docs: add changelog entries for CLI v2.27.0, v2.28.0, and platform updates

[mintlify]

Summary

Document new tagged releases since the last changelog entry for each product.

Changes

• CLI v2.27.0 (Jun 16): pull_request attestations now capture per-commit signature status and PR base branch; author identity recorded; API-key rotation cleanup. Includes a self-hosted upgrade warning.
• CLI v2.28.0 (Jun 18): kosli get trail --output markdown for CI job summaries.
• Platform (Jun 22): membership audit log page, stronger SDLC-CTRL-0007 (signed commits + protected branch), service-account CRUD API, decisions list/tray improvements, auto-run deletability check, controls UI refresh, faster environment snapshot listing, signup-form labels, "Sign out" wording, and bug fixes for concurrent-create 500s and the "Added" date reset.

Context

Triggered by the scheduled changelog workflow. Tags reviewed: kosli-dev/cli (v2.27.0, v2.28.0), kosli-dev/server releases since the last platform entry (June 12). No new tags for kosli-dev/terraform-provider-kosli since v0.6.4.

[claude]

Claude finished @mintlify[bot]'s task in 1m 38s —— View job

---

Reviewing PR #282 — Changelog entries for CLI v2.27.0, v2.28.0, and platform updates

• Read doc-review skill and CLAUDE.md conventions
• Read the changed file (changelog/index.mdx)
• Check diff against origin/main
• Verify <Update> component format and writing style
• Check links and references
• Post review findings

---

Review findings

Scope: 58 lines added to changelog/index.mdx — three new <Update> blocks (Platform Jun 22, CLI v2.28.0, CLI v2.27.0).

Suggestion

changelog/index.mdx:13 — "V2" capitalization
"V2 pull_request attestations" uses an uppercase V, while CLI version references elsewhere use lowercase (v2.27.0). Consider v2 for consistency, unless "V2" is the canonical name for the attestation format version.

Suggestion

changelog/index.mdx:12 — Slightly awkward phrasing
"…and the PR to merge into the protected branch" reads ambiguously (merge into vs. target). Consider "…and the PR to target the protected branch" or "…and the PR to be merged into the protected branch".

No issues found (all passing checks)

Check	Result
<Update> component format	All three entries match the established label / description / tags pattern. Platform entry omits description and [View on GitHub], consistent with prior Platform entries.
Heading style	"New features", "Updates", "Bug fixes" — sentence case, matches existing entries.
Internal links	/client_reference/kosli_get_trail (line 40) resolves to client_reference/kosli_get_trail.md.
External links	GitHub release links for v2.27.0 and v2.28.0 use correct tag URLs.
No relative links	All links are root-relative or absolute — no ../ patterns.
Writing style	Active voice, imperative mood, "Kosli" (not "the Kosli platform"), American spelling throughout.
<Warning> usage	The self-hosted upgrade warning in the v2.27.0 entry is appropriate and actionable — good use of the component.
Navigation config	No update needed — changelog/index.mdx is an existing file.
Content overlap	The Platform entry (line 13) and CLI v2.27.0 entry (line 50) both cover pull_request attestation fields from their respective perspectives (server-side vs. client-side). The Platform entry correctly notes "populated by CLI v2.27.0+", linking the two. This is fine.

Summary

0 Critical · 0 Improvement · 2 Suggestion

Clean changelog PR. All three entries follow the established <Update> format, use correct link patterns, and are well-written. The two suggestions are cosmetic wording nits. LGTM.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
kosli	🟢 Ready	View Preview	Jun 22, 2026, 9:11 AM

[claude]

Suggestion: "V2" uses an uppercase V, while CLI versions elsewhere use lowercase (v2.27.0). Consider v2 for consistency — unless "V2" is the canonical name for the attestation format version.

Suggested change

	- **`pull_request` attestation fields** — v2 `pull_request` attestations now carry per-commit `verified` / `signature_state` and a PR `base_ref` (populated by CLI v2.27.0+), enabling Rego policies for signed commits and "merged into main".

[claude]

Suggestion (minor): "the PR to merge into the protected branch" reads slightly ambiguously. Consider "the PR to target the protected branch" or "the PR to be merged into the protected branch".