v3.2.0

8 commits, 1 contributor, 18 hours since v3.1.3.

Features

• ci: let matrix.exclude name a derived axis (b30efd2)
• render: withhold excluded artifacts per cell in joins (fd985d4)

Bug fixes

• render: render a goal no push fires without the release tag (93a8fb5)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.2.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.2.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.2.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.2.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.2.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.2.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.2.0