v2.9.0

14 commits, 1 contributor, 8 hours since v2.8.0.

Features

• render: release from the stable branch run through a release-tag job (7b0ea2d)

Bug fixes

• deps: bump projectfile/core to v2.18.2 (c8ca0fc)
• render: keep tag runs for a stable branch that declares no release-tag node (dd0b7cc)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v2.9.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v2/cmd/pf-ci@v2.9.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v2.9.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v2.9.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v2.9.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc pf-ci

Full changes: 2.6.1...v2.9.0