From def48d6d2d18f6b02c53216d74f8f4b806719717 Mon Sep 17 00:00:00 2001
From: Luke Wilkinson <95864695+krakenhavoc@users.noreply.github.com>
Date: Mon, 25 May 2026 23:14:15 -0400
Subject: [PATCH] =?UTF-8?q?docs:=20weekly=20audit=20=E2=80=94=20release=20?=
 =?UTF-8?q?pipeline=20notes=20and=20CAA=20record=20advisory?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PR #11 (merged 2026-05-19) improved the release pipeline; CI-internal
changes noted in CHANGELOG. Add CAA record advisory for March 2027
enforcement of RFC 8657 parameters (SC-098v2, passed 2026-05-13).
---
 CHANGELOG.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1cf13b..31dd882 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,20 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](
 
 ## [Unreleased]
 
+### Developer Notes
+- Release workflow (`.github/workflows/release.yaml`) now restricts the trigger to semver tags matching `v[0-9]+.[0-9]+.[0-9]+`. Major-version pointer tags (e.g., `v1`) no longer re-trigger the pipeline.
+- GitHub release notes are now auto-generated using `.github/release.yaml` changelog category labels (Features, Bug Fixes, Other Changes).
+- Each release is now automatically marked as `latest` via `make_latest: true`.
+
+### Compatibility Advisory — CAA Records (March 2027)
+CA/Browser Forum **ballot SC-098v2** (passed 2026-05-13) requires all public CAs to enforce RFC 8657 CAA parameter extensions (`accounturi`, `validationmethods`) by **March 2027**. KrakenKey cert-action issues certificates via Let's Encrypt using ACME DNS-01.
+
+If your domain's CAA record sets `validationmethods`, ensure `dns-01` is included:
+```
+0 issue "letsencrypt.org; validationmethods=dns-01"
+```
+A record restricting to `http-01` or `tls-alpn-01` only will block issuance via this action once enforcement begins. CAA records without the `validationmethods` parameter are unaffected.
+
 ---
 
 ## [v1.1.0] — 2026-05-18