From 3cdc2069dbeabd1842221468e61bc0b45420942e Mon Sep 17 00:00:00 2001
From: pi <pi@pi-devbox>
Date: Wed, 1 Jul 2026 16:49:25 +0200
Subject: [PATCH] =?UTF-8?q?release:=20v1.2.4=20=E2=80=94=20pi=200.80.2=20?=
 =?UTF-8?q?=E2=86=92=200.80.3;=20global=20gitignore,=20env=5Ffile-only=20s?=
 =?UTF-8?q?ecrets,=20promote-base-latest=20CI=20fix?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3777663..7e45df3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,7 +11,14 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
-## Unreleased
+## v1.2.4 — 2026-06-29
+
+Patch release. Headline: **pi `0.80.2` → `0.80.3`** (npm `latest`). Also ships a
+global gitignore baked into the image, secrets-via-`env_file`-only compose
+hardening, and a CI fix so `promote-base-latest` re-points `base-latest`
+reliably after a dry-run-first release. The mempalace pin stays `3.5.0`. The
+base image rebuilds because `Dockerfile.base` changed (the gitignore seed +
+`entrypoint-user.sh` wiring).
 
 ### Added