chore(ci): bump actions/dependency-review-action from 4 to 5 #13

	name: CI

	on:
	push:
	branches: [main, master]
	pull_request:

	permissions:
	contents: read

	jobs:
	test:
	name: Test (Node ${{ matrix.node }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	node: [18, 20, 22]
	steps:
	- uses: actions/checkout@v5
	- uses: actions/setup-node@v6
	with:
	node-version: ${{ matrix.node }}
	cache: npm
	- run: npm ci
	- run: npm test

	lint:
	name: Lint & format (Biome)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5
	- uses: actions/setup-node@v6
	with:
	node-version: 22
	cache: npm
	- run: npm ci
	- run: npm run check
	- run: npm run typecheck
	- run: npm audit --audit-level=critical

	shellcheck:
	name: ShellCheck
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5
	# Fail only on errors; the guards trip style/warning false-positives (e.g. SC2034 on
	# vars used cross-file via the sourced _guardlib.sh).
	- run: shellcheck --severity=error $(git ls-files '*.sh')

	no-runtime-deps:
	name: Assert zero runtime dependencies
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v5
	- run: node -e "process.exit(Object.keys(require('./package.json').dependencies\|\|{}).length)"
	- run: npm pack --dry-run

	dependency-review:
	name: Dependency review
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v5
	# Advisory: needs the repo's Dependency graph enabled (Settings → Security & analysis).
	# continue-on-error keeps the CHECK green until then — this project has zero runtime deps.
	- uses: actions/dependency-review-action@v5
	continue-on-error: true

Provide feedback