v3.4.0

18 commits, 1 contributor, 4 days since v3.3.0.

Features

• render: lower ci.build-memory to the buildah memory input (aa1f1d8)
• audit the image the trunk publishes, overridable by org.ci.audited.branch (c0184d0)
• render: lower goal verdicts and publish facts to the event action (2ae24fd)

Bug fixes

• render: keep interior gates off a goal no push fires (8da7808)
• generate: stamp generated files with the project's license.spdx (130b006)
• deps: bump kiota.ch/projectfile/core/v2 to v2.20.4 (4a3e9c9)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.4.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.4.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.4.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.4.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.4.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.4.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.4.0

v3.3.0

4 commits, 1 contributor, 20 hours since v3.2.4.

Features

• lefthook: render a stage_fixed format job ahead of the dag job (171fea6)
• lefthook: scope the pre-commit hook to staged files (1bb353d)

Bug fixes

• deps: bump m6e submodules (54f838b)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.3.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.3.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.3.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.3.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.3.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.3.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.3.0

v3.2.3

4 commits, 1 contributor, 23 hours since v3.2.2.

Bug fixes

• deps: bump projectfile/core to v2.20.2 (56dbbde)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.2.3

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.2.3

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.2.3/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.2.3
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.2.3

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.2.3/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.2.3

v3.2.0

8 commits, 1 contributor, 18 hours since v3.1.3.

Features

• ci: let matrix.exclude name a derived axis (b30efd2)
• render: withhold excluded artifacts per cell in joins (fd985d4)

Bug fixes

• render: render a goal no push fires without the release tag (93a8fb5)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.2.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.2.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.2.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.2.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.2.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.2.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.2.0

v3.1.3

4 commits, 1 contributor, 2 days since v3.1.2.

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.1.3

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.3

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.1.3/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.1.3
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.1.3

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.1.3/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.1.3

v3.1.0

17 commits, 1 contributor, 21 hours since v3.0.1.

Features

• render: contract tool-less joins and judge each goal in a verdict job (e29ef99)

Bug fixes

• refactor CI workflows (new goals + preflight checks) (bc663b5)
• workflows: move pins (f2ed7e7, 6a9589f)
• workflows: enable checks (3f8805f)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.1.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.1.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.1.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.1.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.1.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.1.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.1.0

v3.0.1

1 commit, 1 contributor, 7 minutes since v3.0.0.

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.0.1

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.0.1

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.0.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.0.1
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.0.1

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.0.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.0.1

v2.9.0

14 commits, 1 contributor, 8 hours since v2.8.0.

Features

• render: release from the stable branch run through a release-tag job (7b0ea2d)

Bug fixes

• deps: bump projectfile/core to v2.18.2 (c8ca0fc)
• render: keep tag runs for a stable branch that declares no release-tag node (dd0b7cc)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v2.9.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v2/cmd/pf-ci@v2.9.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v2.9.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v2.9.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc pf-ci

Full changes: 2.6.1...v2.9.0

v2.8.0

13 commits, 1 contributor, 23 hours since v2.7.0.

Features

• render: name a fused job after a node that runs whenever it runs (2c68a5c)
• matrix: lower matrix: {artifact: NAME} to TARGET_OS/TARGET_ARCH cells from the record (6c0925b)
• render: leave tag runs to the stable branch when release.stable-dispatch opts in (bf06d66)
• render: lower an action without a dedicated fragment to a generic uses step (4033bf3)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v2.8.0

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v2.8.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v2.8.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v2.8.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v2.8.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc pf-ci

Full changes: 2.6.1...v2.8.0

2.6.1

2 commits, 1 contributor, 2 hours since 2.6.0.

Bug fixes

• ci: sign every binary cell in one job (b27e9d1)
• build: fetch public Go modules through proxy.golang.org (d54fe18)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:2.6.1

This release also publishes the 2.6 and 2 tags — pull the precision you want to pin.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Image digests

A tag can move; a digest cannot. Pull this exact build:

docker pull ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059

Platform	Digest	Size
linux/amd64	sha256:17024c811208566550b6ed3fe9233f146e63972f34abf753c9c1b8b352824633	87.3 MB
linux/arm64	sha256:94e807ba1ea958370dfc586c8a1e898a4750f970b0004784c959db3b176d00b1	84.0 MB
linux/riscv64	sha256:eff2549582da7a933d327161d55fb84570203b1350cd073603a6aa18ab476588	88.2 MB

Sizes are compressed layer bytes as stored in the registry.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci@sha256:06a98c4c0665e77bdb778f2ba6c32f3cd0f4811dfcdc6dd75dea185ad9925059

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/2.6.1/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc pf-ci

Full changes: 2.6.0...2.6.1