Go modules through proxy.golang.org (
d54fe18)
Installation
Container image
Pull the published container image:
Pull from DockerHub — linux/amd64
docker pull damianbuho/projectfile-ci:2.6.1This release also publishes the
2.6and2tags — pull the precision you want to pin.If the registries above are unreachable, pull from the origin instead:
Pull from Kiota — linux/amd64
docker pull kiota.ch/projectfile/ci:2.6.1Prebuilt binary
Download the prebuilt binary for your platform from this release:
mkdir -p ~/.local/bin curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m) chmod +x ~/.local/bin/pf-ci ~/.local/bin/pf-ci --helpPublished for:
linux/amd64,linux/arm64,linux/riscv64,darwin/amd64,darwin/arm64Usage
Lower the CI DAG to a forge’s workflow files:
pf-ci resolve pf-ci generate -target forgejo pf-ci generate -target gha -checkImage digests
A tag can move; a digest cannot. Pull this exact build:
docker pull docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5 docker pull kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5Platform Digest Size linux/amd64 sha256:91a6766809129215500a1266cd8c2209ebde2752310a5900d0ad87c96fac9f9694.2 MB Sizes are compressed layer bytes as stored in the registry.
Verify
Check that what you downloaded is what this project published.
Container image
The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.
COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5 cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5 cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci@sha256:bbcefa2a14e2f9dc41ead7a2d5004cd06e6782bb0f82f1068af40f1fd5e8f3d5Prebuilt binary
The signature proves the binary is the one the maintainer’s release key signed.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257 curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc gpg --verify pf-ci.asc pf-ciDownload via BitTorrent
Fetch this release over BitTorrent with a magnet link, or with the attached
.torrentfile:Full changes: https://kiota.ch/projectfile/ci/compare/2.6.0...2.6.1
Downloads
-
Source code (ZIP)
0 downloads
-
Source code (TAR.GZ)
0 downloads
- ci: sign every binary cell in one job (