build: rebuild the asset pipeline on gulp 5, clear all 13 Dependabot alerts

.browserslistrc

@@ -0,0 +1,5 @@
+# Carried over from the browserlist array in the previous gulpfile.
+# autoprefixer reads this; the `browsers` option it used to take was removed
+# in autoprefixer 4.
+last 2 versions
+> 1%

.github/dependabot.yml

@@ -1,9 +1,30 @@
 version: 2
+
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: daily
-    time: "03:00"
-    timezone: Africa/Johannesburg
-  open-pull-requests-limit: 99
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:00"
+      timezone: Africa/Johannesburg
+    open-pull-requests-limit: 5
+    # Grouped updates: one PR for all action bumps rather than one per action.
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "03:00"
+      timezone: Africa/Johannesburg
+    open-pull-requests-limit: 5
+    groups:
+      npm-development:
+        dependency-type: development
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -0,0 +1,70 @@
+name: CI
+
+on:
+  push:
+    branches: [master, develop]
+  pull_request:
+
+# Supersedes the old cancel.yml / styfle/cancel-workflow-action pattern:
+# GitHub cancels superseded runs natively per ref.
+# github.ref is unique per pull request (refs/pull/N/merge). github.head_ref
+# is only the branch name, so two fork PRs sharing a branch name would land in
+# the same group and cancel each other's checks.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  php:
+    name: PHP ${{ matrix.php }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+
+      # vendor/ holds bundled third-party libraries (Custom-Meta-Boxes, uix)
+      # that predate PHP 8 and are not ours to fix, so they stay out of scope.
+      - name: Lint PHP syntax
+        run: |
+          git ls-files '*.php' ':!:vendor/**' | xargs -r -n1 -P4 php -l
+
+  assets:
+    name: Built assets are current
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: '.nvmrc'
+          cache: npm
+
+      - run: npm ci
+
+      - name: Rebuild CSS and JS
+        run: npm run build
+
+      # The committed assets must match what the sources compile to, so a
+      # source-only change cannot ship stale output.
+      - name: Fail if the committed output is stale
+        run: |
+          # --exit-code only looks at tracked paths, so a newly generated
+          # asset would be invisible here. Porcelain status with
+          # --untracked-files=all catches added output too.
+          changes="$(git status --porcelain --untracked-files=all -- assets/css assets/js)"
+          test -z "$changes" || { printf '%s\n' "$changes"; exit 1; }

.gitignore

@@ -1,4 +1,5 @@
 node_modules
 .sass-cache
 .idea
+*.sublime-project
 *.sublime-workspace

.nvmrc

@@ -0,0 +1 @@
+24.20.0