v1.5.0

What's Changed

• fix(ci): run test jobs with zend.assertions=1 by @CybotTM in #159
• Expose one stable check name so a merge queue can be gated by @CybotTM in #160
• feat(ci): add cgl-php-version input for the Code Style job by @CybotTM in #161
• Drop nosemgrep-suppressed findings before SARIF upload by @CybotTM in #163
• chore(deps): update github/codeql-action action to v4.37.6 by @renovate[bot] in #162
• chore(deps): update step-security/harden-runner action to v2.20.1 by @renovate[bot] in #164
• chore(deps): update actions/attest-build-provenance action to v4.2.2 by @renovate[bot] in #166
• fix(security): survive an unreachable advisory source without muting the audit by @CybotTM in #167
• feat(changelog): add opt-in changelog fragments, org-wide by @CybotTM in #165
• feat(ci): opt-in repo-checks job so callers need no workflow of their own by @CybotTM in #168
• chore(deps): update github/codeql-action action to v4.37.7 by @renovate[bot] in #170
• chore(deps): update step-security/harden-runner action to v2.21.0 by @renovate[bot] in #171
• feat(release): make-latest input so backport releases stop claiming Latest by @CybotTM in #176
• fix(ci): health-check the DB service with whichever client the image ships by @CybotTM in #174
• fix(e2e): cache Playwright browsers and bound the browser-install step by @CybotTM in #175
• fix(ci): retry composer over transient transport failures by @CybotTM in #177
• feat(runtests): ship the runner extensions actually use, as a composer bin by @CybotTM in #180

Full Changelog: v1.4.0...v1.5.0