Merge branch '11.5' into 12.5

* 11.5:
  Harden against script injection
  Do not persist Git credentials

Author: sebastianbergmann

.github/workflows/ci.yaml

@@ -38,6 +38,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -94,6 +95,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -145,6 +147,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -224,6 +227,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -304,6 +308,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -363,6 +368,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -456,6 +462,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash
@@ -531,6 +538,7 @@ jobs:
         with:
           fetch-depth: 1
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
 
       - name: Use local branch
         shell: bash

.github/workflows/release.yaml

@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install PHP with extensions
         uses: shivammathur/setup-php@v2
@@ -33,7 +35,7 @@ jobs:
         run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
 
       - name: Parse ChangeLog
-        run: build/scripts/extract-release-notes.php ${{ env.RELEASE_TAG }} > release-notes.md
+        run: build/scripts/extract-release-notes.php ${RELEASE_TAG} > release-notes.md
 
       - name: Create release
         uses: ncipollo/release-action@v1