• v3.1.1 cc388a3b5f

    v3.1.1
    All checks were successful
    published / release-tag (push) Successful in 3s
    published / projectfile-is-valid (push) Successful in 9s
    published / runner-is-ready (push) Successful in 13s
    published / source-is-tested (push) Successful in 15s
    published / source-is-compliant (push) Successful in 20s
    published / source-is-secure (push) Successful in 30s
    published / documentation-passes-lint (push) Successful in 1m6s
    published / gpg-is-ready (push) Successful in 5s
    published / source-passes-lint (push) Successful in 1m20s
    published / signing-is-ready (push) Successful in 9s
    published / projectfile-is-ok (push) Successful in 8s
    published / binaries-are-built (amd64, darwin) (push) Successful in 8s
    published / binaries-are-built (amd64, linux) (push) Successful in 7s
    published / binaries-are-built (arm64, darwin) (push) Successful in 7s
    published / binaries-are-built (riscv64, linux) (push) Successful in 9s
    published / binaries-are-built (arm64, linux) (push) Successful in 9s
    published / gsa (amd64, linux) (push) Successful in 12s
    published / gsa (amd64, darwin) (push) Successful in 15s
    published / gsa (arm64, darwin) (push) Successful in 6s
    published / gsa (arm64, linux) (push) Successful in 7s
    published / gsa (riscv64, linux) (push) Successful in 8s
    published / binaries-are-signed (push) Successful in 20s
    published / binaries-are-torrented (push) Successful in 23s
    published / binaries-torrent-is-verified (push) Successful in 11s
    published / image-is-built (amd64) (push) Successful in 3m33s
    published / image-has-sbom (amd64) (push) Successful in 19s
    published / image-is-secure (amd64) (push) Successful in 23s
    published / container-is-verified (amd64) (push) Successful in 1m7s
    published / image-is-published (kiota) (push) Successful in 28s
    published / image-is-published (dockerhub) (push) Successful in 1m4s
    published / release-is-published (push) Successful in 9s
    published / release-notes-are-published (push) Successful in 8s
    published / go-install-is-ok (push) Successful in 3m39s
    published / published (push) Successful in 0s
    Stable

    damian-buho released this 2026-10-19 12:02:30 +00:00 | 5 commits to main since this release

    Signed by damian-buho
    GPG key ID: 87B15EAD49FD22AB

    3 commits, 1 contributor, 5 hours since v3.1.0.

    Bug fixes

    Installation

    Container image

    Pull the published container image:

    Pull from DockerHub — linux/amd64

    docker pull damianbuho/projectfile-ci:v3.1.1
    

    If the registries above are unreachable, pull from the origin instead:

    Pull from Kiota — linux/amd64

    docker pull kiota.ch/projectfile/ci:v3.1.1
    

    Go toolchain

    Install with the Go toolchain:

    go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.1
    

    Then run pf-ci --help.

    Prebuilt binary

    Download the prebuilt binary for your platform from this release:

    mkdir -p ~/.local/bin
    curl --fail --location --output ~/.local/bin/pf-ci https://kiota.ch/projectfile/ci/releases/download/v3.1.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
    chmod +x ~/.local/bin/pf-ci
    ~/.local/bin/pf-ci --help
    

    Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

    To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

    Usage

    Lower the CI DAG to a forge’s workflow files:

    pf-ci resolve
    pf-ci generate -target forgejo
    pf-ci generate -target gha -check
    

    Verify

    Check that what you downloaded is what this project published.

    Container image

    The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

    COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-ci:v3.1.1
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/ci:v3.1.1
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-ci:v3.1.1
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/ci:v3.1.1
    

    Prebuilt binary

    The signature proves the binary is the one the maintainer’s release key signed.

    gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
    curl --fail --location --output pf-ci.asc https://kiota.ch/projectfile/ci/releases/download/v3.1.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
    gpg --verify pf-ci.asc ~/.local/bin/pf-ci
    
    # every downloaded asset at once
    gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
    sha256sum --check --ignore-missing pf-ci-SHA256SUMS
    

    Download via BitTorrent

    Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

    Full changes: https://kiota.ch/projectfile/ci/compare/2.6.1...v3.1.1

    Downloads