From c99b1bba8e844a87c1baabe1030f152ad2e99e68 Mon Sep 17 00:00:00 2001
From: Francisco Meneses <fmeneses@fmeneses-thinkpadp16vgen1.rmtcl.csb>
Date: Wed, 14 Oct 2026 11:14:42 -0300
Subject: [PATCH] chore(release): version CHANGELOG for v0.4.7

Move expanded --redact-secrets notes out of Unreleased and refresh the
GitHub release body for this cut (#70).

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/release.yml | 7 ++-----
 CHANGELOG.md                  | 2 ++
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15cda46..7912a9a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,12 +73,9 @@ jobs:
             ## What's new in v${{ steps.version.outputs.tag }}
 
             ### threescale-export
-            - **`--toolbox-platform`** / `THREESCALE_TOOLBOX_PLATFORM` — opt-in `--platform` on toolbox `podman|docker run` (e.g. `linux/amd64` on Apple Silicon). Empty omits the flag (no auto-default). Ignored with `--toolbox-binary`.
+            - **`--redact-secrets` (expanded)** — consulting sanitize key set: certificates/PEM blocks, `password`, `apikey`, `secret_token`, `username`, infra URLs (`private_endpoint`, `admin_url`, `*BaseURL`, issuer endpoints, etc.). Issuer URLs fully redacted (not host-preserved). Multi-line YAML PEM bodies stripped. Still **opt-in**.
 
-            ### Release packaging
-            - **macOS Apple Silicon** — `*-darwin-arm64.tar.gz` (+ `.sha256`) alongside `*-linux-amd64.tar.gz` (since v0.4.5)
-
-            See [README](https://github.com/${{ github.repository }}/blob/main/README.md) and [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for flags and full release history.
+            See [README](https://github.com/${{ github.repository }}/blob/main/README.md#redaction) and [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for the full key list and history.
 
             ---
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8bcc5fd..16bc8aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.4.7] - 2026-10-14
+
 ### Changed
 
 - **threescale-export** — `--redact-secrets` now fully redacts the consulting sanitize key set (certificates/PEM blocks, `password`, `apikey`, `secret_token`, `username`, and infra URLs such as `private_endpoint`, `admin_url`, `*BaseURL`, issuer endpoints). Issuer URLs are no longer host-preserved (credentials+host become `***REDACTED***`). Multi-line YAML PEM bodies are stripped.