From 584eb5db81da590c8267cb9a83d27f88a919d7ec Mon Sep 17 00:00:00 2001
From: Luke Wilkinson <95864695+krakenhavoc@users.noreply.github.com>
Date: Mon, 29 Jun 2026 23:12:18 -0400
Subject: [PATCH] =?UTF-8?q?docs:=20add=20release=20pipeline=20and=20PKI=20?=
 =?UTF-8?q?advisories=20to=20CHANGELOG=20=E2=80=94=20weekly=20audit=202026?=
 =?UTF-8?q?-06-30?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Document release pipeline trigger pattern (v[0-9]+.[0-9]+.[0-9]+ tags only)
- Add SC-098v2, Chrome EKU separation, CT mandatory logging, and LE MTC advisories
---
 CHANGELOG.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1cf13b..5ffc959 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,15 @@ Notable changes to the KrakenKey cert-action. Format follows [Keep a Changelog](
 
 ## [Unreleased]
 
+### Changed
+- Release pipeline: trigger restricted to `v[0-9]+.[0-9]+.[0-9]+` tags only; release notes auto-generated from CHANGELOG; `make_latest: true`.
+
+### Advisory
+- **SC-098v2 — CAA RFC 8657 Parameters**: `validationmethods` and `accounturi` CAA parameters; CA enforcement deadline March 2027; no cert-action config change required today.
+- **Chrome EKU Separation**: serverAuth/clientAuth EKU separation enforced 2026-06-15; affects DigiCert/Sectigo chains; Let's Encrypt (used by this action) unaffected.
+- **CT Mandatory Logging**: enforced 2026-06-15; DigiCert opt-out removed 2026-06-01; Let's Encrypt always CT-logged, no action required.
+- **LE Merkle Tree Certificates**: announced 2026-06-03; staging late 2026, production 2027; MTC breaks the `chain.pem`/`fullchain.pem` model — `chain-path` and `fullchain-path` outputs will need updates before the LE production rollout.
+
 ---
 
 ## [v1.1.0] — 2026-05-18