3.7.0

11 commits, 1 contributor, 21 hours since 3.6.1.

Features

• forge: push branch and tag protection derived from release branches (2b2702c)
• forge: set the origin default branch to release.trunk (c06adaf)

Bug fixes

• npm: skip a non-SemVer identity.version instead of writing it (87f0f5c)
• net: retry every network crossing on core's shared policy (251e0eb)
• security: suppress CVE-2026-92392 in the Ubuntu cURL (5dfaa8e)
• security: generate the scanner ignore files from the projectfile (a5e54da)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/bridge:3.7.0

This release also publishes the 3.7 and 3 tags — pull the precision you want to pin.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-bridge https://github.com/projectfile-org/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-bridge
~/.local/bin/pf-bridge --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-bridge

$ pf-bridge --help
pf-bridge — keep every project file in sync with your projectfile document

A projectfile (projectfile.yaml) is the single source of truth for a project:
identity, people, links, and tool config. pf-bridge copies that data out
into the files each tool already reads — README.md, package.json,
CITATION.cff, forge settings — and reads two-way files back.
Spec: https://projectfile.org/specification/

Usage:
  pf-bridge <bridge> [args]   run one bridge (e.g. readme, npm, forge)
  pf-bridge all [flags]       update every file from the projectfile [rw]
  pf-bridge check [flags]     verify declared files match, write nothing [ro]
  pf-bridge to all            write projectfile out to every file [rw]
  pf-bridge from all          read every two-way file back in [rw]
  pf-bridge --list            list installed bridges
  pf-bridge completion SHELL  print completion script (bash|zsh|fish)

[rw] updates files, [ro] only reads or compares. `check` without names
covers the bridges this project declares; `check <name>…` narrows it,
`check --all` covers every installed bridge instead.

Shared flags (also accepted after a bridge name):
  --check, --dry-run, --force, --create-all, --fail-on-drift, --offline,
  --quiet, --verbose. Each has a PF_BRIDGE_* env equivalent.
  Drift warns by default; --fail-on-drift makes it fatal.

Tools:
  cache                Manage the local SPDX and include cache
  forge                Push projectfile metadata out to the repository forge
  init                 Scaffold a new projectfile document (prefer pf-cli init)
  release-notes        Render release notes from git
  scan                 Run scanners to refresh projectfile metadata from filesystem signals
Package manifests:
  composer   [rw]  composer.json — two-way sync
  npm        [rw]  package.json — two-way sync
  pyproject  [rw]  pyproject.toml — two-way sync
  shard      [rw]  shard.yml — two-way sync
Citation and ownership:
  cff          [rw]  CITATION.cff — two-way sync
  codeowners   [rw]  CODEOWNERS — two-way sync
  funding      [ro]  FUNDING.yml — one-way render
  fundingjson  [ro]  funding.json — one-way render
Documentation:
  ai-policy     [ro]  AI_POLICY.md — one-way render
  coc           [ro]  CODE_OF_CONDUCT.md — one-way render
  contributing  [ro]  CONTRIBUTING.md — one-way render
  dei           [ro]  DEI.md — one-way render
  fragments     [ro]  FEATURES.md, ROADMAP.md, … assembled from docs/<name>.d fragments (one-way render)
  readme        [ro]  README.md — one-way render
  security      [ro]  SECURITY.md — one-way render
  support       [ro]  SUPPORT.md — one-way render
Repository setup:
  browserslist     [ro]  .browserslistrc — one-way render
  gitattributes    [ro]  .gitattributes — one-way render
  ignore           [ro]  .claudeignore, .containerignore, .dockerignore, .fdignore, .gitignore, .npmignore, .textlintignore — one-way render
  license          [ro]  LICENSE + LICENSES/<spdx>.txt (one-way render, always overwrite)
  releaserc        [ro]  .releaserc.yaml — one-way render
  vulnerabilities  [ro]  .grype.yaml, .trivyignore, audit-ci.jsonc, osv-scanner.toml — one-way render
  yamllint         [ro]  .yamllint — one-way render

Help per bridge: pf-bridge <bridge> --help

Examples and every command’s help are in Usage.

Image digests

A tag can move; a digest cannot. Pull this exact build:

docker pull ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88

Platform	Digest	Size
linux/amd64	sha256:e046c7713641ffc83cd021eb908645b7e90cf00f6ff8b9802528afb2a23ed8f1	235.2 MB
linux/arm64	sha256:eaf0f298b8921ce7f164291b1442420ee70f284e5b0ba64285c0f88c932cb470	216.6 MB (+0.1 MB)
linux/riscv64	sha256:ce25ddb8b9b48162a5f5f800f00cbf5ae9916730e8bd6c1bbe5efd4d8ab8f67f	226.6 MB (+0.1 MB)

Sizes are compressed layer bytes as stored in the registry.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/bridge@sha256:0ebf79f15d5511da4431e48cec3cf0e8375bca065143b9eea1e9c8ac8aa6ba88

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-bridge.asc https://github.com/projectfile-org/bridge/releases/download/3.7.0/pf-bridge-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-bridge.asc pf-bridge

Full changes: 3.6.1...3.7.0