From 99c35c16299fed6432a18eae30a5d678d290e22d Mon Sep 17 00:00:00 2001
From: Luke Wilkinson <95864695+krakenhavoc@users.noreply.github.com>
Date: Mon, 18 May 2026 23:12:57 -0400
Subject: [PATCH] docs: add CHANGELOG.md and suggest v1.1.0 tag (weekly audit
 2026-05-19)

---
 CHANGELOG.md | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 CHANGELOG.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..d1cf13b
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,42 @@
+# Changelog
+
+Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). Versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Unreleased]
+
+---
+
+## [v1.1.0] — 2026-05-18
+
+### Added
+- `chain-path` input (default `./chain.pem`) — path to save the intermediate CA chain PEM alongside the leaf certificate.
+- `fullchain-path` input (default `./fullchain.pem`) — path to save the full chain PEM (leaf + intermediates).
+- `chain-path` output — absolute path to the saved intermediate chain file, suitable for downstream scp / secrets-manager upload steps.
+- `fullchain-path` output — absolute path to the saved full chain PEM.
+- `issue`, `renew`, and `download` commands now produce all three certificate output files (leaf, chain, fullchain).
+- **Certificate Chain Files** section in README explaining each output file and when to use it.
+- **Deploy with full chain** usage example (nginx/HAProxy) in README.
+
+### Changed
+- `cert-path` output description clarified to "leaf certificate PEM" (was "certificate PEM").
+
+### Depends on
+- KrakenKey/cli v0.2.0 or later (for `--chain-out` / `--fullchain-out` flags)
+- KrakenKey/app v0.4.0 or later (for `GET /certs/tls/:id/chain` backend endpoint)
+
+---
+
+## [v1.0.0] — 2026-04-13
+
+### Added
+- Initial release: `issue`, `renew`, and `download` commands.
+- Automatic CSR generation and submission via the KrakenKey API.
+- API key masking (`::add-mask::`) to prevent key leakage in workflow logs.
+- Private key files written with `0600` permissions.
+- SHA-256 checksum verification of the `krakenkey-cli` binary before execution.
+- Configurable poll interval and poll timeout for certificate issuance and renewal.
+- `cert-path`, `key-path`, and `csr-path` inputs and outputs.
+- SHA-pinned third-party action dependencies (`actions/checkout`, `softprops/action-gh-release`).
+- CLI invoked via `KK_API_KEY` environment variable to prevent the API key appearing in `ps` output.