From 41a9fca8810e219624de1ce6028189bd9a8501fb Mon Sep 17 00:00:00 2001
From: Clyde Stubbs <2366188+clydebarrow@users.noreply.github.com>
Date: Sun, 11 Oct 2026 21:04:57 +1100
Subject: [PATCH] [ci] Reset sdkconfig after ESP-IDF component discovery
 (#20511)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
---
 esphome/espidf/toolchain.py               |  9 ++++++-
 tests/unit_tests/test_espidf_toolchain.py | 29 +++++++++++++++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/esphome/espidf/toolchain.py b/esphome/espidf/toolchain.py
index c09cb73f8c..5b32646e04 100644
--- a/esphome/espidf/toolchain.py
+++ b/esphome/espidf/toolchain.py
@@ -354,7 +354,11 @@ def _clean_foreign_target_tree() -> None:
     clean_build(clear_pio_cache=False)
     if os.environ.get("ESPHOME_SKIP_CLEAN_BUILD"):
         return
-    # Restart sdkconfig from ESPHome's options
+    _reset_sdkconfig()
+
+
+def _reset_sdkconfig() -> None:
+    """Restart the project sdkconfig from ESPHome's own options."""
     internal = CORE.relative_build_path(f"sdkconfig.{CORE.name}.esphomeinternal")
     if internal.is_file():
         shutil.copyfile(internal, CORE.relative_build_path(f"sdkconfig.{CORE.name}"))
@@ -659,6 +663,9 @@ def _configure_project(verbose: bool = False) -> int:
     if not discovered:
         _LOGGER.error("Component discovery found no built-in ESP-IDF components")
         return 1
+    # The discovery configure builds every IDF component, and their Kconfig
+    # selects (e.g. esp-tls turning TLS on) would otherwise stay in sdkconfig
+    _reset_sdkconfig()
     if (rc := _write_project_and_reconfigure(discovered, verbose)) != 0:
         _LOGGER.error("Reconfigure with discovered components failed")
         return rc
diff --git a/tests/unit_tests/test_espidf_toolchain.py b/tests/unit_tests/test_espidf_toolchain.py
index 202ddd970c..9f92106676 100644
--- a/tests/unit_tests/test_espidf_toolchain.py
+++ b/tests/unit_tests/test_espidf_toolchain.py
@@ -608,6 +608,35 @@ def test_run_compile_cache_miss_discovers_and_saves(setup_core: Path) -> None:
     ]
 
 
+def test_run_compile_discovery_resets_sdkconfig(setup_core: Path) -> None:
+    """Options the discovery configure forced on (e.g. esp-tls selecting TLS)
+    are dropped before the configure with the real component list."""
+    _setup_build(setup_core)
+    internal = CORE.relative_build_path("sdkconfig.test.esphomeinternal")
+    internal.parent.mkdir(parents=True)
+    internal.write_text("CONFIG_MBEDTLS_TLS_ENABLED=n\n")
+    sdkconfig = CORE.relative_build_path("sdkconfig.test")
+    seen: list[str] = []
+
+    def record_write(minimal: bool = False, builtin_components=None) -> None:
+        if minimal:
+            sdkconfig.write_text("CONFIG_MBEDTLS_TLS_ENABLED=y\n")
+        else:
+            seen.append(sdkconfig.read_text())
+
+    with (
+        patch.object(toolchain, "load_cached_builtin_components", return_value=None),
+        patch.object(toolchain, "save_cached_builtin_components"),
+        patch(
+            "esphome.build_gen.espidf.get_available_components", return_value=["lwip"]
+        ),
+        patch("esphome.build_gen.espidf.write_project", side_effect=record_write),
+        patch.object(toolchain, "run_reconfigure", return_value=0),
+    ):
+        assert toolchain._configure_project() == 0
+    assert seen == ["CONFIG_MBEDTLS_TLS_ENABLED=n\n"]
+
+
 def test_run_compile_discovery_failure_stops_before_full_write(
     setup_core: Path,
 ) -> None: