From cf08fe0855b4f70a2a3e2c82e32247653cd178da Mon Sep 17 00:00:00 2001
From: Luke Wilkinson <95864695+krakenhavoc@users.noreply.github.com>
Date: Mon, 8 Jun 2026 23:18:25 -0400
Subject: [PATCH] =?UTF-8?q?docs:=20weekly=20audit=20=E2=80=94=20CHANGELOG?=
 =?UTF-8?q?=20[Unreleased]:=20release=20pipeline,=20PKI=20+=20CT=20advisor?=
 =?UTF-8?q?ies?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Populate empty [Unreleased] section:
- Release workflow restricted to v*.*.* tag-triggered runs
- PKI Advisory: SC-098v2 CAA RFC 8657 (March 2027 enforcement)
- PKI Advisory: Chrome EKU separation (effective 2026-06-15)
- PKI Advisory: CT mandatory logging (effective 2026-06-15, DigiCert opt-outs removed 2026-06-01)

Suggested next release: v1.2.0
---
 CHANGELOG.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1cf13b..e3921f1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,23 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](
 
 ## [Unreleased]
 
+### Changed
+
+- Release workflow restricted to tag-triggered runs (`v*.*.*` pattern only); manual dispatch and branch push triggers no longer create releases.
+- Release notes use structured Added / Changed / Fixed sections and publish with `make_latest: true`.
+
+### PKI Advisory — SC-098v2 (CA/B Forum, RFC 8657 CAA, enforcement March 2027)
+
+CA/B Forum Ballot SC-098v2 will require `accounturi` and `validationmethods` CAA parameters for all new issuances from March 2027. KrakenKey uses Let's Encrypt with `dns-01` challenges; no action is required for this action itself, but users who manage their own CAA records should add the required parameters before March 2027. See [RFC 8657](https://www.rfc-editor.org/rfc/rfc8657) for syntax.
+
+### PKI Advisory — Chrome EKU Separation (effective 2026-06-15)
+
+Chrome Root Program Policy v1.8, Section 1.3.2: TLS intermediates must be `serverAuth`-only. DigiCert and Sectigo intermediates that bundled `clientAuth` require re-issuance. Let's Encrypt E5/E6/R10/R11 intermediates are already compliant; certificates issued via this action are unaffected.
+
+### PKI Advisory — Certificate Transparency Mandatory Logging (effective 2026-06-15)
+
+Chrome Root Program Policy v1.8, Section 1.3.4.1: precertificate CT logging is mandatory before issuance for all Root Program participants. DigiCert removed CT opt-out settings from CertCentral on 2026-06-01. Let's Encrypt has always logged all certificates to CT by default; certificates issued via this action are already compliant. Certificate hostnames and SAN values are permanently public record in CT logs — this is by design for all publicly-trusted certificates.
+
 ---
 
 ## [v1.1.0] — 2026-05-18