• v3.4.2 63d50a58de

    v3.4.2
    All checks were successful
    published / release-tag (push) Successful in 1s
    published / projectfile-is-valid (push) Successful in 2s
    published / schema-fetched (push) Successful in 1s
    published / runner-is-ready (push) Successful in 6s
    published / source-is-compliant (push) Successful in 4s
    published / source-is-secure (push) Successful in 10s
    published / gpg-is-ready (push) Successful in 4s
    published / signing-is-ready (push) Successful in 6s
    published / projectfile-is-ok (push) Successful in 8s
    published / source-is-tested (push) Successful in 13s
    published / documentation-passes-lint (push) Successful in 54s
    published / source-passes-lint (push) Successful in 1m15s
    published / binaries-are-built (amd64, darwin) (push) Successful in 7s
    published / binaries-are-built (amd64, linux) (push) Successful in 7s
    published / binaries-are-built (arm64, darwin) (push) Successful in 8s
    published / binaries-are-built (arm64, linux) (push) Successful in 8s
    published / binaries-are-built (riscv64, linux) (push) Successful in 6s
    published / gsa (amd64, darwin) (push) Successful in 7s
    published / gsa (amd64, linux) (push) Successful in 4s
    published / gsa (arm64, darwin) (push) Successful in 5s
    published / gsa (arm64, linux) (push) Successful in 5s
    published / gsa (riscv64, linux) (push) Successful in 4s
    published / image-is-built (amd64) (push) Successful in 1m12s
    published / binaries-are-signed (push) Successful in 12s
    published / image-has-sbom (amd64) (push) Successful in 14s
    published / image-is-secure (amd64) (push) Successful in 18s
    published / binaries-are-torrented (push) Successful in 14s
    published / binaries-torrent-is-verified (push) Successful in 9s
    published / container-is-verified (amd64) (push) Successful in 2m13s
    published / image-is-published (kiota) (push) Successful in 13s
    published / image-is-published (dockerhub) (push) Successful in 45s
    published / release-is-published (push) Successful in 8s
    published / release-notes-are-published (push) Successful in 4s
    published / go-install-is-ok (push) Successful in 47s
    published / published (push) Successful in 0s
    Stable

    damian-buho released this 2026-10-18 23:56:34 +00:00 | 29 commits to main since this release

    Signed by damian-buho
    GPG key ID: 87B15EAD49FD22AB

    24 commits, 1 contributor, 22 hours since v3.4.1.

    Bug fixes

    • get: keep the env-expansion cursor moving on every input (cdbd4d7)
    • refactor CI workflows (new goals + preflight checks) (099413d)
    • workflows: move pins (071582f, bba2b96)
    • workflows: enable checks (09bfbf9)

    Installation

    Container image

    Pull the published container image:

    Pull from DockerHub — linux/amd64

    docker pull damianbuho/projectfile-cli:v3.4.2
    alias pf-cli='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws damianbuho/projectfile-cli:v3.4.2 pf-cli'
    

    If the registries above are unreachable, pull from the origin instead:

    Pull from Kiota — linux/amd64

    docker pull kiota.ch/projectfile/cli:v3.4.2
    alias pf-cli='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws kiota.ch/projectfile/cli:v3.4.2 pf-cli'
    

    Then run it as if it were installed — the alias runs every example as written against the current directory:

    pf-cli --help
    

    Go toolchain

    Install with the Go toolchain:

    go install projectfile.org/projectfile/cli/v3/cmd/pf-cli@v3.4.2
    

    Then run pf-cli --help.

    Prebuilt binary

    Download the prebuilt binary for your platform from this release:

    mkdir -p ~/.local/bin
    curl --fail --location --output ~/.local/bin/pf-cli https://kiota.ch/projectfile/cli/releases/download/v3.4.2/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m)
    chmod +x ~/.local/bin/pf-cli
    ~/.local/bin/pf-cli --help
    

    Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

    To uninstall, delete that one file: rm ~/.local/bin/pf-cli.

    Usage

    pf-cli

    $ pf-cli --help
    pf-cli is the command-line frontend for the projectfile: it reads, writes and
    validates fields, resolves remote includes, and generates derived artifacts. It
    embeds the v1 JSON Schema for offline validation and is the canonical tool for
    editing projectfiles locally and in CI.
    
    File and forge sync (bridge, forge, scan): use pf-bridge.
    
    Usage:
      pf-cli [command]
    
    Examples:
      pf-cli init --namespace org.example --name demo
      pf-cli get identity.name
      pf-cli set license.spdx MIT
      pf-cli add keywords rust wasm
      pf-cli del keywords[0]
      pf-cli validate
      pf-cli convert yaml toml
      pf-cli optimize
      pf-cli cache status
    
    Read:
      get         Read one or more projectfile fields
    
    Write:
      add         Append items to a projectfile list
      del         Remove a field, list item, or map entry from projectfile
      set         Write a value into a projectfile field
    
    Validate:
      validate    Validate a projectfile against the v1 JSON Schema
    
    Maintain:
      cache       Manage pf-cli’s local cache for offline use
      convert     Convert a projectfile between encodings (toml/yaml/json)
      includes    Manage the includes list
      init        Scaffold a new projectfile document
      optimize    Remove local fields that duplicate include values
      setup       Edit your per-user configuration interactively
    
    Other:
      completion  Generate the autocompletion script for the specified shell
      help        Help about any command
    
    Common flags:
        -q, --quiet          mute info; warnings and errors still print
      -v, --verbose        show each step; also PF_CLI_VERBOSE=1
      --offline            refuse network; use cache and embedded data
    
    Flags:
          --colors string        colour output: auto|always|never; also PF_CLI_NO_COLOR=1 (default "auto")
          --fail-on string       abort includes at error|warning (default "error")
      -h, --help                 help for pf-cli
          --ignore-user-config   skip $XDG_CONFIG_HOME/projectfile/cli.* loading
          --offline              refuse network; use cache and embedded data
      -q, --quiet                mute info; warnings and errors still print
          --sorted               write YAML keys in sorted order
          --timeout duration     per-attempt network timeout (default 10s)
      -v, --verbose              show each step; also PF_CLI_VERBOSE=1
      -V, --version              print the version
    
    Documentation:
      https://github.com/projectfile-org/cli/tree/main/docs
    
    Report a bug:
      https://github.com/projectfile-org/cli/issues
    
    Use "pf-cli [command] --help" for more information about a command.
    

    Examples and every command’s help are in Usage.

    Verify

    Check that what you downloaded is what this project published.

    Container image

    The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

    COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true docker.io/damianbuho/projectfile-cli:v3.4.2
    cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true kiota.ch/projectfile/cli:v3.4.2
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx docker.io/damianbuho/projectfile-cli:v3.4.2
    cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx kiota.ch/projectfile/cli:v3.4.2
    

    Prebuilt binary

    The signature proves the binary is the one the maintainer’s release key signed.

    gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
    curl --fail --location --output pf-cli.asc https://kiota.ch/projectfile/cli/releases/download/v3.4.2/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m).asc
    gpg --verify pf-cli.asc ~/.local/bin/pf-cli
    
    # every downloaded asset at once
    gpg --verify pf-cli-SHA256SUMS.asc pf-cli-SHA256SUMS
    sha256sum --check --ignore-missing pf-cli-SHA256SUMS
    

    Download via BitTorrent

    Fetch this release over BitTorrent with a magnet link, or with the attached .torrent file:

    Full changes: https://kiota.ch/projectfile/cli/compare/3.1.1...v3.4.2

    Downloads