v4.3.0

6 commits, 1 contributor, 21 hours since v4.2.3.

Features

• vulnerabilities: name and link every suppressed ID (168872f)
• security: link and sort acknowledged vulnerabilities (5d300ff)

Bug fixes

• deps: bump kiota.ch/projectfile/core/v2 to v2.20.4 (ec04cbc)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.3.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.3.0

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.3.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.3.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.3.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.3.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.3.0

v4.2.3

9 commits, 1 contributor, 4 days since v4.2.2.

Bug fixes

• vulnerabilities: retire managed scan files when the suppress list empties (013bd11)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.2.3

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.2.3

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.2.3/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.2.3
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.2.3

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.2.3/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.2.3

v4.2.2

2 commits, 1 contributor, 2 days since v4.2.1.

Bug fixes

• deps: bump projectfile/core to v2.20.3 (d254dcc)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.2.2

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.2.2

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.2.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.2.2
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.2.2

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.2.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.2.2

v4.2.1

4 commits, 1 contributor, 1 hour since v4.2.0.

Bug fixes

• deps: bump projectfile/core to v2.20.2 (fb0a91b)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.2.1

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.2.1

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.2.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.2.1
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.2.1

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.2.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.2.1

v4.1.2

77 commits, 1 contributor, 8 days since v4.1.1.

Bug fixes

• refactor CI workflows (new goals + preflight checks) (1f28ef1)
• workflows: move pins (10bc841, 0fecb36, 087913c)
• workflows: enable checks (8b40b2a)
• workflows: fix preflights (167df34)
• gosec: add G702 to nosec for command dispatcher (3d8f5ef)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.1.2

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.1.2

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.1.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.1.2
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.1.2

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.1.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.1.2

v4.1.1

4 commits, 1 contributor, 6 hours since v4.1.0.

Bug fixes

• bridge: style the help title only on a colour terminal (a2e77c3)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.1.1

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/bridge/v4/cmd/pf-bridge@v4.1.1

Then run pf-bridge --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.1.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-bridge.

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.1.1
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.1.1

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.1.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc ~/.local/bin/pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.1.1

v4.0.2

3 commits, 1 contributor, 18 hours since v4.0.1.

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.0.2

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.0.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.0.2
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.0.2

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.0.2/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc pf-bridge

# every downloaded asset at once
gpg --verify pf-bridge-SHA256SUMS.asc pf-bridge-SHA256SUMS
sha256sum --check --ignore-missing pf-bridge-SHA256SUMS

Full changes: 3.7.0...v4.0.2

v4.0.1

1 commit, 1 contributor, 29 minutes since v4.0.0.

Highlights

The pf-bridge-bridges-<version>-<os>-<arch>.tar.gz archives announced in v4.0.0 are not published. The single-bridge binaries in them weighed about 130 MB per platform, eight times the standalone pf-bridge-<os>-<arch>, which already includes every bridge. Download that one binary; to get the single-bridge binaries, build them from source.

Bug fixes

• release: publish the standalone binary only, without the bridges archive (27d3e44)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:v4.0.1

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge:v4.0.1
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge:v4.0.1

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/v4.0.1/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc pf-bridge

Full changes: 3.7.0...v4.0.1

v4.0.0

609 commits, 1 contributor.

Upgrade notes

• sinks: compose a ref from declared parts, not from a Go default (acb157b)

• ai-policy: rename the llm bridge to ai-policy (2cfd6f0)

  pf-bridge llm is now pf-bridge ai-policy; the
  pf-bridge-llm binary is now pf-bridge-aipolicy.

• ai: read org.projectfile.ai (16a2cc1)

  a document declaring org.projectfile.llm is no longer
  read; rename the key to org.projectfile.ai.

• fragments: inherit live at generate, no committed cache (acec2f1)

  --refresh and core.Options.Refresh are gone; generate now
  reaches the forge by default (--offline preserves committed sections), and
  docs/.d/.inherited/ is no longer written or read.

• results on stdout, one colour decision and a network timeout (0aa38e6)

  result lines move from stderr to stdout.

• forge: take the network timeout from the shared --timeout (6e068d7)

  forge push no longer declares its own --timeout; the
  persistent flag of the same name replaces it.

• module: move the module to projectfile.org/projectfile/bridge/v4 (a9eb9b2)

  the Go module path is now projectfile.org/projectfile/bridge/v4.

Highlights

pf-bridge-<os>-<arch> is now one standalone binary that includes every bridge, so a single download is the whole tool. The single-bridge binaries no longer ship as loose release assets; they come together in pf-bridge-bridges-<version>-<os>-<arch>.tar.gz with a dispatcher that runs the binaries beside it. Extract the archive anywhere; deleting that directory uninstalls it.

Features

• core: show native language names in the cross-language bar (35e1190)
• security: add GPG fingerprint, reporting guidance, acknowledged vulnerabilities (cde42be)
• security: derive gpg-fingerprint from the network when unset (189d07d)
• security: note absence of a bug bounty programme when unset (8d4c246)
• i18n: move localized docs to docs// and add default-language (cca4500)
• readme: improve generator with platforms, variants, collection bar and merged header (6b767d4)
• bridge: wrap localized docs in textlint terminology disable (635be0c)
• contributing: merge workflow and commits into a Conventions section (54e9cf6)
• readme: drive the related-projects bar from links[] tagged 'related' (f57453a)
• pfmodel: add priority field for link and shield ordering (73d4fa1)
• readme: order badges and links by priority (d5f2fb8)
• support: order links by priority in SUPPORT.md (f3464fc)
• contributing: order forge stars and socials by priority (884cf6e)
• derive: address forge mirrors by capability, not by slug (15d229d)
• scan: propose capability tags from the forge host table (e767a9d)
• scan: name the shields route family, and add --force (528b432)
• forge: add the badges route families to the mirror links (838c823)
• readme: rank installation and usage groups by priority (2fc9d01)
• registries: compose a pull reference per container registry (5fb44af)
• sync: let --force rewrite a file whose fields already agree (f7dfa6d)
• sink: compose pull references from sinks, replacing the registry model (e1391b3)
• bridge: localize prose links and add a generated-file footer (377ade7)
• bridge: localize scan/derive link labels per declared language (e96a8d4)
• bridge/support: render paid-support as a SUPPORT.md block (5c7219c)
• fragments: localize assembled documents per org.projectfile.i18n (5a43813)
• i18n: translate feature fragments to Spanish and Ukrainian (2aa2017)
• i18n: localized link labels, GitHub issues link, llm-generator doc (0e23d81)
• i18n: localize identity summary and description (a29431e)
• fragments: localize inherited sections from the parent's published documents (a04bc15)
• readme: group install commands per sink with joined fences (cd90818)
• readme: curate Links by readme tag and list docs/how-to articles (1240e5b)
• dispatcher: annotate --list with descriptions, skip platform artifacts (52d00f1)
• pfmodel: parse org.projectfile.llm extension namespace (3e8b8d1)
• bridge: add pf-bridge-llm — render LLM.md from org.projectfile.llm (5484376)
• bridge: cross-link LLM.md from readme and contributing (4148d30)
• llm: render AI_POLICY.md with the three-direction shape (106a7e6)
• ai-policy: make default activity coverage and internal-practice link explicit (e8a04a8)
• bridge: add --preview flag (55c46b9)
• bridge: make the generated-from-projectfile footer opt-in (9e5712e)
• bridge: add See also section from project-authored links (6600436)
• readme: localize the related bar prefix and drop the self link (4825923)
• ignore: generate .textlintignore and .fdignore (207f6c5)
• check: derive the check sweep from the project manifest (56531c5)
• ocisinks: compose the own artifact through a sink's selfref (453c445)
• forge: filter push by forge, support scp-style URLs (ca3cf2b)
• readme: label the ssh artifact kind (ac02194)
• release: add riscv64 binary to published matrix (a99eadf)
• vulnerabilities: fan out suppress list to audit-ci.jsonc (b1fe4a7)
• derive: infer Docker Hub and GHCR links from resolved sinks (a09d0e7)
• bridge: add shard.yml sync bridge for Crystal projects (f228946)
• forge: declare Codeberg and GitHub mirrors and enable GitHub CI (5863f25)
• ci: build linux/amd64, arm64 and riscv64 images (1ce3ae1)
• ci: sign and attest the published image with cosign (b48bbe8)
• readme: resolve badge hrefs per language and CI-matrix series (0363e14)
• forges: rank alias claims by link priority (a45be94)
• scan: materialize forge link and repository templates (0f640dd)
• derive: releases alias from repositories[releases=true] (11ec24c)
• scan: sinks scanner materializes package-registry links (83a056c)
• ci: sign released binaries with the org GPG key (907efbb)
• publish: push to Docker Hub (fd38608)
• readme: prefer identity.description over summary in basics (41d1e16)
• readme: summarise inherited features as one note naming each parent (e18b24a)
• readme: lead the building block with declared groups, keep derived goals (37799d6)
• readme: fan command sections over per-node matrix axes too (a9a45cc)
• readme: label the action artifact kind (7efc375)
• readme: per-cell groups render one headed fence per matrix cell (b84b94e)
• readme: optional title gives a section group its own heading (dfeb1a8)
• readme: fleet default platforms for an image declaring none (754a0ec)
• readme: inputs table from an action artifact's action.yaml (0dad9b4)
• readme: axis-args keeps matrix axes as Dockerfile ARG lines (e43925c)
• readme: one runnable line per fan-out, variants listed below it (523deb1)
• readme: render a localized ci goal description in the reader’s language (f64bcc6)
• readme: embed a declared file as a section group's fence (1c6df5c)
• fragments: let a conventions shell opt out of inheritance (6f3127c)
• readme: quote USAGE.md's top-level help and first example (fc4edc9)
• readme: name the packaged upstream and keep its license apart (8b11a8b)
• rootflags: bind -V to --version on every bridge binary (bcca94e)
• readme: join same-sink groups and show channel titles only when there is a choice (c477877)
• readme: recognise a help capture by its console command line (bf4f9af)
• readme: quote only the top-level help in Usage, link USAGE.md for examples (8e8fa0b)
• readme: name each registry’s platforms on its install heading (d6b3346)
• readme: label an npm or PyPI package by its registry (841e9d7)
• readme: name the command an artifact exports on its line (e432585)
• fragments: assemble fragment documents under docs/ (0d69aed)
• readme: link companion documents by their title (1da87d8)
• readme: continue a single fence with a group that carries no prose (0953e24)
• readme: list a group’s published matrix cells under its fence (3053449)
• readme: render the Building section as docs/BUILD.md behind build-doc (11f5118)
• contributing: link docs/BUILD.md once the readme renders it (c69cdd1)
• badges: render each badge on the documents it declares (89e165b)
• release-notes: render release notes from git (63b4038)
• release-notes: pin README install and usage blocks to the release (9c5d9be)
• release-notes: adaptive elapsed time in the summary line from a template (0cf8256)
• release-notes: publish the per-forge half of a release body (a8eeb9b)
• release-notes: compare against the previous release the forge lists (cd5127e)
• derive: expose stable version parts as org.projectfile.semver (7ce9e4a)
• release-notes: split Verify per artifact kind and check the installed binary (fd74162)
• release-notes: apply an installation entry’s release prefix and postfix on the release page (d42db3d)
• release-notes: pin images by digest and list per-platform digests (59885fc)
• release-notes: show per-platform size change against the previous release (dd109cf)
• release-notes: list package changes from the attested SBOM (5fae330)
• release-notes: configure shown commit sections from the projectfile (27b5866)
• release-notes: attach files named by release.attach to the release (2886863)
• npm: name the package after a declared npm package artifact (1c3e545)
• bridge: name the repositories[].packages entry as the package manifest source (ff301a8)
• npm: take cpu and os from the npm artifact before the project-level platform lists (01651c4)
• forge: push branch and tag protection derived from release branches (2b2702c)
• forge: set the origin default branch to release.trunk (c06adaf)
• release-notes: check every downloaded binary against the signed SHA256SUMS (27b00bf)
• bridge: scope the registry to one command so every bridge can share a binary (90f0...

3.7.0

11 commits, 1 contributor, 21 hours since 3.6.1.

Features

• forge: push branch and tag protection derived from release branches (2b2702c)
• forge: set the origin default branch to release.trunk (c06adaf)

Bug fixes

• npm: skip a non-SemVer identity.version instead of writing it (87f0f5c)
• net: retry every network crossing on core's shared policy (251e0eb)
• security: suppress CVE-2026-92392 in the Ubuntu cURL (5dfaa8e)
• security: generate the scanner ignore files from the projectfile (a5e54da)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:3.7.0

This release also publishes the 3.7 and 3 tags — pull the precision you want to pin.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Image digests

A tag can move; a digest cannot. Pull this exact build:

docker pull ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88

Platform	Digest	Size
linux/amd64	sha256:e046c7713641ffc83cd021eb908645b7e90cf00f6ff8b9802528afb2a23ed8f1	235.2 MB
linux/arm64	sha256:eaf0f298b8921ce7f164291b1442420ee70f284e5b0ba64285c0f88c932cb470	216.6 MB (+0.1 MB)
linux/riscv64	sha256:ce25ddb8b9b48162a5f5f800f00cbf5ae9916730e8bd6c1bbe5efd4d8ab8f67f	226.6 MB (+0.1 MB)

Sizes are compressed layer bytes as stored in the registry.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc pf-bridge

Full changes: 3.6.1...3.7.0