43 releases 48 tags

RSS feed

• v2.7.0 ce7e3800c6

  Compare

  v2.7.0 Stable

  damian-buho released this 2026-10-15 19:21:28 +00:00 | 77 commits to dev since this release

  Signed by damian-buho

  GPG key ID: 87B15EAD49FD22AB

  435 commits, 1 contributor.

  Upgrade notes

  • interp: resolve references through core, not a third basename split (764d890)

  • deps: move to core v2.14.0 (e158a88)

    result lines move from stderr to stdout.

  Features

  • ci: subtract matrix.exclude cells from the product (6458f01)
  • publish: render one push per declared sink, not one OUTPUT_REGISTRY (71e1367)
  • publish: make the destination a matrix axis on both planes (b284438)
  • ci: mint the M6E_ARCH matrix axis from the declared architecture set (17ad9b7)
  • ci: bind the arch axis to the build and push actions (9f53936)
  • ci: let a node drop a global axis with matrix.without (d1d292e)
  • ci: bind the declared arch set to the manifest assembly action (f7d9cd6)
  • ci: route each arch cell to the runner its target declares (ec3ed09)
  • ci: let a node narrow a global axis to one value with matrix.pin (19ff903)
  • render: hand every architecture's archive to one publish cell (f130002)
  • render: gate each publish cell on a forge-level sink allow-list (fa50866)
  • i18n: translate feature fragments to Spanish and Ukrainian (e38f3bc)
  • i18n: localize identity summary and description (bf1787c)
  • images: compose foreign images from the target pull sink (a88aefe)
  • ci: serialise matrix cells with needs, the cap Forgejo honours (f64dad4)
  • when: add the preview event, gating a publish on a non-primary branch (c075edc)
  • sinks: split the own-artifact and foreign-image sink planes (69e2443)
  • render: lower advisory by step kind (7a96c16)
  • release: add riscv64 binary to published matrix (89afca0)
  • interp: resolve a ${list[]} projection to its joined elements (ca9134c)
  • release: let a project with no binary mint a release (653d3ae)
  • render: name the build-artifact edge off the producer's axes (a30cc54)
  • render: pin GHA action refs and lower least-privilege token scopes (ab0b9ac)
  • ci: add the primary trigger token for trunk publishes (872c498)
  • platform: declare whether a target's caches are fleet-shared (5390e7c)
  • ci: gate cloud workflow rendering on org.projectfile.ci.targets (6fb1a71)
  • images: per-entry sink template on the foreign plane (bb2ae5f)
  • render: route a tool that executes its cell architecture (dfcd8e9)
  • render: persist build cache mounts on an ephemeral target (f76633b)
  • render: forge-instance override family on every step (c9bb30d)
  • forge: declare Codeberg and GitHub mirrors and enable GitHub CI (d8cac08)
  • ci: build linux/amd64, arm64 and riscv64 images (446b7f6)
  • ci: sign and attest the published image with cosign (0805911)
  • ci: sign released binaries with the org GPG key (4e5c2bb)
  • publish: push to Docker Hub (1ca43d8)
  • build: resolve document references in build-arg defaults (625153d)
  • cli: add -quiet/-q to resolve and generate (71dac83)
  • generate: add -dry-run/-n and -force/-f (ffff607)
  • lefthook: stream hook output with follow (e9215a6)
  • matrix: build only the architectures a forge’s publish route declares (d2f4eff)
  • render: bind declared image tag rules to oci-push (49680fb)
  • render: lower tool keep-going to a status-function step gate (32adde3)
  • ci: let a node follow another node's when events (3644757)
  • render: roll named-cache keys by period and skip saves on a hit (218a020)
  • render: add an N-hour cache-key roll and default to 8h (1dfed64)
  • render: skip same-repo pull requests in favour of the push run (5747599)
  • render: leave the declared stable branch out of the push surface (1d30a68)
  • render: read the trunk from org.projectfile.release.trunk first (4745558)
  • version: fall back to the go install module version (8c8e8d3)
  • release: torrent every signed binary on kiota (fc446a7)
  • module: move the module to projectfile.org/projectfile/ci/v2 (6fad09d)
  • release: tag releases with a v prefix (faa378e)

  Bug fixes

  • audit: target the declared pull sink, not a registry prefix (daf784b)
  • ci: scope the self-image ref and the live stack to the cell architecture (73d7b00)
  • images: compose a run-image from its declared parts (7e06c0a)
  • render: keep the loaded image ref arch-scoped when the publish node is not (9e9ff81)
  • render: gate publish cells on the step, not the job (328ecae)
  • ci: count only the axes a publish node actually fans (d179bde)
  • dockerfile: key apt cache mounts by arch, not just series (fb1122a)
  • render: load the build archive only for the live fuse (9219c46)
  • go: bump toolchain directive to 1.26.6 (42af940)
  • deps: bump projectfile/core to v2.9.4 (b8ef390)
  • render: load the cell archive via container-load, not an inline docker load (2c0b160)
  • ci: stop warning about image sinks on projects with no image (07a397a)
  • ci: interpolate the forgejo-release asset path (c7ff049)
  • container: declare the full b19 build-arg surface (f2ea755)
  • ci: add gsa node to enforce build-binaries before auto-gsa (e473f85)
  • update .makefile/library submodule (disable check-outdated-go memoisation) (1c946c4)
  • ci: opt into the binary release pipeline explicitly (478f2db)
  • interp: scan a ${…} reference with balanced braces (abc25cb)
  • render: emit an explicit empty scalar for a valueless env entry (ab78105)
  • deps: bump kiota.ch/projectfile/core/v2 to v2.9.7 (7094a30)
  • render: give ci.env a declared-image fallback tier (5ab3c3b)
  • build-binaries: stop writing a duplicate unsuffixed dist/pf-ci (8d48a84)
  • render: hang the sink gate on the cell, not on the push step (b094558)
  • render: drop permissions: from Forgejo workflow lowering (98225db)
  • render: enable containerd image store before GHA buildx builds (3121b88)
  • render: guard docker restart when systemd is unavailable (28e3e4a)
  • render: use an isolated buildx builder on gha instead of reconfiguring the daemon (4ee2cad)
  • bump core to 2.10.3 (0612f10)
  • render: restore every producer's artifact into a consumer job (fc4f2bf)
  • render: apply the arch→runner map only to a job that builds (fb4f560)
  • render: pin actions/cache sub-actions to v5.1.0 (03b66b2)
  • forge: declare only existing forges (6f42759)
  • pf-cli optimize fuckup (ff87bf9)
  • deps: bump projectfile/core to v2.11.1 (8837320)
  • ci: run lefthook hooks with TERM=dumb (e3ecb29)
  • render: spell the live-stack identity with compose-safe axis values (ed6949e)
  • render: derive CI_SKIP names by the m6e-run rule (8416755)
  • deps: bump projectfile/core to v2.11.2 (7ea2b5e)
  • deps: bump projectfile/core to v2.12.0 (ac43e59)
  • render: gate an artifact download on its producer's mutes (ceb9b93)
  • ci: drop capacity hints on matrix cell allocations (a1dc86b)
  • ci: matrix the binaries-are-signed node (d0cb904)
  • deps: bump projectfile/core to v2.12.3 (156382a)
  • deps: bump projectfile/core to v2.13.0 (5c070ff)
  • render: default a build-arg series inside a tool image path (af62f0f)
  • cli: print subcommand help on -h, --help and help (cdd34e5)
  • cli: read -pf - from stdin and refuse -o - (dfac433)
  • deps: update projectfile core to v2.15.0 (666bb10)
  • render: keep build-arg default in a tool image tag ref (7e055f1)
  • render: tell cells of one image apart by their variant tag (6da3666)
  • ci: narrow tool-executed arch axes to the publish route (9ac9c00)
  • render: keep each fused member's event gate (b476a6e)
  • container: restore M6E_VERSION in final image (77be8d7)
  • deps: bump projectfile/core to v2.16.0 (6e21f5f)
  • render: let every job accept a skip from a narrower-gated need (1219013)
  • deps: bump core to 2.17.0 (f29625d)
  • deps: bump core to 2.18.0 (8f383ac)
  • deps: bump projectfile/core to v2.18.1 for retried network fetches (a69cc98)
  • ci: sign every binary cell in one job (b27e9d1)
  • build: fetch public Go modules through proxy.golang.org (d54fe18)

  Performance

  • render: restore and save each named cache once per job (8338d86)
  • container: declare M6E_VERSION next to the user stage (4555523)

  Reverts

  • undo local submodule edit (fix belongs in m6e/library) (e11e5c8)

  Dependencies

  • 8 dependency updates

  Installation

  Container image

  Pull the published container image:

  Pull from DockerHub — linux/amd64

  docker pull damianbuho/projectfile-ci:v2.7.0
  

  If the registries above are unreachable, pull from the origin instead:

  Pull from Kiota — linux/amd64

  docker pull kiota.ch/projectfile/ci:v2.7.0
  

  Prebuilt binary

  Download the prebuilt binary for your platform from this release:

  mkdir -p ~/.local/bin
  curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v2.7.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
  chmod +x ~/.local/bin/pf-ci
  ~/.local/bin/pf-ci --help
  

  Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

  Usage

  Lower the CI DAG to a forge’s workflow files:

  pf-ci resolve
  pf-ci generate -target forgejo
  pf-ci generate -target gha -check
  

  Verify

  Check that what you downloaded is what this project published.

  Container image

  The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

  COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v2.7.0
  cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v2.7.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v2.7.0
  cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v2.7.0
  

  Prebuilt binary

  The signature proves the binary is the one the maintainer’s release key signed.

  gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
  curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v2.7.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
  gpg --verify pf-ci.asc pf-ci
  
  # every downloaded asset at once
  gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
  sha256sum --check --ignore-missing pf-ci-SHA256SUMS
  

  Download via BitTorrent

  Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

  • 🧲 projectfile-ci-v2.7.0

  Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v2.7.0

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads

  ---

  • pf-ci-darwin-arm64
    0 downloads · 2026-10-15 23:44:10 +00:00 · 10 MiB
  • pf-ci-darwin-arm64.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • pf-ci-darwin-x86_64
    0 downloads · 2026-10-15 23:44:10 +00:00 · 11 MiB
  • pf-ci-darwin-x86_64.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • pf-ci-linux-aarch64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 9.9 MiB
  • pf-ci-linux-aarch64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-linux-riscv64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 9.5 MiB
  • pf-ci-linux-riscv64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-linux-x86_64
    0 downloads · 2026-10-15 23:44:11 +00:00 · 11 MiB
  • pf-ci-linux-x86_64.asc
    0 downloads · 2026-10-15 23:44:11 +00:00 · 228 B
  • pf-ci-SHA256SUMS
    0 downloads · 2026-10-15 23:44:10 +00:00 · 428 B
  • pf-ci-SHA256SUMS.asc
    0 downloads · 2026-10-15 23:44:10 +00:00 · 228 B
  • projectfile-ci-v2.7.0.magnet
    1 download · 2026-10-15 23:44:12 +00:00 · 188 B
  • projectfile-ci-v2.7.0.torrent
    0 downloads · 2026-10-15 23:44:12 +00:00 · 8.9 KiB