3.1.0

9 commits, 1 contributor, 21 hours since 3.0.1.

Features

• validate: embed the fragment schema and check an included file with --fragment (b7ae0cd)

Bug fixes

• deps: bump projectfile/core to v2.18.1 for retried network fetches (f0a78e0)
• security: suppress CVE-2026-92392 in the Ubuntu cURL (2c38874)
• security: generate the scanner ignore files from the projectfile (375d124)

Installation

alias pf-cli='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws ghcr.io/projectfile-org/cli:3.1.0 pf-cli'

Then run it as if it were installed — the alias runs every example as written against the current directory:

pf-cli --help

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-cli https://github.com/projectfile-org/cli/releases/download/3.1.0/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-cli
~/.local/bin/pf-cli --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-cli

$ pf-cli --help
pf-cli is the command-line frontend for the projectfile: it reads, writes and
validates fields, resolves remote includes, and generates derived artifacts. It
embeds the v1 JSON Schema for offline validation and is the canonical tool for
editing projectfiles locally and in CI.

File and forge sync (bridge, forge, scan): use pf-bridge.

Usage:
  pf-cli [command]

Examples:
  pf-cli init --namespace org.example --name demo
  pf-cli get identity.name
  pf-cli set license.spdx MIT
  pf-cli add keywords rust wasm
  pf-cli del keywords[0]
  pf-cli validate
  pf-cli convert yaml toml
  pf-cli optimize
  pf-cli cache status

Read:
  get         Read one or more projectfile fields

Write:
  add         Append items to a projectfile list
  del         Remove a field, list item, or map entry from projectfile
  set         Write a value into a projectfile field

Validate:
  validate    Validate a projectfile against the v1 JSON Schema

Maintain:
  cache       Manage pf-cli’s local cache for offline use
  convert     Convert a projectfile between encodings (toml/yaml/json)
  includes    Manage the includes list
  init        Scaffold a new projectfile document
  optimize    Remove local fields that duplicate include values
  setup       Edit your per-user configuration interactively

Other:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command

Common flags:
    -q, --quiet          mute info; warnings and errors still print
  -v, --verbose        show each step; also PF_CLI_VERBOSE=1
  --offline            refuse network; use cache and embedded data

Flags:
      --colors string        colour output: auto|always|never; also PF_CLI_NO_COLOR=1 (default "auto")
      --fail-on string       abort includes at error|warning (default "error")
  -h, --help                 help for pf-cli
      --ignore-user-config   skip $XDG_CONFIG_HOME/projectfile/cli.* loading
      --offline              refuse network; use cache and embedded data
  -q, --quiet                mute info; warnings and errors still print
      --sorted               write YAML keys in sorted order
      --timeout duration     per-attempt network timeout (default 10s)
  -v, --verbose              show each step; also PF_CLI_VERBOSE=1
  -V, --version              print the version

Documentation:
  https://github.com/projectfile-org/cli/tree/main/docs

Report a bug:
  https://github.com/projectfile-org/cli/issues

Use "pf-cli [command] --help" for more information about a command.

Examples and every command’s help are in Usage.

Image digests

A tag can move; a digest cannot. Pull this exact build:

docker pull ghcr.io/projectfile-org/cli@sha256:21e38ba099e9e47c0375294c5f581d78be6547b0bd0e3d26854044bc9ce2493d

Platform	Digest	Size
linux/amd64	sha256:d058c63e1c7629f2ec977a7835256443b600aad14e09816e95624544eb28d8c3	88.2 MB
linux/arm64	sha256:7f2cc9440d200d8a191846ad686d548193f408fe71e3458e64684cbb6f86dced	84.9 MB
linux/riscv64	sha256:137e967afc6696547bfafaf64c1c75e804abd216be33e020db4fbce06aab87f8	89.1 MB

Sizes are compressed layer bytes as stored in the registry.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/cli@sha256:21e38ba099e9e47c0375294c5f581d78be6547b0bd0e3d26854044bc9ce2493d
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/cli@sha256:21e38ba099e9e47c0375294c5f581d78be6547b0bd0e3d26854044bc9ce2493d

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-cli.asc https://github.com/projectfile-org/cli/releases/download/3.1.0/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-cli.asc pf-cli

Full changes: 3.0.1...3.1.0