feat: harden fiscal logic and repository governance

Author: TheStreamCode

.editorconfig

@@ -10,6 +10,11 @@ trim_trailing_whitespace = true
 indent_style = space
 indent_size = 2
 
-[*.{sh,bat,ps1}]
+[*.sh]
+indent_style = space
+indent_size = 2
+
+[*.{bat,cmd,ps1}]
+end_of_line = crlf
 indent_style = space
 indent_size = 2

.gitattributes

@@ -0,0 +1,13 @@
+* text=auto eol=lf
+
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.pdf binary

.github/CODEOWNERS

@@ -0,0 +1,6 @@
+* @TheStreamCode
+
+/src/lib/calculations/ @TheStreamCode
+/src/lib/fiscal-data.ts @TheStreamCode
+/docs/ADRs/ @TheStreamCode
+/.github/ @TheStreamCode

.github/ISSUE_TEMPLATE/config.yml

@@ -1,8 +1,8 @@
 blank_issues_enabled: false
 contact_links:
   - name: Security report
-    url: mailto:info@mikesoft.it?subject=EasyPIVA%20Security%20Report
-    about: Segnala vulnerabilità o problemi privacy seguendo SECURITY.md.
+    url: https://github.com/TheStreamCode/easypiva/security/advisories/new
+    about: Segnala privatamente vulnerabilità o problemi privacy seguendo SECURITY.md.
   - name: Contatto operativo
     url: mailto:info@mikesoft.it?subject=EasyPIVA%20Repository
     about: Usa questo canale per comunicazioni operative non legate alla sicurezza.

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '06:00'
+      timezone: Europe/Rome
+    open-pull-requests-limit: 0
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 0

.github/workflows/ci.yml

@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
-          node-version: 20
+          node-version-file: .nvmrc
           cache: npm
 
       - name: Install dependencies

.github/workflows/dependabot-auto-merge.yml

@@ -14,14 +14,9 @@ concurrency:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
-    # No actor filter. Skipping Dependabot made this a no-op: every dependency
-    # change in this repo comes from Dependabot, and because the job is a required
-    # status check, a `skipped` run *satisfies* it -- the gate reported green while
-    # reviewing nothing. On a public repository the dependency-review API is
-    # readable with the Dependabot token, so the job runs for those PRs too.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Dependency review
-        uses: actions/dependency-review-action@v5.0.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/dependency-review.yml

@@ -0,0 +1 @@
+24

.nvmrc

@@ -19,7 +19,7 @@ Install dependencies with `npm ci`. npm is the canonical package manager for thi
 
 ## Tech Stack
 
-- React 19, TypeScript 5, Vite 6.
+- React 19, React Router 8, TypeScript 6, Vite 6.
 - Tailwind CSS v4 with `@tailwindcss/vite`.
 - Base UI / shadcn-style primitives in `components/ui/`.
 - Zustand for local client state.
@@ -66,6 +66,7 @@ docs/              # Architecture, privacy, fiscal assumptions
 ## GitHub Repository Hygiene
 
 - Keep `.github/workflows/ci.yml`, `.github/dependabot.yml`, and `.github/workflows/dependency-review.yml` aligned with `package.json` scripts.
+- Keep Dependabot version updates disabled with `open-pull-requests-limit: 0`; security updates remain enabled and require maintainer review.
 - Update `docs/repository-governance.md` when repository settings, branch protection recommendations, or supply-chain policy change.
 - Use the PR template checklist for maintainer reviews.
 - Do not route security reports through public issues; follow `SECURITY.md`.