v3.4.0

18 commits, 1 contributor, 4 days since v3.3.0.

Features

• render: lower ci.build-memory to the buildah memory input (aa1f1d8)
• audit the image the trunk publishes, overridable by org.ci.audited.branch (c0184d0)
• render: lower goal verdicts and publish facts to the event action (2ae24fd)

Bug fixes

• render: keep interior gates off a goal no push fires (8da7808)
• generate: stamp generated files with the project's license.spdx (130b006)
• deps: bump kiota.ch/projectfile/core/v2 to v2.20.4 (4a3e9c9)

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/ci:v3.4.0

Go toolchain

Install with the Go toolchain:

go install projectfile.org/projectfile/ci/v3/cmd/pf-ci@v3.4.0

Then run pf-ci --help.

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-ci https://github.com/projectfile-org/ci/releases/download/v3.4.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-ci
~/.local/bin/pf-ci --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

To uninstall, delete that one file: rm ~/.local/bin/pf-ci.

Usage

Lower the CI DAG to a forge’s workflow files:

pf-ci resolve
pf-ci generate -target forgejo
pf-ci generate -target gha -check

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/ci:v3.4.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/ci:v3.4.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-ci.asc https://github.com/projectfile-org/ci/releases/download/v3.4.0/pf-ci-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-ci.asc ~/.local/bin/pf-ci

# every downloaded asset at once
gpg --verify pf-ci-SHA256SUMS.asc pf-ci-SHA256SUMS
sha256sum --check --ignore-missing pf-ci-SHA256SUMS

Full changes: 2.6.1...v3.4.0