v3.2.0

410 commits, 1 contributor.

Upgrade notes

• get: read composed values with --scope, drop the sink subcommand (1e826ec)

  removes pf-cli sink and the image.{basename,namespace,name}
  derived get addresses.

• cli: drop the rm and v aliases (0e6f048)

  pf-cli rm and pf-cli v are unknown commands; use del/delete and validate/lint.

• cli: results on stdout, one colour decision and a network timeout (43b16f1)

  result lines move from stderr to stdout.

• cli: rename --path-file to --file (fd19833)

Features

• sink: add pf-cli sink ref and pf-cli sink list (9b6f060)
• sink: compose many references in one call with sink refs (7f0315b)
• get: bind a scope to one --path entry so a batch reads many subjects (47847eb)
• i18n: translate feature fragments to Spanish and Ukrainian (24be133)
• i18n: localize identity summary and description (ae663cf)
• ci: seed released binaries to BitTorrent (a5607da)
• ci: sign released binaries and published images (b0e5a88)
• ci: publish one torrent for the whole release (5dfac29)
• cache: expose cache status, warm --force, purge [url], refresh (06c359d)
• cli: support yaml and toml output in get command (72e21ae)
• forge: declare Codeberg and GitHub mirrors and enable GitHub CI (03801ea)
• ci: build linux/amd64, arm64 and riscv64 images (6cd41ed)
• publish: push to Docker Hub (f2dc54a)
• cli: colorize help headers and command names (d761b7e)
• cli: add pf-cli init with bridge delegation and basic fallback (776dbaf)
• get: add --expand to fill document references in place (8f1c86f)
• cli: add -V and derive a version for unstamped builds (8ba0478)
• pf-cli optimize prunes redundant includes (b388da1)
• cli: pin includes to their sha256 (043d80b)
• get: suggest the nearest sibling on a missing field (3429384)
• cli: document and enforce a distinct exit code per failure class (fd8b852)
• help: lead with examples, group commands and link the docs (1d28fc3)
• get: propose the intended address with --suggest (d5ab94d)
• validate: embed the fragment schema and check an included file with --fragment (b7ae0cd)
• module: move the module to projectfile.org/projectfile/cli/v3 (3ca652e)
• release: tag releases with a v prefix (49b6732)

Bug fixes

• fetch-schema: clear the inherited Git environment before touching the clone (1dcffb6)
• dockerfile: key apt cache mounts by arch, not just series (5932f39)
• go: bump toolchain directive to 1.26.6 (c5b8a75)
• deps: bump projectfile/core to v2.9.4 (4733607)
• container: declare the full b19 build-arg surface (cdc86b3)
• ci: add gsa node to enforce build-binaries before auto-gsa (5ba498d)
• update .makefile/library submodule (disable check-outdated-go memoisation) (eb0d330)
• ci: opt into the binary release pipeline explicitly (416f831)
• deps: bump kiota.ch/projectfile/core/v2 to v2.9.7 (c514443)
• build-binaries: stop writing a duplicate unsuffixed dist/pf-cli (3ab3fcd)
• ci: gate the cosign steps on the publish cell (a19c44c)
• bump core to 2.10.3 (a12e09e)
• forge: declare only existing forges (69c5082)
• deps: bump projectfile/core to v2.11.1 (ed98dbe)
• deps: bump projectfile/core to v2.11.2 (5d7e4a7)
• deps: bump projectfile/core to v2.12.0 (7bb5998)
• deps: bump projectfile/core to v2.12.3 (feac89a)
• cli: drop non-existent sink ref from help (d2185ed)
• deps: bump projectfile/core to v2.13.0 (4c40546)
• cli: reject an empty --fail-on value (620b3a0)
• get: name a missing field and the command to inspect it (4d7f36a)
• set: refuse a value the field cannot hold instead of deleting it (4e8fd2d)
• validate: name a duplicate include as listed twice (ce4affe)
• deps: update projectfile core to v2.15.0 (f623b33)
• goconst (80f3790)
• deps: bump charm.land/bubbletea/v2 to v2.1.0 (9a890c3)
• container: restore M6E_VERSION in final image (f31cedb)
• deps: bump projectfile/core to v2.16.0 (e263b7d)
• validate: reject TOML documents missing spec_version (d9962b7)
• validate: name the repositories origin rule in failures (bc2c343)
• cli: rewrite argument and flag errors in the tool’s voice (41f8755)
• cli: reserve -f for --force and drop it from --path-file and --format (b7efc12)
• cli: keep a bare set value as the text the user typed (7cc954a)
• cli: keep a folded block scalar folded across a write (5bf8f2b)
• deps: bump core to 2.17.0 (ec46d2b)
• deps: bump core to 2.18.0 (e4c4d15)
• deps: bump projectfile/core to v2.18.1 for retried network fetches (f0a78e0)
• security: suppress CVE-2026-92392 in the Ubuntu cURL (2c38874)
• security: generate the scanner ignore files from the projectfile (375d124)
• ci: sign every binary cell in one job (2e16bcf)
• build: fetch public Go modules through proxy.golang.org (72c1ce7)

Performance

• container: declare M6E_VERSION next to the user stage (c0de4fe)

Reverts

• undo local submodule edit (fix belongs in m6e/library) (b8448fb)

Dependencies

• 9 dependency updates

Installation

Container image

Pull the published container image:

docker pull ghcr.io/projectfile-org/cli:v3.2.0
alias pf-cli='docker run --rm --user "$(id -u):$(id -g)" --group-add 0 --volume "$PWD:/app/ws" --workdir /app/ws ghcr.io/projectfile-org/cli:v3.2.0 pf-cli'

Then run it as if it were installed — the alias runs every example as written against the current directory:

pf-cli --help

Prebuilt binary

Download the prebuilt binary for your platform from this release:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/pf-cli https://github.com/projectfile-org/cli/releases/download/v3.2.0/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m)
chmod +x ~/.local/bin/pf-cli
~/.local/bin/pf-cli --help

Published for: linux/amd64, linux/arm64, linux/riscv64, darwin/amd64, darwin/arm64

Usage

pf-cli

$ pf-cli --help
pf-cli is the command-line frontend for the projectfile: it reads, writes and
validates fields, resolves remote includes, and generates derived artifacts. It
embeds the v1 JSON Schema for offline validation and is the canonical tool for
editing projectfiles locally and in CI.

File and forge sync (bridge, forge, scan): use pf-bridge.

Usage:
  pf-cli [command]

Examples:
  pf-cli init --namespace org.example --name demo
  pf-cli get identity.name
  pf-cli set license.spdx MIT
  pf-cli add keywords rust wasm
  pf-cli del keywords[0]
  pf-cli validate
  pf-cli convert yaml toml
  pf-cli optimize
  pf-cli cache status

Read:
  get         Read one or more projectfile fields

Write:
  add         Append items to a projectfile list
  del         Remove a field, list item, or map entry from projectfile
  set         Write a value into a projectfile field

Validate:
  validate    Validate a projectfile against the v1 JSON Schema

Maintain:
  cache       Manage pf-cli’s local cache for offline use
  convert     Convert a projectfile between encodings (toml/yaml/json)
  includes    Manage the includes list
  init        Scaffold a new projectfile document
  optimize    Remove local fields that duplicate include values
  setup       Edit your per-user configuration interactively

Other:
  completion  Generate the autocompletion script for the specified shell
  help        Help about any command

Common flags:
    -q, --quiet          mute info; warnings and errors still print
  -v, --verbose        show each step; also PF_CLI_VERBOSE=1
  --offline            refuse network; use cache and embedded data

Flags:
      --colors string        colour output: auto|always|never; also PF_CLI_NO_COLOR=1 (default "auto")
      --fail-on string       abort includes at error|warning (default "error")
  -h, --help                 help for pf-cli
      --ignore-user-config   skip $XDG_CONFIG_HOME/projectfile/cli.* loading
      --offline              refuse network; use cache and embedded data
  -q, --quiet                mute info; warnings and errors still print
      --sorted               write YAML keys in sorted order
      --timeout duration     per-attempt network timeout (default 10s)
  -v, --verbose              show each step; also PF_CLI_VERBOSE=1
  -V, --version              print the version

Documentation:
  https://github.com/projectfile-org/cli/tree/main/docs

Report a bug:
  https://github.com/projectfile-org/cli/issues

Use "pf-cli [command] --help" for more information about a command.

Examples and every command’s help are in Usage.

Verify

Check that what you downloaded is what this project published.

Container image

The signature proves this project’s CI built and pushed the image; the attestation carries its software bill of materials.

COSIGN_KEY=https://kiota.ch/damian-buho/metadata/raw/branch/main/keys/ci-cosign-key.pub
cosign verify --key "$COSIGN_KEY" --insecure-ignore-tlog=true ghcr.io/projectfile-org/cli:v3.2.0
cosign verify-attestation --key "$COSIGN_KEY" --insecure-ignore-tlog=true --type cyclonedx ghcr.io/projectfile-org/cli:v3.2.0

Prebuilt binary

The signature proves the binary is the one the maintainer’s release key signed.

gpg --keyserver hkps://keys.openpgp.org --recv-keys 8F89CBF7C8D51F8BEC7533C00925F8F79EBD3257
curl --fail --location --output pf-cli.asc https://github.com/projectfile-org/cli/releases/download/v3.2.0/pf-cli-$(uname -s | tr A-Z a-z)-$(uname -m).asc
gpg --verify pf-cli.asc pf-cli

Full changes: 3.1.1...v3.2.0