Merge remote-tracking branch 'origin/dev' into web-server-logs

# Conflicts: # esphome/__main__.py # tests/unit_tests/test_main.py
[core] Clarify resolve error when a device has no network log/OTA transport (#17107 )
2026-06-29 12:06:13 +00:00 · 2026-06-21 15:03:00 -05:00 · 2026-06-21 15:00:55 -05:00 · 2026-06-22 08:00:46 +12:00 · 2026-06-21 15:00:36 -05:00 · 2026-06-22 07:54:05 +12:00
8082 changed files with 354847 additions and 107855 deletions
@@ -5,24 +5,30 @@ Checks: >-
  -altera-*,
  -android-*,
  -boost-*,
+  -bugprone-derived-method-shadowing-base-method,
  -bugprone-easily-swappable-parameters,
  -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-invalid-enum-default-initialization,
  -bugprone-multi-level-implicit-pointer-conversion,
  -bugprone-narrowing-conversions,
+  -bugprone-tagged-union-member-count,
  -bugprone-signed-char-misuse,
  -bugprone-switch-missing-default-case,
  -cert-dcl50-cpp,
  -cert-err33-c,
  -cert-err58-cpp,
+  -cert-int09-c,
  -cert-oop57-cpp,
  -cert-str34-c,
  -clang-analyzer-optin.core.EnumCastOutOfRange,
  -clang-analyzer-optin.cplusplus.UninitializedObject,
  -clang-analyzer-osx.*,
+  -clang-analyzer-security.ArrayBound,
  -clang-diagnostic-delete-abstract-non-virtual-dtor,
  -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
  -clang-diagnostic-deprecated-declarations,
  -clang-diagnostic-ignored-optimization-argument,
+  -clang-diagnostic-missing-designated-field-initializers,
  -clang-diagnostic-missing-field-initializers,
  -clang-diagnostic-shadow-field,
  -clang-diagnostic-unused-const-variable,
@@ -42,6 +48,7 @@ Checks: >-
  -cppcoreguidelines-owning-memory,
  -cppcoreguidelines-prefer-member-initializer,
  -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
  -cppcoreguidelines-pro-bounds-constant-array-index,
  -cppcoreguidelines-pro-bounds-pointer-arithmetic,
  -cppcoreguidelines-pro-type-const-cast,
@@ -54,12 +61,13 @@ Checks: >-
  -cppcoreguidelines-rvalue-reference-param-not-moved,
  -cppcoreguidelines-special-member-functions,
  -cppcoreguidelines-use-default-member-init,
+  -cppcoreguidelines-use-enum-class,
  -cppcoreguidelines-virtual-class-destructor,
+  -fuchsia-default-arguments-calls,
+  -fuchsia-default-arguments-declarations,
  -fuchsia-multiple-inheritance,
  -fuchsia-overloaded-operator,
  -fuchsia-statically-constructed-objects,
-  -fuchsia-default-arguments-declarations,
-  -fuchsia-default-arguments-calls,
  -google-build-using-namespace,
  -google-explicit-constructor,
  -google-readability-braces-around-statements,
@@ -71,49 +79,63 @@ Checks: >-
  -llvm-else-after-return,
  -llvm-header-guard,
  -llvm-include-order,
+  -llvm-prefer-static-over-anonymous-namespace,
  -llvm-qualified-auto,
+  -llvm-use-ranges,
  -llvmlibc-*,
  -misc-const-correctness,
  -misc-include-cleaner,
+  -misc-multiple-inheritance,
  -misc-no-recursion,
  -misc-non-private-member-variables-in-classes,
+  -misc-override-with-different-visibility,
  -misc-unused-parameters,
  -misc-use-anonymous-namespace,
+  -misc-use-internal-linkage,
  -modernize-avoid-bind,
+  -modernize-avoid-variadic-functions,
  -modernize-avoid-c-arrays,
-  -modernize-concat-nested-namespaces,
+  -modernize-avoid-c-style-cast,
  -modernize-macro-to-enum,
  -modernize-return-braced-init-list,
  -modernize-type-traits,
  -modernize-use-auto,
  -modernize-use-constraints,
  -modernize-use-default-member-init,
+  -modernize-use-designated-initializers,
  -modernize-use-equals-default,
+  -modernize-use-integer-sign-comparison,
  -modernize-use-nodiscard,
  -modernize-use-nullptr,
-  -modernize-use-nodiscard,
-  -modernize-use-nullptr,
+  -modernize-use-ranges,
  -modernize-use-trailing-return-type,
  -mpi-*,
  -objc-*,
  -performance-enum-size,
+  -portability-avoid-pragma-once,
+  -portability-template-virtual-member-function,
+  -readability-ambiguous-smartptr-reset-call,
  -readability-avoid-nested-conditional-operator,
-  -readability-container-contains,
  -readability-container-data-pointer,
  -readability-convert-member-functions-to-static,
  -readability-else-after-return,
+  -readability-enum-initial-value,
  -readability-function-cognitive-complexity,
  -readability-implicit-bool-conversion,
  -readability-isolate-declaration,
  -readability-magic-numbers,
  -readability-make-member-function-const,
+  -readability-math-missing-parentheses,
  -readability-named-parameter,
  -readability-redundant-casting,
  -readability-redundant-inline-specifier,
  -readability-redundant-member-init,
-  -readability-redundant-string-init,
+  -readability-redundant-parentheses,
+  -readability-redundant-typename,
  -readability-uppercase-literal-suffix,
  -readability-use-anyofallof,
+  -readability-use-std-min-max,
+  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
 FormatStyle:     google
 CheckOptions:
@@ -0,0 +1,96 @@
+---
+name: pr-workflow
+description: Create pull requests for esphome. Use when creating PRs, submitting changes, or preparing contributions.
+allowed-tools: Read, Bash, Glob, Grep
+---
+
+# ESPHome PR Workflow
+
+When creating a pull request for esphome, follow these steps:
+
+## 1. Create Branch from Upstream
+
+Always base your branch on **upstream** (not origin/fork) to ensure you have the latest code:
+
+```bash
+git fetch upstream
+git checkout -b <branch-name> upstream/dev
+```
+
+## 2. Read the PR Template
+
+Before creating a PR, read `.github/PULL_REQUEST_TEMPLATE.md` to understand required fields.
+
+## 3. Create the PR
+
+Use `gh pr create` with the **full template** filled in. Never skip or abbreviate sections.
+
+Required fields:
+- **What does this implement/fix?**: Brief description of changes
+- **Types of changes**: Check ONE appropriate box (Bugfix, New feature, Breaking change, etc.)
+- **Related issue**: Use `fixes <link>` syntax if applicable
+- **Pull request in esphome.io**: Link if docs are needed
+- **Test Environment**: Check platforms you tested on
+- **Example config.yaml**: Include working example YAML
+- **Checklist**: Verify code is tested and tests added
+
+## 4. Example PR Body
+
+```markdown
+# What does this implement/fix?
+
+<describe your changes here>
+
+## Types of changes
+
+- [ ] Bugfix (non-breaking change which fixes an issue)
+- [x] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Developer breaking change (an API change that could break external components)
+- [ ] Code quality improvements to existing code or addition of tests
+- [ ] Other
+
+**Related issue or feature (if applicable):**
+
+- fixes https://github.com/esphome/esphome/issues/XXX
+
+**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**
+
+- esphome/esphome.io#XXX
+
+## Test Environment
+
+- [x] ESP32
+- [x] ESP32 IDF
+- [ ] ESP8266
+- [ ] RP2040
+- [ ] BK72xx
+- [ ] RTL87xx
+- [ ] LN882x
+- [ ] nRF52840
+
+## Example entry for `config.yaml`:
+
+```yaml
+# Example config.yaml
+component_name:
+  id: my_component
+  option: value
+```
+
+## Checklist:
+  - [x] The code change is tested and works locally.
+  - [x] Tests have been added to verify that the new code works (under `tests/` folder).
+
+If user exposed functionality or configuration variables are added/changed:
+  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
+```
+
+## 5. Push and Create PR
+
+```bash
+git push -u origin <branch-name>
+gh pr create --repo esphome/esphome --base dev --title "[component] Brief description"
+```
+
+Title should be prefixed with the component name in brackets, e.g. `[safe_mode] Add feature`.
@@ -1,4 +1,5 @@
 [run]
-omit = 
+omit =
    esphome/components/*
+    esphome/analyze_memory/*
    tests/integration/*
@@ -12,7 +12,7 @@
    "--privileged",
    "-e",
    "GIT_EDITOR=code --wait"
-    // uncomment and edit the path in order to pass though local USB serial to the conatiner
+    // uncomment and edit the path in order to pass through local USB serial to the container
    // , "--device=/dev/ttyACM0"
  ],
  "appPort": 6052,
@@ -115,4 +115,4 @@ examples/
 Dockerfile
 .git/
 tests/
-.*
+.?*
@@ -0,0 +1,92 @@
+name: Report an issue with ESPHome
+description: Report an issue with ESPHome.
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This issue form is for reporting bugs only!
+
+        If you have a feature request or enhancement, please [request them here instead][fr].
+
+        [fr]: https://github.com/orgs/esphome/discussions
+  - type: textarea
+    validations:
+      required: true
+    id: problem
+    attributes:
+      label: The problem
+      description: >-
+        Describe the issue you are experiencing here to communicate to the
+        maintainers. Tell us what you were trying to do and what happened.
+
+        Provide a clear and concise description of what the problem is.
+
+  - type: markdown
+    attributes:
+      value: |
+        ## Environment
+  - type: input
+    id: version
+    validations:
+      required: true
+    attributes:
+      label: Which version of ESPHome has the issue?
+      description: >
+        ESPHome version like 1.19, 2025.6.0 or 2025.XX.X-dev.
+  - type: dropdown
+    validations:
+      required: true
+    id: installation
+    attributes:
+      label: What type of installation are you using?
+      options:
+        - Home Assistant Add-on
+        - Docker
+        - pip
+  - type: dropdown
+    validations:
+      required: true
+    id: platform
+    attributes:
+      label: What platform are you using?
+      options:
+        - ESP8266
+        - ESP32
+        - RP2040
+        - BK72XX
+        - RTL87XX
+        - LN882X
+        - Host
+        - Other
+  - type: input
+    id: component_name
+    attributes:
+      label: Component causing the issue
+      description: >
+        The name of the component or platform. For example, api/i2c or ultrasonic.
+
+  - type: markdown
+    attributes:
+      value: |
+        # Details
+  - type: textarea
+    id: config
+    attributes:
+      label: YAML Config
+      description: |
+        Include a complete YAML configuration file demonstrating the problem here. Preferably post the *entire* file - don't make assumptions about what is unimportant. However, if it's a large or complicated config then you will need to reduce it to the smallest possible file *that still demonstrates the problem*. If you don't provide enough information to *easily* reproduce the problem, it's unlikely your bug report will get any attention. Logs do not belong here, attach them below.
+      render: yaml
+  - type: textarea
+    id: logs
+    attributes:
+      label: Anything in the logs that might be useful for us?
+      description: For example, error message, or stack traces. Serial or USB logs are much more useful than WiFi logs.
+      render: txt
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional information
+      description: >
+        If you have any additional information for us, use the field below.
+        Please note, you can attach screenshots or screen recordings here, by
+        dragging and dropping files in the field below.
@@ -1,15 +1,21 @@
 ---
 blank_issues_enabled: false
 contact_links:
-  - name: Issue Tracker
-    url: https://github.com/esphome/issues
-    about: Please create bug reports in the dedicated issue tracker.
-  - name: Feature Request Tracker
-    url: https://github.com/esphome/feature-requests
-    about: |
-      Please create feature requests in the dedicated feature request tracker.
+  - name: Report an issue with the ESPHome documentation
+    url: https://github.com/esphome/esphome.io/issues/new/choose
+    about: Report an issue with the ESPHome documentation.
+  - name: Report an issue with the ESPHome web server
+    url: https://github.com/esphome/esphome-webserver/issues/new/choose
+    about: Report an issue with the ESPHome web server.
+  - name: Report an issue with the ESPHome Builder / Dashboard
+    url: https://github.com/esphome/dashboard/issues/new/choose
+    about: Report an issue with the ESPHome Builder / Dashboard.
+  - name: Report an issue with the ESPHome API client
+    url: https://github.com/esphome/aioesphomeapi/issues/new/choose
+    about: Report an issue with the ESPHome API client.
+  - name: Make a Feature Request
+    url: https://github.com/orgs/esphome/discussions
+    about: Please create feature requests in the dedicated feature request tracker.
  - name: Frequently Asked Question
    url: https://esphome.io/guides/faq.html
-    about: |
-      Please view the FAQ for common questions and what
-      to include in a bug report.
+    about: Please view the FAQ for common questions and what to include in a bug report.
@@ -6,7 +6,9 @@

 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — [policy](https://developers.esphome.io/contributing/code/#what-constitutes-a-c-breaking-change)
+- [ ] Developer breaking change (an API change that could break external components) — [policy](https://developers.esphome.io/contributing/code/#what-is-considered-public-c-api)
+- [ ] Undocumented C++ API change (removal or change of undocumented public methods that lambda users may depend on) — [policy](https://developers.esphome.io/contributing/code/#c-user-expectations)
 - [ ] Code quality improvements to existing code or addition of tests
 - [ ] Other

@@ -14,18 +16,20 @@

 - fixes <link to issue>

-**Pull request in [esphome-docs](https://github.com/esphome/esphome-docs) with documentation (if applicable):**
+**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**

- esphome/esphome-docs#<esphome-docs PR number goes here>
+- esphome/esphome.io#<esphome.io PR number goes here>

 ## Test Environment

 - [ ] ESP32
 - [ ] ESP32 IDF
 - [ ] ESP8266
- [ ] RP2040
+- [ ] RP2040/RP2350
 - [ ] BK72xx
 - [ ] RTL87xx
+- [ ] LN882x
+- [ ] nRF52840

 ## Example entry for `config.yaml`:

@@ -39,4 +43,4 @@
  - [ ] Tests have been added to verify that the new code works (under `tests/` folder).

 If user exposed functionality or configuration variables are added/changed:
-  - [ ] Documentation added/updated in [esphome-docs](https://github.com/esphome/esphome-docs).
+  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
@@ -15,11 +15,6 @@ inputs:
    description: "Version to build"
    required: true
    example: "2023.12.0"
-  base_os:
-    description: "Base OS to use"
-    required: false
-    default: "debian"
-    example: "debian"
 runs:
  using: "composite"
  steps:
@@ -47,7 +42,7 @@ runs:

    - name: Build and push to ghcr by digest
      id: build-ghcr
-      uses: docker/build-push-action@v6.18.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      env:
        DOCKER_BUILD_SUMMARY: false
        DOCKER_BUILD_RECORD_UPLOAD: false
@@ -60,7 +55,6 @@ runs:
        build-args: |
          BUILD_TYPE=${{ inputs.build_type }}
          BUILD_VERSION=${{ inputs.version }}
-          BUILD_OS=${{ inputs.base_os }}
        outputs: |
          type=image,name=ghcr.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true

@@ -73,7 +67,7 @@ runs:

    - name: Build and push to dockerhub by digest
      id: build-dockerhub
-      uses: docker/build-push-action@v6.18.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
      env:
        DOCKER_BUILD_SUMMARY: false
        DOCKER_BUILD_RECORD_UPLOAD: false
@@ -86,7 +80,6 @@ runs:
        build-args: |
          BUILD_TYPE=${{ inputs.build_type }}
          BUILD_VERSION=${{ inputs.version }}
-          BUILD_OS=${{ inputs.base_os }}
        outputs: |
          type=image,name=docker.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true

@@ -0,0 +1,52 @@
+name: Cache ESP-IDF
+description: >
+  Resolve the pinned ESP-IDF version and cache the native ESP-IDF install
+  (toolchains + source) at ~/.esphome-idf. Every job that installs ESP-IDF
+  natively (clang-tidy for IDF/Arduino and the component test batches) shares
+  one cache, since the install is identical (ESPHOME_IDF_DEFAULT_TARGETS
+  defaults to "all", so all toolchains are present regardless of the chip).
+  Callers must set env ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf and have the
+  Python venv already restored.
+inputs:
+  framework:
+    description: 'Which pinned IDF version to key on: "espidf" (recommended) or "arduino".'
+    default: espidf
+  restore-only:
+    description: >
+      When "true", only restore -- never save the cache, even on dev. Use from
+      jobs that may not produce an ESP-IDF install (e.g. a component batch with
+      no esp32 target), so a partial/empty install is never written to the key.
+    default: "false"
+runs:
+  using: composite
+  steps:
+    - name: Resolve ESP-IDF version for cache key
+      # The native-IDF version is pinned in code, not in any file that feeds the
+      # other cache keys, so resolve it explicitly. Keying on it means the cache
+      # invalidates on a version bump (actions/cache never overwrites a key).
+      id: version
+      shell: bash
+      run: |
+        . venv/bin/activate
+        if [ "${{ inputs.framework }}" = "arduino" ]; then
+          version=$(python -c 'from esphome.components.esp32 import ARDUINO_FRAMEWORK_VERSION_LOOKUP as A, ARDUINO_IDF_VERSION_LOOKUP as L; print(L[A["recommended"]])')
+        else
+          version=$(python -c 'from esphome.components.esp32 import ESP_IDF_FRAMEWORK_VERSION_LOOKUP as L; print(L["recommended"])')
+        fi
+        echo "version=$version" >> "$GITHUB_OUTPUT"
+    # Mirror the adjacent PlatformIO cache: only dev-branch runs write the
+    # shared cache (so it lives in the default-branch scope readable by all
+    # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
+    # their own scope / the repo quota (e.g. on a version-bump PR).
+    - name: Cache ESP-IDF install (write on dev)
+      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.esphome-idf
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
+    - name: Cache ESP-IDF install (restore-only off dev)
+      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      with:
+        path: ~/.esphome-idf
+        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}
@@ -17,16 +17,28 @@ runs:
  steps:
    - name: Set up Python ${{ inputs.python-version }}
      id: python
-      uses: actions/setup-python@v5.6.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
      with:
        python-version: ${{ inputs.python-version }}
    - name: Restore Python virtual environment
      id: cache-venv
-      uses: actions/cache/restore@v4.2.3
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
      with:
        path: venv
        # yamllint disable-line rule:line-length
        key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ inputs.cache-key }}
+    - name: Set up uv
+      # Only needed on cache miss to populate the venv. ``uv pip install``
+      # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
+      # downstream jobs rely on is preserved.
+      if: steps.cache-venv.outputs.cache-hit != 'true'
+      uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+      with:
+        enable-cache: true
+        # Pin uv version so the action does not have to fetch the
+        # manifest from raw.githubusercontent.com on every cache
+        # miss; that fetch flakes on Windows runners.
+        version: "0.11.15"
    - name: Create Python virtual environment
      if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os != 'Windows'
      shell: bash
@@ -34,14 +46,14 @@ runs:
        python -m venv venv
        source venv/bin/activate
        python --version
-        pip install -r requirements.txt -r requirements_test.txt
-        pip install -e .
+        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -e .
    - name: Create Python virtual environment
      if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
      shell: bash
      run: |
        python -m venv venv
-        ./venv/Scripts/activate
+        source ./venv/Scripts/activate
        python --version
-        pip install -r requirements.txt -r requirements_test.txt
-        pip install -e .
+        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -e .
@@ -0,0 +1 @@
+../AGENTS.md
@@ -5,10 +5,14 @@ updates:
    directory: "/"
    schedule:
      interval: daily
+    open-pull-requests-limit: 10
    ignore:
      # Hypotehsis is only used for testing and is updated quite often
      - dependency-name: hypothesis
  - package-ecosystem: github-actions
+    labels:
+      - "dependencies"
+      - "github-actions"
    directory: "/"
    schedule:
      interval: daily
@@ -20,11 +24,17 @@ updates:
          - "docker/login-action"
          - "docker/setup-buildx-action"
  - package-ecosystem: github-actions
+    labels:
+      - "dependencies"
+      - "github-actions"
    directory: "/.github/actions/build-image"
    schedule:
      interval: daily
    open-pull-requests-limit: 10
  - package-ecosystem: github-actions
+    labels:
+      - "dependencies"
+      - "github-actions"
    directory: "/.github/actions/restore-python"
    schedule:
      interval: daily
@@ -0,0 +1,44 @@
+// Constants and markers for PR auto-labeling
+module.exports = {
+  BOT_COMMENT_MARKER: '<!-- auto-label-pr-bot -->',
+  CODEOWNERS_MARKER: '<!-- codeowners-request -->',
+  TOO_BIG_MARKER: '<!-- too-big-request -->',
+  DEPRECATED_COMPONENT_MARKER: '<!-- deprecated-component-request -->',
+  ORG_FORK_MARKER: '<!-- maintainer-access-warning -->',
+
+  MANAGED_LABELS: [
+    'new-component',
+    'new-platform',
+    'new-target-platform',
+    'merging-to-release',
+    'merging-to-beta',
+    'chained-pr',
+    'core',
+    'small-pr',
+    'medium-pr',
+    'dashboard',
+    'github-actions',
+    'by-code-owner',
+    'has-tests',
+    'needs-tests',
+    'needs-docs',
+    'needs-codeowners',
+    'too-big',
+    'labeller-recheck',
+    'bugfix',
+    'new-feature',
+    'breaking-change',
+    'developer-breaking-change',
+    'undocumented-api-change',
+    'code-quality',
+    'deprecated-component'
+  ],
+
+  DOCS_PR_PATTERNS: [
+    /https:\/\/github\.com\/esphome\/esphome\.io\/pull\/\d+/,
+    /esphome\/esphome\.io#\d+/,
+    // Keep matching the old esphome-docs name during the transition period
+    /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
+    /esphome\/esphome-docs#\d+/
+  ]
+};
@@ -0,0 +1,403 @@
+const { DOCS_PR_PATTERNS } = require('./constants');
+const {
+  COMPONENT_REGEX,
+  detectComponents,
+  hasCoreChanges,
+  hasDashboardChanges,
+  hasGitHubActionsChanges,
+} = require('../detect-tags');
+const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
+
+// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
+// Ruff/Black enforce exactly one space around `=` and no space before `:`,
+// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
+const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
+
+// Fetch a file's contents from the PR head SHA via the GitHub API.
+// The auto-label workflow runs on `pull_request_target`, which checks out the
+// base branch — files added by the PR don't exist in the workspace, so we have
+// to fetch them from the head SHA. Returns null if the file can't be fetched.
+async function fetchPrFileContent(github, context, path) {
+  try {
+    const { owner, repo } = context.repo;
+    const { data } = await github.rest.repos.getContent({
+      owner,
+      repo,
+      path,
+      ref: context.payload.pull_request.head.sha,
+    });
+    return Buffer.from(data.content, 'base64').toString('utf8');
+  } catch (error) {
+    console.log(`Failed to fetch ${path} from PR head:`, error.message);
+    return null;
+  }
+}
+
+// Strategy: Merge branch detection
+async function detectMergeBranch(context) {
+  const labels = new Set();
+  const baseRef = context.payload.pull_request.base.ref;
+
+  if (baseRef === 'release') {
+    labels.add('merging-to-release');
+  } else if (baseRef === 'beta') {
+    labels.add('merging-to-beta');
+  } else if (baseRef !== 'dev') {
+    labels.add('chained-pr');
+  }
+
+  return labels;
+}
+
+// Strategy: Component and platform labeling
+async function detectComponentPlatforms(changedFiles, apiData) {
+  const labels = new Set();
+  const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
+
+  for (const comp of detectComponents(changedFiles)) {
+    labels.add(`component: ${comp}`);
+  }
+
+  for (const file of changedFiles) {
+    const platformMatch = file.match(targetPlatformRegex);
+    if (platformMatch) {
+      labels.add(`platform: ${platformMatch[1]}`);
+    }
+  }
+
+  return labels;
+}
+
+// Strategy: New component detection
+async function detectNewComponents(github, context, prFiles) {
+  const labels = new Set();
+  let hasYamlLoadable = false;
+  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+  for (const file of addedFiles) {
+    const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
+    if (!componentMatch) continue;
+
+    labels.add('new-component');
+    const content = await fetchPrFileContent(github, context, file);
+    if (content === null) {
+      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+      hasYamlLoadable = true;
+      continue;
+    }
+    if (content.includes('IS_TARGET_PLATFORM = True')) {
+      labels.add('new-target-platform');
+    }
+    if (CONFIG_SCHEMA_REGEX.test(content)) {
+      hasYamlLoadable = true;
+    }
+  }
+
+  return { labels, hasYamlLoadable };
+}
+
+// Strategy: New platform detection
+async function detectNewPlatforms(github, context, prFiles, apiData) {
+  const labels = new Set();
+  let hasYamlLoadable = false;
+  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+  const platformPathPatterns = [
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
+  ];
+
+  const removedFiles = new Set(prFiles.filter(file => file.status === 'removed').map(file => file.filename));
+
+  for (const file of addedFiles) {
+    for (const re of platformPathPatterns) {
+      const match = file.match(re);
+      if (!match) continue;
+      const platform = match[2];
+      if (!apiData.platformComponents.includes(platform)) break;
+
+      // Skip if this is a restructure between flat and subdirectory forms (either direction):
+      //   <component>/<platform>.py  <->  <component>/<platform>/__init__.py
+      const flatEquivalent = `esphome/components/${match[1]}/${platform}.py`;
+      const subdirEquivalent = `esphome/components/${match[1]}/${platform}/__init__.py`;
+      if (removedFiles.has(flatEquivalent) || removedFiles.has(subdirEquivalent)) break;
+
+      labels.add('new-platform');
+      const content = await fetchPrFileContent(github, context, file);
+      if (content === null) {
+        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+        hasYamlLoadable = true;
+      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
+        hasYamlLoadable = true;
+      }
+      break;
+    }
+  }
+
+  return { labels, hasYamlLoadable };
+}
+
+// Strategy: Core files detection
+async function detectCoreChanges(changedFiles) {
+  const labels = new Set();
+  if (hasCoreChanges(changedFiles)) {
+    labels.add('core');
+  }
+  return labels;
+}
+
+// Strategy: PR size detection
+async function detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD) {
+  const labels = new Set();
+
+  if (totalChanges <= SMALL_PR_THRESHOLD) {
+    labels.add('small-pr');
+    return labels;
+  }
+
+  if (totalChanges <= MEDIUM_PR_THRESHOLD) {
+    labels.add('medium-pr');
+    return labels;
+  }
+
+  const testAdditions = prFiles
+    .filter(file => file.filename.startsWith('tests/'))
+    .reduce((sum, file) => sum + (file.additions || 0), 0);
+  const testDeletions = prFiles
+    .filter(file => file.filename.startsWith('tests/'))
+    .reduce((sum, file) => sum + (file.deletions || 0), 0);
+
+  const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
+
+  // Don't add too-big if mega-pr label is already present
+  if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
+    labels.add('too-big');
+  }
+
+  return labels;
+}
+
+// Strategy: Dashboard changes
+async function detectDashboardChanges(changedFiles) {
+  const labels = new Set();
+  if (hasDashboardChanges(changedFiles)) {
+    labels.add('dashboard');
+  }
+  return labels;
+}
+
+// Strategy: GitHub Actions changes
+async function detectGitHubActionsChanges(changedFiles) {
+  const labels = new Set();
+  if (hasGitHubActionsChanges(changedFiles)) {
+    labels.add('github-actions');
+  }
+  return labels;
+}
+
+// Strategy: Code owner detection
+async function detectCodeOwner(github, context, changedFiles) {
+  const labels = new Set();
+
+  try {
+    const codeownersPatterns = loadCodeowners();
+    const prAuthor = context.payload.pull_request.user.login;
+
+    // Check if PR author is a codeowner of any changed file
+    const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+    if (effective.users.has(prAuthor)) {
+      labels.add('by-code-owner');
+    }
+  } catch (error) {
+    console.log('Failed to read or parse CODEOWNERS file:', error.message);
+  }
+
+  return labels;
+}
+
+// Strategy: Test detection
+async function detectTests(changedFiles) {
+  const labels = new Set();
+  const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
+
+  if (testFiles.length > 0) {
+    labels.add('has-tests');
+  }
+
+  return labels;
+}
+
+// Strategy: PR Template Checkbox detection
+async function detectPRTemplateCheckboxes(context) {
+  const labels = new Set();
+  const prBody = context.payload.pull_request.body || '';
+
+  console.log('Checking PR template checkboxes...');
+
+  // Check for checked checkboxes in the "Types of changes" section
+  const checkboxPatterns = [
+    { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
+    { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
+    { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
+    { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
+    { pattern: /- \[x\] Undocumented C\+\+ API change \(removal or change of undocumented public methods that lambda users may depend on\)/i, label: 'undocumented-api-change' },
+    { pattern: /- \[x\] Code quality improvements to existing code or addition of tests/i, label: 'code-quality' }
+  ];
+
+  for (const { pattern, label } of checkboxPatterns) {
+    if (pattern.test(prBody)) {
+      console.log(`Found checked checkbox for: ${label}`);
+      labels.add(label);
+    }
+  }
+
+  return labels;
+}
+
+// Strategy: Deprecated component detection
+async function detectDeprecatedComponents(github, context, changedFiles) {
+  const labels = new Set();
+  const deprecatedInfo = [];
+  const { owner, repo } = context.repo;
+
+  // Compile regex once for better performance
+  const componentFileRegex = COMPONENT_REGEX;
+
+  // Get files that are modified or added in components directory
+  const componentFiles = changedFiles.filter(file => componentFileRegex.test(file));
+
+  if (componentFiles.length === 0) {
+    return { labels, deprecatedInfo };
+  }
+
+  // Extract unique component names using the same regex
+  const components = new Set();
+  for (const file of componentFiles) {
+    const match = file.match(componentFileRegex);
+    if (match) {
+      components.add(match[1]);
+    }
+  }
+
+  // Get base branch ref to check if deprecation already exists for the component
+  // This prevents flagging a PR that simply adds deprecation
+  const baseRef = context.payload.pull_request.base.ref;
+
+  // Check each component's __init__.py for DEPRECATED_COMPONENT constant
+  for (const component of components) {
+    const initFile = `esphome/components/${component}/__init__.py`;
+    try {
+      // Fetch file content from base branch using GitHub API
+      const { data: fileData } = await github.rest.repos.getContent({
+        owner,
+        repo,
+        path: initFile,
+        ref: baseRef
+      });
+
+      // Decode base64 content
+      const content = Buffer.from(fileData.content, 'base64').toString('utf8');
+
+      // Look for DEPRECATED_COMPONENT = "message" or DEPRECATED_COMPONENT = 'message'
+      // Support single quotes, double quotes, and triple quotes (for multiline)
+      const doubleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*"""([\s\S]*?)"""/s) ||
+                              content.match(/DEPRECATED_COMPONENT\s*=\s*"((?:[^"\\]|\\.)*)"/);
+      const singleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*'''([\s\S]*?)'''/s) ||
+                              content.match(/DEPRECATED_COMPONENT\s*=\s*'((?:[^'\\]|\\.)*)'/);
+      const deprecatedMatch = doubleQuoteMatch || singleQuoteMatch;
+
+      if (deprecatedMatch) {
+        labels.add('deprecated-component');
+        deprecatedInfo.push({
+          component: component,
+          message: deprecatedMatch[1].trim()
+        });
+        console.log(`Found deprecated component: ${component}`);
+      }
+    } catch (error) {
+      // Only log if it's not a simple "file not found" error (404)
+      if (error.status !== 404) {
+        console.log(`Error reading ${initFile}:`, error.message);
+      }
+    }
+  }
+
+  return { labels, deprecatedInfo };
+}
+
+// Strategy: Detect when maintainers cannot modify the PR branch
+function detectMaintainerAccess(context) {
+  const pr = context.payload.pull_request;
+
+  // Only relevant for cross-repo PRs (forks)
+  if (!pr.head.repo || pr.head.repo.full_name === pr.base.repo.full_name) {
+    return null;
+  }
+
+  if (pr.maintainer_can_modify) {
+    return null;
+  }
+
+  const isOrgFork = pr.head.repo.owner.type === 'Organization';
+  console.log(`Maintainer cannot modify PR branch (${isOrgFork ? 'org fork: ' + pr.head.repo.owner.login : 'user disabled'})`);
+  return { isOrgFork, orgName: pr.head.repo.owner.login };
+}
+
+// Strategy: Requirements detection
+async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
+  const labels = new Set();
+
+  // Check for missing tests
+  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) && !allLabels.has('has-tests')) {
+    labels.add('needs-tests');
+  }
+
+  // Check for missing docs.
+  // `new-feature` (PR-body checkbox) always counts. `new-component` / `new-platform`
+  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
+  // i.e. the new component/platform is actually loadable from YAML.
+  const docsEligible =
+    allLabels.has('new-feature') ||
+    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
+
+  if (docsEligible) {
+    const prBody = context.payload.pull_request.body || '';
+    const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
+
+    if (!hasDocsLink) {
+      labels.add('needs-docs');
+    }
+  }
+
+  // Check for missing CODEOWNERS
+  if (allLabels.has('new-component')) {
+    const codeownersModified = prFiles.some(file =>
+      file.filename === 'CODEOWNERS' &&
+      (file.status === 'modified' || file.status === 'added') &&
+      (file.additions || 0) > 0
+    );
+
+    if (!codeownersModified) {
+      labels.add('needs-codeowners');
+    }
+  }
+
+  return labels;
+}
+
+module.exports = {
+  detectMergeBranch,
+  detectComponentPlatforms,
+  detectNewComponents,
+  detectNewPlatforms,
+  detectCoreChanges,
+  detectPRSize,
+  detectDashboardChanges,
+  detectGitHubActionsChanges,
+  detectCodeOwner,
+  detectTests,
+  detectPRTemplateCheckboxes,
+  detectDeprecatedComponents,
+  detectMaintainerAccess,
+  detectRequirements
+};
@@ -0,0 +1,201 @@
+const { MANAGED_LABELS } = require('./constants');
+const {
+  detectMergeBranch,
+  detectComponentPlatforms,
+  detectNewComponents,
+  detectNewPlatforms,
+  detectCoreChanges,
+  detectPRSize,
+  detectDashboardChanges,
+  detectGitHubActionsChanges,
+  detectCodeOwner,
+  detectTests,
+  detectPRTemplateCheckboxes,
+  detectDeprecatedComponents,
+  detectMaintainerAccess,
+  detectRequirements
+} = require('./detectors');
+const { handleReviews, handleMaintainerAccessComment } = require('./reviews');
+const { applyLabels, removeOldLabels } = require('./labels');
+
+// Fetch API data
+async function fetchApiData() {
+  try {
+    const response = await fetch('https://data.esphome.io/components.json');
+    const componentsData = await response.json();
+    return {
+      targetPlatforms: componentsData.target_platforms || [],
+      platformComponents: componentsData.platform_components || []
+    };
+  } catch (error) {
+    console.log('Failed to fetch components data from API:', error.message);
+    return { targetPlatforms: [], platformComponents: [] };
+  }
+}
+
+module.exports = async ({ github, context }) => {
+  // Environment variables
+  const SMALL_PR_THRESHOLD = parseInt(process.env.SMALL_PR_THRESHOLD);
+  const MEDIUM_PR_THRESHOLD = parseInt(process.env.MEDIUM_PR_THRESHOLD);
+  const MAX_LABELS = parseInt(process.env.MAX_LABELS);
+  const TOO_BIG_THRESHOLD = parseInt(process.env.TOO_BIG_THRESHOLD);
+  const COMPONENT_LABEL_THRESHOLD = parseInt(process.env.COMPONENT_LABEL_THRESHOLD);
+
+  // Global state
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  // Get current labels and PR data
+  const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
+    owner,
+    repo,
+    issue_number: pr_number
+  });
+  const currentLabels = currentLabelsData.map(label => label.name);
+  const managedLabels = currentLabels.filter(label =>
+    label.startsWith('component: ') || MANAGED_LABELS.includes(label)
+  );
+
+  // Check for mega-PR early - if present, skip most automatic labeling
+  const isMegaPR = currentLabels.includes('mega-pr');
+
+  // Get all PR files with automatic pagination
+  const prFiles = await github.paginate(
+    github.rest.pulls.listFiles,
+    {
+      owner,
+      repo,
+      pull_number: pr_number
+    }
+  );
+
+  // Calculate data from PR files
+  const changedFiles = prFiles.map(file => file.filename);
+  const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
+  const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
+  const totalChanges = totalAdditions + totalDeletions;
+
+  console.log('Current labels:', currentLabels.join(', '));
+  console.log('Changed files:', changedFiles.length);
+  console.log('Total changes:', totalChanges);
+  if (isMegaPR) {
+    console.log('Mega-PR detected - applying limited labeling logic');
+  }
+
+  // Fetch API data
+  const apiData = await fetchApiData();
+  const baseRef = context.payload.pull_request.base.ref;
+
+  // Early exit for release and beta branches only
+  if (baseRef === 'release' || baseRef === 'beta') {
+    const branchLabels = await detectMergeBranch(context);
+    const finalLabels = Array.from(branchLabels);
+
+    console.log('Computed labels (merge branch only):', finalLabels.join(', '));
+
+    // Apply labels
+    await applyLabels(github, context, finalLabels);
+
+    // Remove old managed labels
+    await removeOldLabels(github, context, managedLabels, finalLabels);
+
+    return;
+  }
+
+  // Run all strategies
+  const [
+    branchLabels,
+    componentLabels,
+    newComponentResult,
+    newPlatformResult,
+    coreLabels,
+    sizeLabels,
+    dashboardLabels,
+    actionsLabels,
+    codeOwnerLabels,
+    testLabels,
+    checkboxLabels,
+    deprecatedResult,
+    maintainerAccess
+  ] = await Promise.all([
+    detectMergeBranch(context),
+    detectComponentPlatforms(changedFiles, apiData),
+    detectNewComponents(github, context, prFiles),
+    detectNewPlatforms(github, context, prFiles, apiData),
+    detectCoreChanges(changedFiles),
+    detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
+    detectDashboardChanges(changedFiles),
+    detectGitHubActionsChanges(changedFiles),
+    detectCodeOwner(github, context, changedFiles),
+    detectTests(changedFiles),
+    detectPRTemplateCheckboxes(context),
+    detectDeprecatedComponents(github, context, changedFiles),
+    detectMaintainerAccess(context)
+  ]);
+
+  // Extract new-component / new-platform results
+  const newComponentLabels = newComponentResult.labels;
+  const newPlatformLabels = newPlatformResult.labels;
+  // Eligible for needs-docs only if any newly added component or platform file
+  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
+  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
+
+  // Extract deprecated component info
+  const deprecatedLabels = deprecatedResult.labels;
+  const deprecatedInfo = deprecatedResult.deprecatedInfo;
+
+  // Combine all labels
+  const allLabels = new Set([
+    ...branchLabels,
+    ...componentLabels,
+    ...newComponentLabels,
+    ...newPlatformLabels,
+    ...coreLabels,
+    ...sizeLabels,
+    ...dashboardLabels,
+    ...actionsLabels,
+    ...codeOwnerLabels,
+    ...testLabels,
+    ...checkboxLabels,
+    ...deprecatedLabels
+  ]);
+
+  // Detect requirements based on all other labels
+  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
+  for (const label of requirementLabels) {
+    allLabels.add(label);
+  }
+
+  let finalLabels = Array.from(allLabels);
+
+  // For mega-PRs, exclude component labels if there are too many
+  if (isMegaPR) {
+    const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
+    if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
+      finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
+      console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
+    }
+  }
+
+  // Handle too many labels (only for non-mega PRs)
+  const tooManyLabels = finalLabels.length > MAX_LABELS;
+  const originalLabelCount = finalLabels.length;
+
+  if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
+    finalLabels = ['too-big'];
+  }
+
+  console.log('Computed labels:', finalLabels.join(', '));
+
+  // Handle reviews and org fork comment
+  await Promise.all([
+    handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD),
+    handleMaintainerAccessComment(github, context, maintainerAccess)
+  ]);
+
+  // Apply labels
+  await applyLabels(github, context, finalLabels);
+
+  // Remove old managed labels
+  await removeOldLabels(github, context, managedLabels, finalLabels);
+};
@@ -0,0 +1,41 @@
+// Apply labels to PR
+async function applyLabels(github, context, finalLabels) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  if (finalLabels.length > 0) {
+    console.log(`Adding labels: ${finalLabels.join(', ')}`);
+    await github.rest.issues.addLabels({
+      owner,
+      repo,
+      issue_number: pr_number,
+      labels: finalLabels
+    });
+  }
+}
+
+// Remove old managed labels
+async function removeOldLabels(github, context, managedLabels, finalLabels) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
+  for (const label of labelsToRemove) {
+    console.log(`Removing label: ${label}`);
+    try {
+      await github.rest.issues.removeLabel({
+        owner,
+        repo,
+        issue_number: pr_number,
+        name: label
+      });
+    } catch (error) {
+      console.log(`Failed to remove label ${label}:`, error.message);
+    }
+  }
+}
+
+module.exports = {
+  applyLabels,
+  removeOldLabels
+};
@@ -0,0 +1,7 @@
+{
+  "name": "auto-label-pr",
+  "private": true,
+  "scripts": {
+    "test": "node --test tests/*.test.js"
+  }
+}
@@ -0,0 +1,219 @@
+const {
+  BOT_COMMENT_MARKER,
+  CODEOWNERS_MARKER,
+  TOO_BIG_MARKER,
+  DEPRECATED_COMPONENT_MARKER,
+  ORG_FORK_MARKER
+} = require('./constants');
+
+// Generate review messages
+function generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD) {
+  const messages = [];
+
+  // Deprecated component message
+  if (finalLabels.includes('deprecated-component') && deprecatedInfo && deprecatedInfo.length > 0) {
+    let message = `${DEPRECATED_COMPONENT_MARKER}\n### ⚠️ Deprecated Component\n\n`;
+    message += `Hey there @${prAuthor},\n`;
+    message += `This PR modifies one or more deprecated components. Please be aware:\n\n`;
+
+    for (const info of deprecatedInfo) {
+      message += `#### Component: \`${info.component}\`\n`;
+      message += `${info.message}\n\n`;
+    }
+
+    message += `Consider migrating to the recommended alternative if applicable.`;
+
+    messages.push(message);
+  }
+
+  // Too big message
+  if (finalLabels.includes('too-big')) {
+    const testAdditions = prFiles
+      .filter(file => file.filename.startsWith('tests/'))
+      .reduce((sum, file) => sum + (file.additions || 0), 0);
+    const testDeletions = prFiles
+      .filter(file => file.filename.startsWith('tests/'))
+      .reduce((sum, file) => sum + (file.deletions || 0), 0);
+    const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
+
+    const tooManyLabels = originalLabelCount > MAX_LABELS;
+    const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
+
+    let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
+
+    message +=
+      `Hey @${prAuthor}, thanks for the contribution! Just a heads up, ` +
+      `this PR is on the large side `;
+
+    if (tooManyLabels && tooManyChanges) {
+      message +=
+        `(${nonTestChanges} line changes excluding tests, across ` +
+        `${originalLabelCount} different components/areas)`;
+    } else if (tooManyLabels) {
+      message +=
+        `(it touches ${originalLabelCount} different components/areas)`;
+    } else {
+      message += `(${nonTestChanges} line changes excluding tests)`;
+    }
+
+    message += `, which makes it harder for maintainers to review.\n\n`;
+    message +=
+      `Smaller, focused PRs tend to be reviewed much faster since they ` +
+      `fit into the short gaps between other maintainer work; large ones ` +
+      `often have to wait for a rare long uninterrupted block of time. ` +
+      `If you can break this up into smaller pieces that can be reviewed ` +
+      `independently, it will almost certainly land faster overall.\n\n`;
+    message +=
+      `Before putting more time in, it's also worth popping into ` +
+      `\`#devs\` on [Discord](https://esphome.io/chat) so we can help ` +
+      `you scope things and flag anything already in flight.\n\n`;
+    message +=
+      `For more details (including how to split the work up), see: ` +
+      `https://developers.esphome.io/contributing/submitting-your-work/` +
+      `#how-to-approach-large-submissions`;
+
+    messages.push(message);
+  }
+
+  // CODEOWNERS message
+  if (finalLabels.includes('needs-codeowners')) {
+    const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
+      `This way we can notify you if a bug report for this integration is reported.\n\n` +
+      `In \`__init__.py\` of the integration, please add:\n\n` +
+      `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
+      `And run \`script/build_codeowners.py\``;
+
+    messages.push(message);
+  }
+
+  return messages;
+}
+
+// Handle reviews
+async function handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+  const prAuthor = context.payload.pull_request.user.login;
+
+  const reviewMessages = generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD);
+  const hasReviewableLabels = finalLabels.some(label =>
+    ['too-big', 'needs-codeowners', 'deprecated-component'].includes(label)
+  );
+
+  const { data: reviews } = await github.rest.pulls.listReviews({
+    owner,
+    repo,
+    pull_number: pr_number
+  });
+
+  const botReviews = reviews.filter(review =>
+    review.user.type === 'Bot' &&
+    review.state === 'CHANGES_REQUESTED' &&
+    review.body && review.body.includes(BOT_COMMENT_MARKER)
+  );
+
+  if (hasReviewableLabels) {
+    const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
+
+    if (botReviews.length > 0) {
+      // Update existing review
+      await github.rest.pulls.updateReview({
+        owner,
+        repo,
+        pull_number: pr_number,
+        review_id: botReviews[0].id,
+        body: reviewBody
+      });
+      console.log('Updated existing bot review');
+    } else {
+      // Create new review
+      await github.rest.pulls.createReview({
+        owner,
+        repo,
+        pull_number: pr_number,
+        body: reviewBody,
+        event: 'REQUEST_CHANGES'
+      });
+      console.log('Created new bot review');
+    }
+  } else if (botReviews.length > 0) {
+    // Dismiss existing reviews
+    for (const review of botReviews) {
+      try {
+        await github.rest.pulls.dismissReview({
+          owner,
+          repo,
+          pull_number: pr_number,
+          review_id: review.id,
+          message: 'Review dismissed: All requirements have been met'
+        });
+        console.log(`Dismissed bot review ${review.id}`);
+      } catch (error) {
+        console.log(`Failed to dismiss review ${review.id}:`, error.message);
+      }
+    }
+  }
+}
+
+// Handle maintainer access warning comment
+async function handleMaintainerAccessComment(github, context, maintainerAccess) {
+  if (!maintainerAccess) {
+    return;
+  }
+
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+  const prAuthor = context.payload.pull_request.user.login;
+
+  // Check if we already posted the warning (iterate pages to exit early)
+  let existingComment;
+  for await (const { data: comments } of github.paginate.iterator(
+    github.rest.issues.listComments,
+    { owner, repo, issue_number: pr_number }
+  )) {
+    existingComment = comments.find(comment =>
+      comment.user.type === 'Bot' &&
+      comment.body && comment.body.includes(ORG_FORK_MARKER)
+    );
+    if (existingComment) {
+      break;
+    }
+  }
+
+  if (existingComment) {
+    console.log('Maintainer access warning comment already exists, skipping');
+    return;
+  }
+
+  let body;
+  if (maintainerAccess.isOrgFork) {
+    body = `${ORG_FORK_MARKER}\n### ⚠️ Organization Fork Detected\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `It looks like this PR was submitted from a fork owned by the **${maintainerAccess.orgName}** organization. ` +
+      `GitHub does not allow maintainers to push changes to pull request branches when the fork is owned by an organization. ` +
+      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
+      `To allow maintainer collaboration, please re-submit this PR from a personal fork instead.\n\n` +
+      `See: [Setting up the local repository](https://developers.esphome.io/contributing/development-environment/?h=org#set-up-the-local-repository) for more details.`;
+  } else {
+    body = `${ORG_FORK_MARKER}\n### ⚠️ Maintainer Access Disabled\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `It looks like this PR does not have the "Allow edits from maintainers" option enabled. ` +
+      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
+      `Please enable this option in the PR sidebar to allow maintainer collaboration.`;
+  }
+
+  await github.rest.issues.createComment({
+    owner,
+    repo,
+    issue_number: pr_number,
+    body
+  });
+  console.log('Created maintainer access warning comment');
+}
+
+module.exports = {
+  handleReviews,
+  handleMaintainerAccessComment
+};
@@ -0,0 +1,147 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { detectNewPlatforms, detectNewComponents } = require('../detectors');
+
+// Minimal GitHub API mock — only repos.getContent is called by detectNewPlatforms/detectNewComponents
+// to check for CONFIG_SCHEMA in newly added files.
+function makeGithub(content = '') {
+  return {
+    rest: {
+      repos: {
+        getContent: async () => ({
+          data: { content: Buffer.from(content).toString('base64') }
+        })
+      }
+    }
+  };
+}
+
+const CONTEXT = {
+  repo: { owner: 'esphome', repo: 'esphome' },
+  payload: { pull_request: { head: { sha: 'abc123' }, base: { ref: 'dev' } } }
+};
+
+const API_DATA = {
+  targetPlatforms: ['esp32', 'esp8266', 'rp2040'],
+  platformComponents: ['cover', 'sensor', 'binary_sensor', 'switch', 'light', 'fan', 'climate', 'valve']
+};
+
+const WITH_SCHEMA = 'CONFIG_SCHEMA = cv.Schema({})';
+const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';
+
+// ---------------------------------------------------------------------------
+// detectNewPlatforms
+// ---------------------------------------------------------------------------
+
+describe('detectNewPlatforms', () => {
+  describe('restructure detection (no false positives)', () => {
+    it('flat .py -> subdir __init__.py is not a new platform', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/endstop/cover.py', status: 'removed' },
+        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
+      ];
+      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
+      assert.equal(result.labels.size, 0);
+      assert.equal(result.hasYamlLoadable, false);
+    });
+
+    it('subdir __init__.py -> flat .py is not a new platform', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'removed' },
+        { filename: 'esphome/components/endstop/cover.py', status: 'added' },
+      ];
+      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
+      assert.equal(result.labels.size, 0);
+      assert.equal(result.hasYamlLoadable, false);
+    });
+  });
+
+  describe('genuine new platforms', () => {
+    it('new subdir platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/my_sensor/cover/__init__.py', status: 'added' },
+      ];
+      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
+      assert.ok(result.labels.has('new-platform'));
+      assert.equal(result.hasYamlLoadable, true);
+    });
+
+    it('new flat platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
+      ];
+      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
+      assert.ok(result.labels.has('new-platform'));
+      assert.equal(result.hasYamlLoadable, true);
+    });
+
+    it('new platform without CONFIG_SCHEMA sets new-platform but not hasYamlLoadable', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
+      ];
+      const result = await detectNewPlatforms(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles, API_DATA);
+      assert.ok(result.labels.has('new-platform'));
+      assert.equal(result.hasYamlLoadable, false);
+    });
+
+    it('non-platform file addition produces no labels', async () => {
+      const prFiles = [
+        { filename: 'esphome/components/my_sensor/sensor.py', status: 'added' },
+      ];
+      // Override platformComponents so 'sensor' is not a recognized platform -> no label expected.
+      const nonPlatformApiData = { ...API_DATA, platformComponents: ['cover'] };
+      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, nonPlatformApiData);
+      assert.equal(result.labels.size, 0);
+      assert.equal(result.hasYamlLoadable, false);
+    });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// detectNewComponents
+// ---------------------------------------------------------------------------
+
+describe('detectNewComponents', () => {
+  it('new top-level __init__.py sets new-component', async () => {
+    const prFiles = [
+      { filename: 'esphome/components/actuator/__init__.py', status: 'added', },
+    ];
+    const result = await detectNewComponents(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles);
+    assert.ok(result.labels.has('new-component'));
+    assert.equal(result.hasYamlLoadable, false);
+  });
+
+  it('new top-level __init__.py with CONFIG_SCHEMA sets hasYamlLoadable', async () => {
+    const prFiles = [
+      { filename: 'esphome/components/my_component/__init__.py', status: 'added' },
+    ];
+    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
+    assert.ok(result.labels.has('new-component'));
+    assert.equal(result.hasYamlLoadable, true);
+  });
+
+  it('new top-level __init__.py with IS_TARGET_PLATFORM sets new-target-platform', async () => {
+    const prFiles = [
+      { filename: 'esphome/components/my_platform/__init__.py', status: 'added' },
+    ];
+    const result = await detectNewComponents(makeGithub('IS_TARGET_PLATFORM = True'), CONTEXT, prFiles);
+    assert.ok(result.labels.has('new-component'));
+    assert.ok(result.labels.has('new-target-platform'));
+  });
+
+  it('modified __init__.py does not set new-component', async () => {
+    const prFiles = [
+      { filename: 'esphome/components/existing/__init__.py', status: 'modified' },
+    ];
+    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
+    assert.equal(result.labels.size, 0);
+  });
+
+  it('nested __init__.py does not set new-component', async () => {
+    const prFiles = [
+      { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
+    ];
+    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
+    assert.equal(result.labels.size, 0);
+  });
+});
@@ -0,0 +1,227 @@
+// Shared CODEOWNERS parsing and matching utilities.
+//
+// Used by:
+//   - codeowner-review-request.yml
+//   - codeowner-approved-label-update.yml
+//   - auto-label-pr/detectors.js (detectCodeOwner)
+
+/**
+ * Convert a CODEOWNERS glob pattern to a RegExp.
+ *
+ * Handles **, *, and ? wildcards after escaping regex-special characters.
+ */
+function globToRegex(pattern) {
+  let regexStr = pattern
+    .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
+    .replace(/\*\*/g, '\x00GLOBSTAR\x00')  // protect ** from next replace
+    .replace(/\*/g, '[^/]*')               // single star
+    .replace(/\x00GLOBSTAR\x00/g, '.*')    // restore globstar
+    .replace(/\?/g, '.');
+  return new RegExp('^' + regexStr + '$');
+}
+
+/**
+ * Parse raw CODEOWNERS file content into an array of
+ * { pattern, regex, owners } objects.
+ *
+ * Each `owners` entry is the raw string from the file (e.g. "@user" or
+ * "@esphome/core").
+ */
+function parseCodeowners(content) {
+  const lines = content
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line && !line.startsWith('#'));
+
+  const patterns = [];
+  for (const line of lines) {
+    const parts = line.split(/\s+/);
+    if (parts.length < 2) continue;
+
+    const pattern = parts[0];
+    const owners = parts.slice(1);
+    const regex = globToRegex(pattern);
+    patterns.push({ pattern, regex, owners });
+  }
+  return patterns;
+}
+
+/**
+ * Fetch and parse the CODEOWNERS file via the GitHub API.
+ *
+ * @param {object} github  - octokit instance from actions/github-script
+ * @param {string} owner   - repo owner
+ * @param {string} repo    - repo name
+ * @param {string} [ref]   - git ref (SHA / branch) to read from
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+async function fetchCodeowners(github, owner, repo, ref) {
+  const params = { owner, repo, path: 'CODEOWNERS' };
+  if (ref) params.ref = ref;
+
+  const { data: file } = await github.rest.repos.getContent(params);
+  const content = Buffer.from(file.content, 'base64').toString('utf8');
+  return parseCodeowners(content);
+}
+
+/**
+ * Classify raw owner strings into individual users and teams.
+ *
+ * @param {string[]} rawOwners - e.g. ["@user1", "@esphome/core"]
+ * @returns {{ users: string[], teams: string[] }}
+ *   users  – login names without "@"
+ *   teams  – team slugs without the "org/" prefix
+ */
+function classifyOwners(rawOwners) {
+  const users = [];
+  const teams = [];
+  for (const o of rawOwners) {
+    const clean = o.startsWith('@') ? o.slice(1) : o;
+    if (clean.includes('/')) {
+      teams.push(clean.split('/')[1]);
+    } else {
+      users.push(clean);
+    }
+  }
+  return { users, teams };
+}
+
+/**
+ * For each file, find its effective codeowners using GitHub's
+ * "last match wins" semantics, then union across all files.
+ *
+ * @param {string[]} files              - list of file paths
+ * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
+ * @returns {{ users: Set<string>, teams: Set<string>, matchedFileCount: number }}
+ */
+function getEffectiveOwners(files, codeownersPatterns) {
+  const users = new Set();
+  const teams = new Set();
+  let matchedFileCount = 0;
+
+  for (const file of files) {
+    // Last matching pattern wins for each file
+    let effectiveOwners = null;
+    for (const { regex, owners } of codeownersPatterns) {
+      if (regex.test(file)) {
+        effectiveOwners = owners;
+      }
+    }
+    if (effectiveOwners) {
+      matchedFileCount++;
+      const classified = classifyOwners(effectiveOwners);
+      for (const u of classified.users) users.add(u);
+      for (const t of classified.teams) teams.add(t);
+    }
+  }
+
+  return { users, teams, matchedFileCount };
+}
+
+/**
+ * Read and parse the CODEOWNERS file from disk.
+ *
+ * Use this when the repo is already checked out (avoids an API call).
+ *
+ * @param {string} [repoRoot='.'] - path to the repo root
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+function loadCodeowners(repoRoot = '.') {
+  const fs = require('fs');
+  const path = require('path');
+  const content = fs.readFileSync(path.join(repoRoot, 'CODEOWNERS'), 'utf8');
+  return parseCodeowners(content);
+}
+
+/** Possible label actions returned by determineLabelAction. */
+const LabelAction = Object.freeze({
+  ADD: 'add',
+  REMOVE: 'remove',
+  NONE: 'none',
+});
+
+/**
+ * Determine what label action is needed for a PR based on codeowner approvals.
+ *
+ * Checks changed files against CODEOWNERS patterns, reviews, and current labels
+ * to decide if the label should be added, removed, or left unchanged.
+ *
+ * @param {object} github              - octokit instance from actions/github-script
+ * @param {string} owner               - repo owner
+ * @param {string} repo                - repo name
+ * @param {number} pr_number           - pull request number
+ * @param {Array}  codeownersPatterns   - from loadCodeowners / fetchCodeowners
+ * @param {string} labelName           - label to manage
+ * @returns {Promise<LabelAction>}
+ */
+async function determineLabelAction(github, owner, repo, pr_number, codeownersPatterns, labelName) {
+  // Get the list of changed files in this PR
+  const prFiles = await github.paginate(
+    github.rest.pulls.listFiles,
+    { owner, repo, pull_number: pr_number }
+  );
+
+  const changedFiles = prFiles.map(file => file.filename);
+  console.log(`Found ${changedFiles.length} changed files`);
+
+  if (changedFiles.length === 0) {
+    console.log('No changed files found');
+    return LabelAction.NONE;
+  }
+
+  // Get effective owners using last-match-wins semantics
+  const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+  const componentCodeowners = effective.users;
+
+  console.log(`Component-specific codeowners: ${Array.from(componentCodeowners).join(', ') || '(none)'}`);
+
+  // Get current labels
+  const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+    owner, repo, issue_number: pr_number
+  });
+  const hasLabel = currentLabels.some(label => label.name === labelName);
+
+  if (componentCodeowners.size === 0) {
+    console.log('No component-specific codeowners found');
+    return hasLabel ? LabelAction.REMOVE : LabelAction.NONE;
+  }
+
+  // Get all reviews and find latest per user
+  const reviews = await github.paginate(
+    github.rest.pulls.listReviews,
+    { owner, repo, pull_number: pr_number }
+  );
+
+  const latestReviewByUser = new Map();
+  for (const review of reviews) {
+    if (!review.user || review.user.type === 'Bot' || review.state === 'COMMENTED') continue;
+    latestReviewByUser.set(review.user.login, review);
+  }
+
+  // Check if any component-specific codeowner has an active approval
+  let hasCodeownerApproval = false;
+  for (const [login, review] of latestReviewByUser) {
+    if (review.state === 'APPROVED' && componentCodeowners.has(login)) {
+      console.log(`Codeowner '${login}' has approved`);
+      hasCodeownerApproval = true;
+      break;
+    }
+  }
+
+  if (hasCodeownerApproval && !hasLabel) return LabelAction.ADD;
+  if (!hasCodeownerApproval && hasLabel) return LabelAction.REMOVE;
+
+  console.log(`Label already ${hasLabel ? 'present' : 'absent'}, no change needed`);
+  return LabelAction.NONE;
+}
+
+module.exports = {
+  globToRegex,
+  parseCodeowners,
+  fetchCodeowners,
+  loadCodeowners,
+  classifyOwners,
+  getEffectiveOwners,
+  LabelAction,
+  determineLabelAction
+};
@@ -0,0 +1,66 @@
+/**
+ * Shared tag detection from changed file paths.
+ * Used by pr-title-check and auto-label-pr workflows.
+ */
+
+const COMPONENT_REGEX = /^esphome\/components\/([^\/]+)\//;
+
+/**
+ * Detect component names from changed files.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {Set<string>} Set of component names
+ */
+function detectComponents(changedFiles) {
+  const components = new Set();
+  for (const file of changedFiles) {
+    const match = file.match(COMPONENT_REGEX);
+    if (match) {
+      components.add(match[1]);
+    }
+  }
+  return components;
+}
+
+/**
+ * Detect if core files were changed.
+ * Core files are in esphome/core/ or top-level esphome/ directory.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasCoreChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('esphome/core/') ||
+    (file.startsWith('esphome/') && file.split('/').length === 2)
+  );
+}
+
+/**
+ * Detect if dashboard files were changed.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasDashboardChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('esphome/dashboard/') ||
+    file.startsWith('esphome/components/dashboard_import/')
+  );
+}
+
+/**
+ * Detect if GitHub Actions files were changed.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasGitHubActionsChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('.github/workflows/')
+  );
+}
+
+module.exports = {
+  COMPONENT_REGEX,
+  detectComponents,
+  hasCoreChanges,
+  hasDashboardChanges,
+  hasGitHubActionsChanges,
+};
@@ -0,0 +1,46 @@
+name: Auto Label PR
+
+on:
+  # Runs only on pull_request_target due to having access to a App token.
+  # This means PRs from forks will not be able to alter this workflow to get the tokens
+  pull_request_target:
+    types: [labeled, opened, reopened, synchronize, edited]
+
+# All PR/label/review writes are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
+permissions:
+  contents: read  # actions/checkout reads the workflow source
+
+env:
+  SMALL_PR_THRESHOLD: 30
+  MEDIUM_PR_THRESHOLD: 100
+  MAX_LABELS: 15
+  TOO_BIG_THRESHOLD: 1000
+  COMPONENT_LABEL_THRESHOLD: 10
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
+          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
+          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
+          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
+
+      - name: Auto Label PR
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const script = require('./.github/scripts/auto-label-pr/index.js');
+            await script({ github, context });
@@ -12,8 +12,8 @@ on:
      - ".github/workflows/ci-api-proto.yml"

 permissions:
-  contents: read
-  pull-requests: write
+  contents: read        # actions/checkout for the PR head
+  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale

 jobs:
  check:
@@ -21,11 +21,21 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up Python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
+      - name: Set up uv
+        # ``--system`` (below) installs into the setup-python interpreter;
+        # no venv is created or restored by this workflow.
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"

      - name: Install apt dependencies
        run: |
@@ -34,7 +44,7 @@ jobs:
          sudo apt install -y protobuf-compiler
          protoc --version
      - name: Install python dependencies
-        run: pip install aioesphomeapi -c requirements.txt -r requirements_dev.txt
+        run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt
      - name: Generate files
        run: script/api_protobuf/api_protobuf.py
      - name: Check for changes
@@ -47,7 +57,7 @@ jobs:
          fi
      - if: failure()
        name: Review PR
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.pulls.createReview({
@@ -62,7 +72,7 @@ jobs:
        run: git diff
      - if: failure()
        name: Archive artifacts
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: generated-proto-files
          path: |
@@ -70,7 +80,7 @@ jobs:
            esphome/components/api/api_pb2_service.*
      - if: success()
        name: Dismiss review
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            let reviews = await github.rest.pulls.listReviews({
@@ -1,29 +1,41 @@
 ---
 name: CI for docker images

-# Only run when docker paths change
+# Only run on PRs that touch the docker image, its build inputs, or any code
+# whose toolchain the compile smoke test exercises (core + target platforms).

 on:
-  push:
-    branches: [dev, beta, release]
-    paths:
-      - "docker/**"
-      - ".github/workflows/ci-docker.yml"
-      - "requirements*.txt"
-      - "platformio.ini"
-      - "script/platformio_install_deps.py"
-
  pull_request:
    paths:
+      # Docker image and its build inputs.
      - "docker/**"
      - ".github/workflows/ci-docker.yml"
      - "requirements*.txt"
+      - "pyproject.toml"
      - "platformio.ini"
+      - "esphome/idf_component.yml"
      - "script/platformio_install_deps.py"
+      # Core, build pipeline, toolchain, and target-platform changes can change
+      # how a toolchain is set up or built, so re-run the per-toolchain compile
+      # smoke test when they change.
+      - "esphome/core/**"
+      - "esphome/writer.py"
+      - "esphome/build_gen/**"
+      - "esphome/espidf/**"
+      - "esphome/platformio/**"
+      - "esphome/components/bk72xx/**"
+      - "esphome/components/esp32/**"
+      - "esphome/components/esp8266/**"
+      - "esphome/components/host/**"
+      - "esphome/components/libretiny/**"
+      - "esphome/components/ln882x/**"
+      - "esphome/components/nrf52/**"
+      - "esphome/components/rp2040/**"
+      - "esphome/components/rtl87xx/**"
+      - "esphome/components/zephyr/**"

 permissions:
-  contents: read
-  packages: read
+  contents: read  # actions/checkout only

 concurrency:
  # yamllint disable-line rule:line-length
@@ -34,6 +46,9 @@ jobs:
  check-docker:
    name: Build docker containers
    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # push branch-tagged images to ghcr.io for local testing
    strategy:
      fail-fast: false
      matrix:
@@ -42,23 +57,161 @@ jobs:
          - "ha-addon"
          - "docker"
          # - "lint"
+    outputs:
+      tag: ${{ steps.tag.outputs.tag }}
+      push: ${{ steps.tag.outputs.push }}
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up Python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          python-version: "3.10"
+          python-version: "3.11"
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

-      - name: Set TAG
+      - name: Determine tag and whether to push
+        id: tag
        run: |
-          echo "TAG=check" >> $GITHUB_ENV
+          # Sanitize the branch name into a valid docker tag: replace invalid
+          # characters, ensure the first character is valid (tags must start
+          # with [A-Za-z0-9_]), and cap the length at 128 characters.
+          branch="${{ github.head_ref || github.ref_name }}"
+          tag="${branch//[^a-zA-Z0-9_.-]/-}"
+          case "$tag" in
+            [a-zA-Z0-9_]*) ;;
+            *) tag="pr-${tag}" ;;
+          esac
+          tag="${tag:0:128}"
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+          # Only push branch images for same-repo pull requests. Push events
+          # only fire for dev/beta/release, whose images are owned by the
+          # release pipeline -- never overwrite those from here.
+          if [ "${{ github.event_name }}" = "pull_request" ] \
+            && [ "${{ github.repository }}" = "esphome/esphome" ] \
+            && [ "${{ github.event.pull_request.head.repo.full_name }}" = "esphome/esphome" ]; then
+            echo "push=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "push=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Log in to the GitHub container registry
+        if: steps.tag.outputs.push == 'true'
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run build
        run: |
          docker/build.py \
-            --tag "${TAG}" \
+            --tag "${{ steps.tag.outputs.tag }}" \
            --arch "${{ matrix.os == 'ubuntu-24.04-arm' && 'aarch64' || 'amd64' }}" \
            --build-type "${{ matrix.build_type }}" \
-            build
+            --registry ghcr \
+            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }} ${{ (matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker') && '--load' || '' }}
+
+      # The amd64 "docker" image is also loaded locally (above) and handed to
+      # compile-test as an artifact, so the smoke test reuses this build instead
+      # of building the image a second time. Using an artifact (rather than the
+      # pushed image) keeps it working for fork PRs, which never push to ghcr.io.
+      - name: Export image for compile-test
+        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
+        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | gzip > compile-test-image.tar.gz
+
+      - name: Upload compile-test image artifact
+        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          # The tar is already gzipped, so upload it as-is. archive: false skips
+          # the redundant zip and makes the file name the artifact name (the
+          # `name` input is ignored in that mode).
+          path: compile-test-image.tar.gz
+          retention-days: 1
+          archive: false
+
+  manifest:
+    name: Push ${{ matrix.build_type }} manifest to ghcr.io
+    needs: [check-docker]
+    if: needs.check-docker.outputs.push == 'true'
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read   # actions/checkout to run docker/build.py
+      packages: write  # buildx imagetools writes the multi-arch tag to ghcr.io
+    strategy:
+      fail-fast: false
+      matrix:
+        build_type:
+          - "ha-addon"
+          - "docker"
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.11"
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
+      - name: Log in to the GitHub container registry
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create and push manifest
+        run: |
+          docker/build.py \
+            --tag "${{ needs.check-docker.outputs.tag }}" \
+            --build-type "${{ matrix.build_type }}" \
+            --registry ghcr \
+            manifest
+
+  # Smoke-test the built image by compiling one minimal config per target
+  # platform / toolchain. This catches missing system dependencies in the image
+  # that only surface when a given toolchain is downloaded and run. The image is
+  # the amd64 "docker" build produced by check-docker (shared as an artifact).
+  compile-test:
+    name: Compile ${{ matrix.id }}
+    needs: check-docker
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read  # actions/checkout to load the test configs
+    strategy:
+      fail-fast: false
+      # Cap concurrency so this smoke test doesn't hog all the shared runners.
+      max-parallel: 2
+      matrix:
+        # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
+        # share a toolchain bundle, so esp32 is exercised on the base variant
+        # across the full framework x toolchain cross-product (arduino/esp-idf
+        # framework, each built with the platformio and native esp-idf
+        # toolchains) so both toolchains stay covered regardless of which one is
+        # the default.
+        id:
+          - esp8266-arduino
+          - esp32-arduino-platformio
+          - esp32-arduino-esp-idf
+          - esp32-idf-platformio
+          - esp32-idf-esp-idf
+          - rp2040-arduino
+          - bk72xx-arduino
+          - rtl87xx-arduino
+          - ln882x-arduino
+          - nrf52
+          - host
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Download image artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: compile-test-image.tar.gz
+      - name: Load image
+        run: docker load --input compile-test-image.tar.gz
+      - name: Compile ${{ matrix.id }}
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}/docker/test_configs:/config" \
+            "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
+            compile "${{ matrix.id }}.yaml"
@@ -0,0 +1,27 @@
+name: CI - GitHub Scripts
+
+on:
+  push:
+    branches: [dev, beta, release]
+    paths:
+      - ".github/scripts/**"
+      - ".github/workflows/ci-github-scripts.yml"
+  pull_request:
+    paths:
+      - ".github/scripts/**"
+      - ".github/workflows/ci-github-scripts.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  test-auto-label-pr:
+    name: Test auto-label-pr scripts
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Run tests
+        working-directory: .github/scripts/auto-label-pr
+        run: npm test
@@ -0,0 +1,111 @@
+---
+name: Memory Impact Comment (Forks)
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+
+permissions:
+  contents: read        # actions/checkout of the base repo at the PR's target branch
+  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
+  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
+
+jobs:
+  memory-impact-comment:
+    name: Post memory impact comment (fork PRs only)
+    runs-on: ubuntu-24.04
+    # Only run for PRs from forks that had successful CI runs
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.head_repository.full_name != github.repository
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Get PR details
+        id: pr
+        run: |
+          # Get PR details by searching for PR with matching head SHA
+          # The workflow_run.pull_requests field is often empty for forks
+          # Use paginate to handle repos with many open PRs
+          head_sha="${{ github.event.workflow_run.head_sha }}"
+          pr_data=$(gh api --paginate "/repos/${{ github.repository }}/pulls" \
+            --jq ".[] | select(.head.sha == \"$head_sha\") | {number: .number, base_ref: .base.ref}" \
+            | head -n 1)
+
+          if [ -z "$pr_data" ]; then
+            echo "No PR found for SHA $head_sha, skipping"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          pr_number=$(echo "$pr_data" | jq -r '.number')
+          base_ref=$(echo "$pr_data" | jq -r '.base_ref')
+
+          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
+          echo "base_ref=$base_ref" >> "$GITHUB_OUTPUT"
+          echo "Found PR #$pr_number targeting base branch: $base_ref"
+
+      - name: Check out code from base repository
+        if: steps.pr.outputs.skip != 'true'
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          # Always check out from the base repository (esphome/esphome), never from forks
+          # Use the PR's target branch to ensure we run trusted code from the main repo
+          repository: ${{ github.repository }}
+          ref: ${{ steps.pr.outputs.base_ref }}
+
+      - name: Restore Python
+        if: steps.pr.outputs.skip != 'true'
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: "3.11"
+          cache-key: ${{ hashFiles('.cache-key') }}
+
+      - name: Download memory analysis artifacts
+        if: steps.pr.outputs.skip != 'true'
+        run: |
+          run_id="${{ github.event.workflow_run.id }}"
+          echo "Downloading artifacts from workflow run $run_id"
+
+          mkdir -p memory-analysis
+
+          # Download target analysis artifact
+          if gh run download --name "memory-analysis-target" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
+            echo "Downloaded memory-analysis-target artifact."
+          else
+            echo "No memory-analysis-target artifact found."
+          fi
+
+          # Download PR analysis artifact
+          if gh run download --name "memory-analysis-pr" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
+            echo "Downloaded memory-analysis-pr artifact."
+          else
+            echo "No memory-analysis-pr artifact found."
+          fi
+
+      - name: Check if artifacts exist
+        id: check
+        if: steps.pr.outputs.skip != 'true'
+        run: |
+          if [ -f ./memory-analysis/memory-analysis-target.json ] && [ -f ./memory-analysis/memory-analysis-pr.json ]; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+            echo "Memory analysis artifacts not found, skipping comment"
+          fi
+
+      - name: Post or update PR comment
+        if: steps.pr.outputs.skip != 'true' && steps.check.outputs.found == 'true'
+        env:
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+        run: |
+          . venv/bin/activate
+          # Pass PR number and JSON file paths directly to Python script
+          # Let Python parse the JSON to avoid shell injection risks
+          # The script will validate and sanitize all inputs
+          python script/ci_memory_impact_comment.py \
+            --pr-number "$PR_NUMBER" \
+            --target-json ./memory-analysis/memory-analysis-target.json \
+            --pr-json ./memory-analysis/memory-analysis-pr.json
@@ -0,0 +1,72 @@
+name: Close PR From Fork Default Branch
+
+on:
+  # pull_request_target is required so we have permission to comment and close PRs from forks.
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
+  issues: write         # issues.createComment to explain to the contributor why the PR was closed
+
+jobs:
+  close:
+    name: Close PR opened from fork's default branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+      && github.event.pull_request.head.ref == github.event.repository.default_branch
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const author = context.payload.pull_request.user.login;
+            const defaultBranch = context.payload.repository.default_branch;
+            const headRepo = context.payload.pull_request.head.repo.full_name;
+
+            const body = [
+              `Hi @${author}, thanks for opening a pull request! :tada:`,
+              ``,
+              `It looks like this PR was opened from the \`${defaultBranch}\` branch of your fork (\`${headRepo}\`), which is the same name as this repository's default branch. Working directly on \`${defaultBranch}\` in your fork causes a few problems:`,
+              ``,
+              `- Your fork's \`${defaultBranch}\` branch will permanently diverge from \`esphome/esphome:${defaultBranch}\`, making it hard to keep your fork up to date.`,
+              `- Any additional commits you push to \`${defaultBranch}\` will be added to this PR, so you can't easily work on multiple changes at once.`,
+              `- Pushing maintainer fixes to your branch is awkward, since it means committing directly to your fork's default branch.`,
+              `- It makes local collaboration painful — \`${defaultBranch}\` in a checkout becomes ambiguous between upstream and your fork, and maintainers end up with naming collisions when fetching your branch.`,
+              ``,
+              `Please re-open this as a new PR from a dedicated feature branch. The usual flow looks like:`,
+              ``,
+              `\`\`\`bash`,
+              `# Make sure your fork's ${defaultBranch} is up to date with upstream`,
+              `git remote add upstream https://github.com/${owner}/${repo}.git  # if you haven't already`,
+              `git fetch upstream`,
+              `git checkout ${defaultBranch}`,
+              `git reset --hard upstream/${defaultBranch}`,
+              `git push --force-with-lease origin ${defaultBranch}`,
+              ``,
+              `# Create a new branch for your change and cherry-pick / re-apply your commits there`,
+              `git checkout -b my-feature-branch upstream/${defaultBranch}`,
+              `# ...re-apply your changes, then:`,
+              `git push origin my-feature-branch`,
+              `\`\`\``,
+              ``,
+              `Then open a new pull request from \`my-feature-branch\` into \`${owner}/${repo}:${defaultBranch}\`.`,
+              ``,
+              `Closing this PR for now — sorry for the friction, and thanks again for contributing! :heart:`,
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body,
+            });
+
+            await github.rest.pulls.update({
+              owner,
+              repo,
+              pull_number: prNumber,
+              state: 'closed',
+            });
@@ -0,0 +1,81 @@
+# Adds/removes a 'code-owner-approved' label when a component-specific
+# codeowner approves (or dismisses) a PR.
+#
+# Uses pull_request_target so that fork PRs do not require workflow approval.
+# The label is reconciled on every PR update; for review events specifically,
+# this means the label is applied on the next push after a codeowner review.
+
+name: Codeowner Approved Label
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches-ignore:
+      - release
+      - beta
+
+permissions:
+  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
+  pull-requests: read  # listReviews to determine whether a codeowner has approved
+  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+
+jobs:
+  codeowner-approved:
+    name: Run
+    if: ${{ github.repository == 'esphome/esphome' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base branch
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          sparse-checkout: |
+            .github/scripts/codeowners.js
+            CODEOWNERS
+
+      - name: Check codeowner approval and update label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        with:
+          script: |
+            const { loadCodeowners, determineLabelAction, LabelAction } = require('./.github/scripts/codeowners.js');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr_number = parseInt(process.env.PR_NUMBER, 10);
+            const LABEL_NAME = 'code-owner-approved';
+
+            console.log(`Processing PR #${pr_number} for codeowner approval label`);
+
+            const codeownersPatterns = loadCodeowners();
+            const action = await determineLabelAction(
+              github, owner, repo, pr_number, codeownersPatterns, LABEL_NAME
+            );
+
+            if (action === LabelAction.NONE) {
+              console.log('No label change needed');
+              return;
+            }
+
+            try {
+              if (action === LabelAction.ADD) {
+                await github.rest.issues.addLabels({
+                  owner, repo, issue_number: pr_number, labels: [LABEL_NAME]
+                });
+                console.log(`Added '${LABEL_NAME}' label`);
+              } else if (action === LabelAction.REMOVE) {
+                await github.rest.issues.removeLabel({
+                  owner, repo, issue_number: pr_number, name: LABEL_NAME
+                });
+                console.log(`Removed '${LABEL_NAME}' label`);
+              }
+            } catch (error) {
+              if (error.status === 403) {
+                console.log(`Warning: insufficient permissions to update label (expected for fork PRs)`);
+              } else if (error.status === 404) {
+                console.log(`Label '${LABEL_NAME}' not present, nothing to remove`);
+              } else {
+                throw error;
+              }
+            }
@@ -0,0 +1,291 @@
+# This workflow automatically requests reviews from codeowners when:
+# 1. A PR is opened, reopened, or synchronized (updated)
+# 2. A PR is marked as ready for review
+#
+# It reads the CODEOWNERS file and matches all changed files in the PR against
+# the codeowner patterns, then requests reviews from the appropriate owners
+# while avoiding duplicate requests for users who have already been requested
+# or have already reviewed the PR.
+
+name: Request Codeowner Reviews
+
+on:
+  # Needs to be pull_request_target to get write permissions
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches-ignore:
+      - release
+      - beta
+
+# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
+permissions:
+  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+
+jobs:
+  request-codeowner-reviews:
+    name: Run
+    if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base branch
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by the github-script step below.
+          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
+          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
+
+      - name: Request reviews from component codeowners
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr_number = context.payload.pull_request.number;
+
+            console.log(`Processing PR #${pr_number} for codeowner review requests`);
+
+            // Hidden marker to identify bot comments from this workflow
+            const BOT_COMMENT_MARKER = '<!-- codeowner-review-request-bot -->';
+
+            try {
+              // Get the list of changed files in this PR (with pagination)
+              const files = await github.paginate(
+                github.rest.pulls.listFiles,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
+
+              const changedFiles = files.map(file => file.filename);
+              console.log(`Found ${changedFiles.length} changed files`);
+
+              if (changedFiles.length === 0) {
+                console.log('No changed files found, skipping codeowner review requests');
+                return;
+              }
+
+              // Parse CODEOWNERS from the checked-out base branch
+              const codeownersPatterns = loadCodeowners();
+
+              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
+
+              // Helper function to create comment body
+              function createCommentBody(reviewersList, teamsList, matchedFileCount, isSuccessful = true) {
+                const reviewerMentions = reviewersList.map(r => `@${r}`);
+                const teamMentions = teamsList.map(t => `@${owner}/${t}`);
+                const allMentions = [...reviewerMentions, ...teamMentions].join(', ');
+
+                if (isSuccessful) {
+                  return `${BOT_COMMENT_MARKER}\n👋 Hi there! I've automatically requested reviews from codeowners based on the files changed in this PR.\n\n${allMentions} - You've been requested to review this PR as codeowner(s) of ${matchedFileCount} file(s) that were modified. Thanks for your time! 🙏`;
+                } else {
+                  return `${BOT_COMMENT_MARKER}\n👋 Hi there! This PR modifies ${matchedFileCount} file(s) with codeowners.\n\n${allMentions} - As codeowner(s) of the affected files, your review would be appreciated! 🙏\n\n_Note: Automatic review request may have failed, but you're still welcome to review._`;
+                }
+              }
+
+              // Match changed files against CODEOWNERS patterns using last-match-wins semantics
+              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+              const matchedOwners = effective.users;
+              const matchedTeams = effective.teams;
+              const matchedFileCount = effective.matchedFileCount;
+
+              if (matchedOwners.size === 0 && matchedTeams.size === 0) {
+                console.log('No codeowners found for any changed files');
+                return;
+              }
+
+              // Remove the PR author from reviewers
+              const prAuthor = context.payload.pull_request.user.login;
+              matchedOwners.delete(prAuthor);
+
+              // Get current reviewers to avoid duplicate requests (but still mention them)
+              const { data: prData } = await github.rest.pulls.get({
+                owner,
+                repo,
+                pull_number: pr_number
+              });
+
+              const currentReviewers = new Set();
+              const currentTeams = new Set();
+
+              if (prData.requested_reviewers) {
+                prData.requested_reviewers.forEach(reviewer => {
+                  currentReviewers.add(reviewer.login);
+                });
+              }
+
+              if (prData.requested_teams) {
+                prData.requested_teams.forEach(team => {
+                  currentTeams.add(team.slug);
+                });
+              }
+
+              // Check for completed reviews to avoid re-requesting users who have already reviewed
+              const reviews = await github.paginate(
+                github.rest.pulls.listReviews,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
+
+              const reviewedUsers = new Set();
+              reviews.forEach(review => {
+                reviewedUsers.add(review.user.login);
+              });
+
+              // Check for previous comments from this workflow to avoid duplicate pings
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                {
+                  owner,
+                  repo,
+                  issue_number: pr_number
+                }
+              );
+
+              const previouslyPingedUsers = new Set();
+              const previouslyPingedTeams = new Set();
+
+              // Look for comments from github-actions bot that contain our bot marker
+              const workflowComments = comments.filter(comment =>
+                comment.user.type === 'Bot' &&
+                comment.body.includes(BOT_COMMENT_MARKER)
+              );
+
+              // Extract previously mentioned users and teams from workflow comments
+              for (const comment of workflowComments) {
+                // Match @username patterns (not team mentions)
+                const userMentions = comment.body.match(/@([a-zA-Z0-9_.-]+)(?![/])/g) || [];
+                userMentions.forEach(mention => {
+                  const username = mention.slice(1); // remove @
+                  previouslyPingedUsers.add(username);
+                });
+
+                // Match @org/team patterns
+                const teamMentions = comment.body.match(/@[a-zA-Z0-9_.-]+\/([a-zA-Z0-9_.-]+)/g) || [];
+                teamMentions.forEach(mention => {
+                  const teamName = mention.split('/')[1];
+                  previouslyPingedTeams.add(teamName);
+                });
+              }
+
+              console.log(`Found ${previouslyPingedUsers.size} previously pinged users and ${previouslyPingedTeams.size} previously pinged teams`);
+
+              // Remove users who have already been pinged in previous workflow comments
+              previouslyPingedUsers.forEach(user => {
+                matchedOwners.delete(user);
+              });
+
+              previouslyPingedTeams.forEach(team => {
+                matchedTeams.delete(team);
+              });
+
+              // Remove only users who have already submitted reviews (not just requested reviewers)
+              reviewedUsers.forEach(reviewer => {
+                matchedOwners.delete(reviewer);
+              });
+
+              // For teams, we'll still remove already requested teams to avoid API errors
+              currentTeams.forEach(team => {
+                matchedTeams.delete(team);
+              });
+
+              const reviewersList = Array.from(matchedOwners);
+              const teamsList = Array.from(matchedTeams);
+
+              if (reviewersList.length === 0 && teamsList.length === 0) {
+                console.log('No eligible reviewers found (all may already be requested, reviewed, or previously pinged)');
+                return;
+              }
+
+              const totalReviewers = reviewersList.length + teamsList.length;
+              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${matchedFileCount} matched files`);
+
+              // Request reviews
+              try {
+                const requestParams = {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                };
+
+                // Filter out users who are already requested reviewers for the API call
+                const newReviewers = reviewersList.filter(reviewer => !currentReviewers.has(reviewer));
+                const newTeams = teamsList.filter(team => !currentTeams.has(team));
+
+                if (newReviewers.length > 0) {
+                  requestParams.reviewers = newReviewers;
+                }
+
+                if (newTeams.length > 0) {
+                  requestParams.team_reviewers = newTeams;
+                }
+
+                // Only make the API call if there are new reviewers to request
+                if (newReviewers.length > 0 || newTeams.length > 0) {
+                  await github.rest.pulls.requestReviewers(requestParams);
+                  console.log(`Successfully requested reviews from ${newReviewers.length} new users and ${newTeams.length} new teams`);
+                } else {
+                  console.log('All codeowners are already requested reviewers or have reviewed');
+                }
+
+                // Only add a comment if there are new codeowners to mention (not previously pinged)
+                if (reviewersList.length > 0 || teamsList.length > 0) {
+                  const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, true);
+
+                  await github.rest.issues.createComment({
+                    owner,
+                    repo,
+                    issue_number: pr_number,
+                    body: commentBody
+                  });
+                  console.log(`Added comment mentioning ${reviewersList.length} users and ${teamsList.length} teams`);
+                } else {
+                  console.log('No new codeowners to mention in comment (all previously pinged)');
+                }
+              } catch (error) {
+                if (error.status === 422) {
+                  console.log('Some reviewers may already be requested or unavailable:', error.message);
+
+                  // Only try to add a comment if there are new codeowners to mention
+                  if (reviewersList.length > 0 || teamsList.length > 0) {
+                    const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, false);
+
+                    try {
+                      await github.rest.issues.createComment({
+                        owner,
+                        repo,
+                        issue_number: pr_number,
+                        body: commentBody
+                      });
+                      console.log(`Added fallback comment mentioning ${reviewersList.length} users and ${teamsList.length} teams`);
+                    } catch (commentError) {
+                      console.log('Failed to add comment:', commentError.message);
+                    }
+                  } else {
+                    console.log('No new codeowners to mention in fallback comment');
+                  }
+                } else {
+                  throw error;
+                }
+              }
+
+            } catch (error) {
+              console.log('Failed to process codeowner review requests:', error.message);
+              console.error(error);
+            }
@@ -16,6 +16,9 @@ on:
  schedule:
    - cron: "30 18 * * 4"

+# Deny by default; the analyze job opts in to exactly what it needs.
+permissions: {}
+
 jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
@@ -26,15 +29,10 @@ jobs:
    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
+      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
+      packages: read          # fetch internal or private CodeQL query packs
+      actions: read           # required by codeql-action when run from a private repo
+      contents: read          # actions/checkout to scan the repository

    strategy:
      fail-fast: false
@@ -54,11 +52,11 @@ jobs:
            # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -86,6 +84,6 @@ jobs:
          exit 1

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          category: "/language:${{matrix.language}}"
@@ -0,0 +1,119 @@
+name: Add Dashboard Deprecation Comment
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
+
+jobs:
+  dashboard-deprecation-comment:
+    name: Dashboard deprecation comment
+    runs-on: ubuntu-latest
+    # Release-bump PRs (bump-X.Y.Z -> beta, beta -> release) inevitably
+    # roll up everything merged into dev since the last cut, which can
+    # include dashboard changes that have already been reviewed once.
+    # The bot's purpose is to warn new contributors before they invest
+    # time -- that only applies to PRs entering dev.
+    if: github.event.pull_request.base.ref == 'dev'
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
+      - name: Add dashboard deprecation comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const commentMarker = "<!-- This comment was generated automatically by the dashboard-deprecation-comment workflow. -->";
+
+            const commentBody = `Thanks for opening this PR!
+
+            Heads up: the legacy ESPHome dashboard (\`esphome/dashboard/\` and \`tests/dashboard/\`) is **deprecated** and is being replaced by [ESPHome Device Builder](https://github.com/esphome/device-builder). We are not adding new features to the legacy dashboard and it will eventually be removed from this repository.
+
+            What this means for your PR:
+
+            - **New features / enhancements**: please port the change to [esphome/device-builder](https://github.com/esphome/device-builder) instead. We are unlikely to review or merge new dashboard features here.
+            - **Bug fixes**: small fixes may still be considered, but please check first whether the same issue exists in Device Builder, where the fix will have a longer life.
+            - **Security issues**: please do not file a public PR. Report privately via [GitHub security advisories](https://github.com/esphome/esphome/security/advisories/new) so we can coordinate a fix.
+
+            We appreciate the contribution and apologize for the friction; flagging this early so your time isn't spent on a change that may not land.
+
+            ---
+            (Added by the PR bot)
+
+            ${commentMarker}`;
+
+            async function getDashboardChanges(github, owner, repo, prNumber) {
+                const changedFiles = await github.paginate(
+                    github.rest.pulls.listFiles,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        pull_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return changedFiles.filter(file =>
+                    file.filename.startsWith('esphome/dashboard/') ||
+                    file.filename.startsWith('tests/dashboard/')
+                );
+            }
+
+            async function findBotComment(github, owner, repo, prNumber) {
+                const comments = await github.paginate(
+                    github.rest.issues.listComments,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        issue_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return comments.find(comment =>
+                    comment.body.includes(commentMarker) && comment.user.type === "Bot"
+                );
+            }
+
+            const prNumber = context.payload.pull_request.number;
+            const { owner, repo } = context.repo;
+
+            const dashboardChanges = await getDashboardChanges(github, owner, repo, prNumber);
+            const existingComment = await findBotComment(github, owner, repo, prNumber);
+
+            if (dashboardChanges.length === 0) {
+                // PR doesn't (or no longer) touches the legacy dashboard. If we previously
+                // commented (e.g. files were removed in a later push), leave the comment in
+                // place for history rather than thrash on edit/delete.
+                return;
+            }
+
+            if (existingComment) {
+                if (existingComment.body === commentBody) {
+                    return;
+                }
+                await github.rest.issues.updateComment({
+                    owner: owner,
+                    repo: repo,
+                    comment_id: existingComment.id,
+                    body: commentBody,
+                });
+            } else {
+                await github.rest.issues.createComment({
+                    owner: owner,
+                    repo: repo,
+                    issue_number: prNumber,
+                    body: commentBody,
+                });
+            }
@@ -0,0 +1,166 @@
+name: Add External Component Comment
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
+
+jobs:
+  external-comment:
+    name: External component comment
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
+      - name: Add external component comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            // Generate external component usage instructions
+            function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {
+                let source;
+                if (owner === 'esphome' && repo === 'esphome')
+                    source = `github://pr#${prNumber}`;
+                else
+                    source = `github://${owner}/${repo}@pull/${prNumber}/head`;
+                return `To use the changes from this PR as an external component, add the following to your ESPHome configuration YAML file:
+
+            \`\`\`yaml
+            external_components:
+              - source: ${source}
+                components: [${componentNames.join(', ')}]
+                refresh: 1h
+            \`\`\``;
+            }
+
+            // Generate repo clone instructions
+            function generateRepoInstructions(prNumber, owner, repo, branch) {
+                return `To use the changes in this PR:
+
+            \`\`\`bash
+            # Clone the repository:
+            git clone https://github.com/${owner}/${repo}
+            cd ${repo}
+
+            # Checkout the PR branch:
+            git fetch origin pull/${prNumber}/head:${branch}
+            git checkout ${branch}
+
+            # Install the development version:
+            script/setup
+
+            # Activate the development version:
+            source venv/bin/activate
+            \`\`\`
+
+            Now you can run \`esphome\` as usual to test the changes in this PR.
+            `;
+            }
+
+            async function createComment(octokit, owner, repo, prNumber, esphomeChanges, componentChanges) {
+                const commentMarker = "<!-- This comment was generated automatically by the external-component-bot workflow. -->";
+                const legacyCommentMarker = "<!-- This comment was generated automatically by a GitHub workflow. -->";
+                let commentBody;
+                if (esphomeChanges.length === 1) {
+                    commentBody = generateExternalComponentInstructions(prNumber, componentChanges, owner, repo);
+                } else {
+                    commentBody = generateRepoInstructions(prNumber, owner, repo, context.payload.pull_request.head.ref);
+                }
+                commentBody += `\n\n---\n(Added by the PR bot)\n\n${commentMarker}`;
+
+                // Check for existing bot comment
+                const comments = await github.paginate(
+                    github.rest.issues.listComments,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        issue_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                const sorted = comments.sort((a, b) => new Date(b.updated_at) - new Date(a.updated_at));
+
+                const botComment = sorted.find(comment =>
+                    (
+                      comment.body.includes(commentMarker) ||
+                      comment.body.includes(legacyCommentMarker)
+                    ) && comment.user.type === "Bot"
+                );
+
+                if (botComment && botComment.body === commentBody) {
+                    // No changes in the comment, do nothing
+                    return;
+                }
+
+                if (botComment) {
+                    // Update existing comment
+                    await github.rest.issues.updateComment({
+                        owner: owner,
+                        repo: repo,
+                        comment_id: botComment.id,
+                        body: commentBody,
+                    });
+                } else {
+                    // Create new comment
+                    await github.rest.issues.createComment({
+                        owner: owner,
+                        repo: repo,
+                        issue_number: prNumber,
+                        body: commentBody,
+                    });
+                }
+            }
+
+            async function getEsphomeAndComponentChanges(github, owner, repo, prNumber) {
+                const changedFiles = await github.rest.pulls.listFiles({
+                    owner: owner,
+                    repo: repo,
+                    pull_number: prNumber,
+                });
+
+                const esphomeChanges = changedFiles.data
+                    .filter(file => file.filename !== "esphome/core/defines.h" && file.filename.startsWith('esphome/'))
+                    .map(file => {
+                        const match = file.filename.match(/esphome\/([^/]+)/);
+                        return match ? match[1] : null;
+                    })
+                    .filter(it => it !== null);
+
+                if (esphomeChanges.length === 0) {
+                    return {esphomeChanges: [], componentChanges: []};
+                }
+
+                const uniqueEsphomeChanges = [...new Set(esphomeChanges)];
+                const componentChanges = changedFiles.data
+                    .filter(file => file.filename.startsWith('esphome/components/'))
+                    .map(file => {
+                        const match = file.filename.match(/esphome\/components\/([^/]+)\//);
+                        return match ? match[1] : null;
+                    })
+                    .filter(it => it !== null);
+
+                return {esphomeChanges: uniqueEsphomeChanges, componentChanges: [...new Set(componentChanges)]};
+            }
+
+            // Start of main code.
+
+            const prNumber = context.payload.pull_request.number;
+            const {owner, repo} = context.repo;
+
+            const {esphomeChanges, componentChanges} = await getEsphomeAndComponentChanges(github, owner, repo, prNumber);
+            if (componentChanges.length !== 0) {
+                await createComment(github, owner, repo, prNumber, esphomeChanges, componentChanges);
+            }
@@ -0,0 +1,163 @@
+# This workflow automatically notifies codeowners when an issue is labeled with component labels.
+# It reads the CODEOWNERS file to find the maintainers for the labeled components
+# and posts a comment mentioning them to ensure they're aware of the issue.
+
+name: Notify Issue Codeowners
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
+  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
+
+jobs:
+  notify-codeowners:
+    name: Run
+    if: ${{ startsWith(github.event.label.name, format('component{0} ', ':')) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify codeowners for component issues
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issue_number = context.payload.issue.number;
+            const labelName = context.payload.label.name;
+
+            console.log(`Processing issue #${issue_number} with label: ${labelName}`);
+
+            // Hidden marker to identify bot comments from this workflow
+            const BOT_COMMENT_MARKER = '<!-- issue-codeowner-notify-bot -->';
+
+            // Extract component name from label
+            const componentName = labelName.replace('component: ', '');
+            console.log(`Component: ${componentName}`);
+
+            try {
+              // Fetch CODEOWNERS file from root
+              const { data: codeownersFile } = await github.rest.repos.getContent({
+                owner,
+                repo,
+                path: 'CODEOWNERS'
+              });
+              const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
+
+              // Parse CODEOWNERS file to extract component mappings
+              const codeownersLines = codeownersContent.split('\n')
+                .map(line => line.trim())
+                .filter(line => line && !line.startsWith('#'));
+
+              let componentOwners = null;
+
+              for (const line of codeownersLines) {
+                const parts = line.split(/\s+/);
+                if (parts.length < 2) continue;
+
+                const pattern = parts[0];
+                const owners = parts.slice(1);
+
+                // Look for component patterns: esphome/components/{component}/*
+                const componentMatch = pattern.match(/^esphome\/components\/([^\/]+)\/\*$/);
+                if (componentMatch && componentMatch[1] === componentName) {
+                  componentOwners = owners;
+                  break;
+                }
+              }
+
+              if (!componentOwners) {
+                console.log(`No codeowners found for component: ${componentName}`);
+                return;
+              }
+
+              console.log(`Found codeowners for '${componentName}': ${componentOwners.join(', ')}`);
+
+              // Separate users and teams
+              const userOwners = [];
+              const teamOwners = [];
+
+              for (const owner of componentOwners) {
+                const cleanOwner = owner.startsWith('@') ? owner.slice(1) : owner;
+                if (cleanOwner.includes('/')) {
+                  // Team mention (org/team-name)
+                  teamOwners.push(`@${cleanOwner}`);
+                } else {
+                  // Individual user
+                  userOwners.push(`@${cleanOwner}`);
+                }
+              }
+
+              // Remove issue author from mentions to avoid self-notification
+              const issueAuthor = context.payload.issue.user.login;
+              const filteredUserOwners = userOwners.filter(mention =>
+                mention !== `@${issueAuthor}`
+              );
+
+              // Check for previous comments from this workflow to avoid duplicate pings
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                {
+                  owner,
+                  repo,
+                  issue_number: issue_number
+                }
+              );
+
+              const previouslyPingedUsers = new Set();
+              const previouslyPingedTeams = new Set();
+
+              // Look for comments from github-actions bot that contain codeowner pings for this component
+              const workflowComments = comments.filter(comment =>
+                comment.user.type === 'Bot' &&
+                comment.body.includes(BOT_COMMENT_MARKER) &&
+                comment.body.includes(`component: ${componentName}`)
+              );
+
+              // Extract previously mentioned users and teams from workflow comments
+              for (const comment of workflowComments) {
+                // Match @username patterns (not team mentions)
+                const userMentions = comment.body.match(/@([a-zA-Z0-9_.-]+)(?![/])/g) || [];
+                userMentions.forEach(mention => {
+                  previouslyPingedUsers.add(mention); // Keep @ prefix for easy comparison
+                });
+
+                // Match @org/team patterns
+                const teamMentions = comment.body.match(/@[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+/g) || [];
+                teamMentions.forEach(mention => {
+                  previouslyPingedTeams.add(mention);
+                });
+              }
+
+              console.log(`Found ${previouslyPingedUsers.size} previously pinged users and ${previouslyPingedTeams.size} previously pinged teams for component ${componentName}`);
+
+              // Remove previously pinged users and teams
+              const newUserOwners = filteredUserOwners.filter(mention => !previouslyPingedUsers.has(mention));
+              const newTeamOwners = teamOwners.filter(mention => !previouslyPingedTeams.has(mention));
+
+              const allMentions = [...newUserOwners, ...newTeamOwners];
+
+              if (allMentions.length === 0) {
+                console.log('No new codeowners to notify (all previously pinged or issue author is the only codeowner)');
+                return;
+              }
+
+              // Create comment body
+              const mentionString = allMentions.join(', ');
+              const commentBody = `${BOT_COMMENT_MARKER}\n👋 Hey ${mentionString}!\n\nThis issue has been labeled with \`component: ${componentName}\` and you've been identified as a codeowner of this component. Please take a look when you have a chance!\n\nThanks for maintaining this component! 🙏`;
+
+              // Post comment
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: issue_number,
+                body: commentBody
+              });
+
+              console.log(`Successfully notified new codeowners: ${mentionString}`);
+
+            } catch (error) {
+              console.log('Failed to process codeowner notifications:', error.message);
+              console.error(error);
+            }
@@ -1,28 +1,17 @@
 ---
-name: Lock
+name: Lock closed issues and PRs

 on:
  schedule:
-    - cron: "30 0 * * *"
+    - cron: "30 0 * * *"  # Run daily at 00:30 UTC
  workflow_dispatch:

-permissions:
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: lock
+# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
+permissions: {}

 jobs:
  lock:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/lock-threads@v5.0.1
-        with:
-          pr-inactive-days: "1"
-          pr-lock-reason: ""
-          exclude-any-pr-labels: keep-open
-
-          issue-inactive-days: "7"
-          issue-lock-reason: ""
-          exclude-any-issue-labels: keep-open
+    permissions:
+      issues: write         # issues.lock on closed issues
+      pull-requests: write  # issues.lock on closed pull requests
+    uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df  # 2026.4.1
@@ -1,24 +0,0 @@
-name: Needs Docs
-
-on:
-  pull_request:
-    types: [labeled, unlabeled]
-
-jobs:
-  check:
-    name: Check
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check for needs-docs label
-        uses: actions/github-script@v7.0.1
-        with:
-          script: |
-            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number
-            });
-            const needsDocs = labels.find(label => label.name === 'needs-docs');
-            if (needsDocs) {
-              core.setFailed('Pull request needs docs');
-            }
@@ -0,0 +1,98 @@
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    branches-ignore:
+      - release
+      - beta
+
+permissions:
+  contents: read       # actions/checkout to load detect-tags.js
+  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
+
+jobs:
+  check:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const {
+              detectComponents,
+              hasCoreChanges,
+              hasDashboardChanges,
+              hasGitHubActionsChanges,
+            } = require('./.github/scripts/detect-tags.js');
+
+            const title = context.payload.pull_request.title;
+            const user = context.payload.pull_request.user;
+
+            // Skip bot PRs (e.g. dependabot, esphome[bot] device-class sync) -
+            // they have their own title formats.
+            if (user.type === 'Bot') {
+              return;
+            }
+
+            // Block titles starting with "word:" or "word(scope):" patterns
+            const commitStylePattern = /^\w+(\(.*?\))?[!]?\s*:/;
+            if (commitStylePattern.test(title)) {
+              core.setFailed(
+                `PR title should not start with a "prefix:" style format.\n` +
+                `Please use the format: [component] Brief description\n`
+              );
+              return;
+            }
+
+            // Get changed files to detect tags
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+            });
+            const filenames = files.map(f => f.filename);
+
+            // Detect tags from changed files using shared logic
+            const tags = new Set();
+
+            for (const comp of detectComponents(filenames)) {
+              tags.add(comp);
+            }
+            if (hasCoreChanges(filenames)) tags.add('core');
+            if (hasDashboardChanges(filenames)) tags.add('dashboard');
+            if (hasGitHubActionsChanges(filenames)) tags.add('ci');
+
+            if (tags.size === 0) {
+              return;
+            }
+
+            // Check for MDX syntax characters not wrapped in backticks.
+            // Astro docs MDX treats bare `<` as JSX component opening tags and
+            // bare `{` as JS expressions, so both must be escaped in changelog entries.
+            const stripped = title.replace(/`[^`]*`/g, '');
+            if (/[<>{}]/.test(stripped)) {
+              core.setFailed(
+                'PR title contains `<`, `>`, `{`, or `}` not wrapped in backticks.\n' +
+                'Astro docs MDX interprets bare `<` as JSX components and bare `{` as JS expressions.\n' +
+                'Please wrap these characters with backticks, e.g.: [component] Add `<feature>` support'
+              );
+              return;
+            }
+
+            // Check title starts with [tag] prefix
+            const bracketPattern = /^\[\w+\]/;
+            if (!bracketPattern.test(title)) {
+              const suggestion = [...tags].map(c => `[${c}]`).join('');
+              // Skip if the suggested prefix would be too long for a readable title
+              if (suggestion.length > 40) {
+                return;
+              }
+              core.setFailed(
+                `PR modifies: ${[...tags].join(', ')}\n` +
+                `Title must start with a [tag] prefix.\n` +
+                `Suggested: ${suggestion} <description>`
+              );
+            }
@@ -9,7 +9,7 @@ on:
    - cron: "0 2 * * *"

 permissions:
-  contents: read
+  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write

 jobs:
  init:
@@ -20,7 +20,7 @@ jobs:
      branch_build: ${{ steps.tag.outputs.branch_build }}
      deploy_env: ${{ steps.tag.outputs.deploy_env }}
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Get tag
        id: tag
        # yamllint disable rule:line-length
@@ -57,12 +57,12 @@ jobs:
    if: github.repository == 'esphome/esphome' && github.event_name == 'release'
    runs-on: ubuntu-latest
    permissions:
-      contents: read
-      id-token: write
+      contents: read   # actions/checkout to build the sdist/wheel
+      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up Python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.x"
      - name: Build
@@ -70,7 +70,7 @@ jobs:
          pip3 install build
          python3 -m build
      - name: Publish
-        uses: pypa/gh-action-pypi-publish@v1.12.4
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
        with:
          skip-existing: true

@@ -78,8 +78,8 @@ jobs:
    name: Build ESPHome ${{ matrix.platform.arch }}
    if: github.repository == 'esphome/esphome'
    permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
    runs-on: ${{ matrix.platform.os }}
    needs: [init]
    strategy:
@@ -92,22 +92,22 @@ jobs:
            os: "ubuntu-24.04-arm"

    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: Set up Python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          python-version: "3.10"
+          python-version: "3.11"

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to docker hub
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Log in to the GitHub container registry
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -138,7 +138,7 @@ jobs:
      #     version: ${{ needs.init.outputs.tag }}

      - name: Upload digests
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ matrix.platform.arch }}
          path: /tmp/digests
@@ -152,8 +152,8 @@ jobs:
      - deploy-docker
    if: github.repository == 'esphome/esphome'
    permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
    strategy:
      fail-fast: false
      matrix:
@@ -168,27 +168,27 @@ jobs:
          - ghcr
          - dockerhub
    steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Download digests
-        uses: actions/download-artifact@v4.3.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: digests-*
          path: /tmp/digests
          merge-multiple: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.10.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: Log in to docker hub
        if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_PASSWORD }}
      - name: Log in to the GitHub container registry
        if: matrix.registry == 'ghcr'
-        uses: docker/login-action@v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
@@ -212,48 +212,32 @@ jobs:
          docker buildx imagetools create $(jq -Rcnr 'inputs | . / "," | map("-t " + .) | join(" ")' <<< "${{ steps.tags.outputs.tags}}") \
            $(printf '${{ steps.tags.outputs.image }}@sha256:%s ' *)

-  deploy-ha-addon-repo:
+  version-notifier:
    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
    runs-on: ubuntu-latest
    needs:
      - init
      - deploy-manifest
    steps:
-      - name: Trigger Workflow
-        uses: actions/github-script@v7.0.1
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
-          github-token: ${{ secrets.DEPLOY_HA_ADDON_REPO_TOKEN }}
-          script: |
-            let description = "ESPHome";
-            if (context.eventName == "release") {
-              description = ${{ toJSON(github.event.release.body) }};
-            }
-            github.rest.actions.createWorkflowDispatch({
-              owner: "esphome",
-              repo: "home-assistant-addon",
-              workflow_id: "bump-version.yml",
-              ref: "main",
-              inputs: {
-                version: "${{ needs.init.outputs.tag }}",
-                content: description
-              }
-            })
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          owner: esphome
+          repositories: version-notifier
+          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)

-  deploy-esphome-schema:
-    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
-    runs-on: ubuntu-latest
-    needs: [init]
-    environment: ${{ needs.init.outputs.deploy_env }}
-    steps:
      - name: Trigger Workflow
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
-          github-token: ${{ secrets.DEPLOY_ESPHOME_SCHEMA_REPO_TOKEN }}
+          github-token: ${{ steps.generate-token.outputs.token }}
          script: |
-            github.rest.actions.createWorkflowDispatch({
+            await github.rest.actions.createWorkflowDispatch({
              owner: "esphome",
-              repo: "esphome-schema",
-              workflow_id: "generate-schemas.yml",
+              repo: "version-notifier",
+              workflow_id: "notify.yml",
              ref: "main",
              inputs: {
                version: "${{ needs.init.outputs.tag }}",
@@ -7,44 +7,60 @@ on:
  workflow_dispatch:

 permissions:
-  issues: write
-  pull-requests: write
+  issues: write         # actions/stale labels, comments on, and closes stale issues
+  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests

 concurrency:
  group: lock

 jobs:
  stale:
+    if: github.repository_owner == 'esphome'
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/stale@v9.1.0
+      - name: Stale
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
        with:
+          debug-only: ${{ github.ref != 'refs/heads/dev' }} # Dry-run when not run on dev branch
+          remove-stale-when-updated: true
+          operations-per-run: 400
+
+          # The 90 day stale policy for PRs
+          # - PRs
+          # - No PRs marked as "not-stale"
+          # - No Issues (see below)
          days-before-pr-stale: 90
          days-before-pr-close: 7
-          days-before-issue-stale: -1
-          days-before-issue-close: -1
-          remove-stale-when-updated: true
          stale-pr-label: "stale"
          exempt-pr-labels: "not-stale"
          stale-pr-message: >
            There hasn't been any activity on this pull request recently. This
            pull request has been automatically marked as stale because of that
            and will be closed if no further activity occurs within 7 days.
-            Thank you for your contributions.

-  # Use stale to automatically close issues with a
-  # reference to the issue tracker
-  close-issues:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v9.1.0
-        with:
-          days-before-pr-stale: -1
-          days-before-pr-close: -1
-          days-before-issue-stale: 1
-          days-before-issue-close: 1
-          remove-stale-when-updated: true
+            If you are the author of this PR, please leave a comment if you want
+            to keep it open. Also, please rebase your PR onto the latest dev
+            branch to ensure that it's up to date with the latest changes.
+
+            Thank you for your contribution!
+
+          # The 90 day stale policy for Issues
+          # - Issues
+          # - No Issues marked as "not-stale"
+          # - No PRs (see above)
+          days-before-issue-stale: 90
+          days-before-issue-close: 7
          stale-issue-label: "stale"
          exempt-issue-labels: "not-stale"
          stale-issue-message: >
-            https://github.com/esphome/esphome/issues/430
+            There hasn't been any activity on this issue recently. Due to the
+            high number of incoming GitHub notifications, we have to clean some
+            of the old issues, as many of them have already been resolved with
+            the latest updates.
+
+            Please make sure to update to the latest ESPHome version and
+            check if that solves the issue. Let us know if that works for you by
+            adding a comment 👍
+
+            This issue has now been marked as stale and will be closed if no
+            further activity occurs. Thank you for your contributions.
@@ -0,0 +1,33 @@
+name: Status check labels
+
+on:
+  pull_request:
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr)
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Check blocking labels
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for blocking labels
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const blockingLabels = ['needs-docs', 'merge-after-release', 'chained-pr'];
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number
+            });
+            const labelNames = labels.map(l => l.name);
+            const found = blockingLabels.filter(bl => labelNames.includes(bl));
+            if (found.length > 0) {
+              core.setFailed(`Pull request cannot be merged, it has blocking label(s): ${found.join(', ')}`);
+            }
@@ -6,37 +6,94 @@ on:
  schedule:
    - cron: "45 6 * * *"

+# Repo writes (branch push, PR open) happen via the App token minted below,
+# so the workflow's GITHUB_TOKEN does not need any write scopes.
+permissions:
+  contents: read  # actions/checkout for this repo and home-assistant/core
+
 jobs:
  sync:
    name: Sync Device Classes
    runs-on: ubuntu-latest
    if: github.repository == 'esphome/esphome'
    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
+          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
+          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
+
      - name: Checkout
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Checkout Home Assistant
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: home-assistant/core
          path: lib/home-assistant

      - name: Setup Python
-        uses: actions/setup-python@v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
-          python-version: 3.13
+          python-version: "3.14"
+
+      - name: Set up uv
+        # An order of magnitude faster than pip on cold boots, with its
+        # own wheel cache. ``--system`` (below) installs into the
+        # setup-python interpreter so subsequent ``pre-commit`` /
+        # ``script/run-in-env.py`` steps find the deps without a
+        # ``uv run`` prefix.
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"

      - name: Install Home Assistant
        run: |
-          python -m pip install --upgrade pip
-          pip install -e lib/home-assistant
+          uv pip install --system -e lib/home-assistant
+          uv pip install --system -r requirements.txt -r requirements_test.txt pre-commit

      - name: Sync
        run: |
          python ./script/sync-device_class.py

+      - name: Apply pre-commit auto-fixes
+        # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
+        # files. pre-commit exits non-zero whenever a hook touches anything,
+        # which would otherwise abort the workflow before the auto-fixes
+        # can flow into the sync PR.
+        #
+        # SKIP:
+        #   - no-commit-to-branch is a local guard against committing on
+        #     dev/release/beta; CI runs on dev by definition, and
+        #     peter-evans/create-pull-request creates the branch itself.
+        #   - pylint surfaces import-error / relative-beyond-top-level
+        #     noise here because this workflow installs only a subset of
+        #     the runtime deps (HA + requirements*.txt); main CI already
+        #     gates pylint on real PRs.
+        env:
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files || true
+
+      - name: Verify pre-commit clean
+        # Second pass: re-run all hooks against the now-fixed tree.
+        # Auto-fixers exit 0 (nothing to change); any remaining failure
+        # from a check-only hook (flake8 / yamllint / ci-custom) is a
+        # real issue and fails the workflow loudly. Same SKIP list as
+        # above for the same reasons.
+        env:
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files
+
      - name: Commit changes
-        uses: peter-evans/create-pull-request@v7.0.8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
        with:
          commit-message: "Synchronise Device Classes from Home Assistant"
          committer: esphomebot <esphome@openhomefoundation.org>
@@ -45,4 +102,4 @@ jobs:
          delete-branch: true
          title: "Synchronise Device Classes from Home Assistant"
          body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}
@@ -1,25 +0,0 @@
---
-name: YAML lint
-
-on:
-  push:
-    branches: [dev, beta, release]
-    paths:
-      - "**.yaml"
-      - "**.yml"
-  pull_request:
-    paths:
-      - "**.yaml"
-      - "**.yml"
-
-jobs:
-  yamllint:
-    name: yamllint
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@v4.2.2
-      - name: Run yamllint
-        uses: frenck/action-yamllint@v1.5.0
-        with:
-          strict: true
@@ -91,6 +91,10 @@ venv-*/
 # mypy
 .mypy_cache/

+# nix
+/default.nix
+/shell.nix
+
 .pioenvs
 .piolibdeps
 .pio
@@ -137,10 +141,12 @@ tests/.esphome/

 sdkconfig.*
 !sdkconfig.defaults
+!sdkconfig.defaults.*

 .tests/

 /components
 /managed_components
+/dependencies.lock

 api-docs/
@@ -1,10 +1,17 @@
 ---
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
+
+ci:
+  autoupdate_commit_msg: 'pre-commit: autoupdate'
+  autoupdate_schedule: off  # Disabled until ruff versions are synced between deps and pre-commit
+  # Skip hooks that have issues in pre-commit CI environment
+  skip: [pylint]
+
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
-    rev: v0.11.10
+    rev: v0.15.15
    hooks:
      # Run the linter.
      - id: ruff
@@ -12,7 +19,7 @@ repos:
      # Run the formatter.
      - id: ruff-format
  - repo: https://github.com/PyCQA/flake8
-    rev: 7.2.0
+    rev: 7.3.0
    hooks:
      - id: flake8
        additional_dependencies:
@@ -20,22 +27,25 @@ repos:
          - pydocstyle==5.1.1
        files: ^(esphome|tests)/.+\.py$
  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v3.4.0
+    rev: v5.0.0
    hooks:
      - id: no-commit-to-branch
        args:
          - --branch=dev
          - --branch=release
          - --branch=beta
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
  - repo: https://github.com/asottile/pyupgrade
-    rev: v3.20.0
+    rev: v3.21.2
    hooks:
      - id: pyupgrade
-        args: [--py310-plus]
+        args: [--py311-plus]
  - repo: https://github.com/adrienverge/yamllint.git
    rev: v1.37.1
    hooks:
      - id: yamllint
+        exclude: ^(\.clang-format|\.clang-tidy)$
  - repo: https://github.com/pre-commit/mirrors-clang-format
    rev: v13.0.1
    hooks:
@@ -45,6 +55,11 @@ repos:
    hooks:
      - id: pylint
        name: pylint
-        entry: python3 script/run-in-env.py pylint
+        entry: python script/run-in-env.py pylint
        language: system
        types: [python]
+        files: ^esphome/.+\.py$
+      - id: ci-custom
+        name: ci-custom
+        entry: python script/run-in-env.py script/ci-custom.py
+        language: system
@@ -0,0 +1,713 @@
+# ESPHome AI Collaboration Guide
+
+This document provides essential context for AI models interacting with this project. Adhering to these guidelines will ensure consistency and maintain code quality.
+
+## 1. Project Overview & Purpose
+
+*   **Primary Goal:** ESPHome is a system to configure microcontrollers (like ESP32, ESP8266, RP2040, and LibreTiny-based chips) using simple yet powerful YAML configuration files. It generates C++ firmware that can be compiled and flashed to these devices, allowing users to control them remotely through home automation systems.
+*   **Business Domain:** Internet of Things (IoT), Home Automation.
+
+## 2. Core Technologies & Stack
+
+*   **Languages:** Python (>=3.11), C++ (gnu++20)
+*   **Frameworks & Runtimes:** PlatformIO, Arduino, ESP-IDF.
+*   **Build Systems:** PlatformIO is the primary build system. CMake is used as an alternative.
+*   **Configuration:** YAML.
+*   **Key Libraries/Dependencies:**
+    *   **Python:** `voluptuous` (for configuration validation), `PyYAML` (for parsing configuration files), `paho-mqtt` (for MQTT communication), `tornado` (for the web server), `aioesphomeapi` (for the native API).
+    *   **C++:** `ArduinoJson` (for JSON serialization/deserialization), `AsyncMqttClient-esphome` (for MQTT), `ESPAsyncWebServer` (for the web server).
+*   **Package Manager(s):** `pip` (for Python dependencies), `platformio` (for C++/PlatformIO dependencies).
+*   **Communication Protocols:** Protobuf (for native API), MQTT, HTTP.
+
+## 3. Architectural Patterns
+
+*   **Overall Architecture:** The project follows a code-generation architecture. The Python code parses user-defined YAML configuration files and generates C++ source code. This C++ code is then compiled and flashed to the target microcontroller using PlatformIO.
+
+*   **Directory Structure Philosophy:**
+    *   `/esphome`: Contains the core Python source code for the ESPHome application.
+    *   `/esphome/components`: Contains the individual components that can be used in ESPHome configurations. Each component is a self-contained unit with its own C++ and Python code.
+    *   `/tests`: Contains all unit and integration tests for the Python code.
+    *   `/docker`: Contains Docker-related files for building and running ESPHome in a container.
+    *   `/script`: Contains helper scripts for development and maintenance.
+
+*   **Core Architectural Components:**
+    1.  **Configuration System** (`esphome/config*.py`): Handles YAML parsing and validation using Voluptuous, schema definitions, and multi-platform configurations.
+    2.  **Code Generation** (`esphome/codegen.py`, `esphome/cpp_generator.py`): Manages Python to C++ code generation, template processing, and build flag management.
+    3.  **Component System** (`esphome/components/`): Contains modular hardware and software components with platform-specific implementations and dependency management.
+    4.  **Core Framework** (`esphome/core/`): Manages the application lifecycle, hardware abstraction, and component registration.
+    5.  **Dashboard** (`esphome/dashboard/`): A web-based interface for device configuration, management, and OTA updates.
+
+*   **Platform Support:**
+    1.  **ESP32** (`components/esp32/`): Espressif ESP32 family. Supports multiple variants (Original, C2, C3, C5, C6, H2, P4, S2, S3) with ESP-IDF framework. Arduino framework supports only a subset of the variants (Original, C3, S2, S3).
+    2.  **ESP8266** (`components/esp8266/`): Espressif ESP8266. Arduino framework only, with memory constraints.
+    3.  **RP2040** (`components/rp2040/`): Raspberry Pi Pico/RP2040. Arduino framework with PIO (Programmable I/O) support.
+    4.  **LibreTiny** (`components/libretiny/`): Realtek and Beken chips. Supports multiple chip families and auto-generated components.
+
+## 4. Coding Conventions & Style Guide
+
+*   **Formatting:**
+    *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
+    *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
+
+*   **Naming Conventions:**
+    *   **Python:** Follows PEP 8. Use clear, descriptive names following snake_case.
+    *   **C++:** Follows the Google C++ Style Guide with these specifics (following clang-tidy conventions):
+        - Function, method, and variable names: `lower_snake_case`
+        - Class/struct/enum names: `UpperCamelCase`
+        - Top-level constants (global/namespace scope): `UPPER_SNAKE_CASE`
+        - Function-local constants: `lower_snake_case`
+        - Protected/private fields: `lower_snake_case_with_trailing_underscore_`
+        - Favor descriptive names over abbreviations
+
+*   **Python Idioms:**
+    *   **Assignment expressions (PEP 572):** Prefer the walrus operator (`:=`) wherever it removes a redundant lookup or a throwaway temporary. The most common case in component code is presence-checking a config key and then indexing it separately — fetch once with `.get()` and bind in the condition instead:
+        ```python
+        # Bad - looks up CONF_BLAH twice
+        if CONF_BLAH in config:
+            cg.add(var.set_blah(config[CONF_BLAH]))
+
+        # Good - single lookup, value bound inline
+        if (blah := config.get(CONF_BLAH)) is not None:
+            cg.add(var.set_blah(blah))
+        ```
+        The same applies to `while` loops and comprehensions where it avoids recomputing a value. Don't contort code to use it — reach for `:=` only when it genuinely cuts repetition or an extra assignment line.
+
+*   **C++ Field Visibility:**
+    *   **Prefer `protected`:** Use `protected` for most class fields to enable extensibility and testing. Fields should be `lower_snake_case_with_trailing_underscore_`.
+    *   **Use `private` for safety-critical cases:** Use `private` visibility when direct field access could introduce bugs or violate invariants:
+        1. **Pointer lifetime issues:** When setters validate and store pointers from known lists to prevent dangling references.
+           ```cpp
+           // Helper to find matching string in vector and return its pointer
+           inline const char *vector_find(const std::vector<const char *> &vec, const char *value) {
+             for (const char *item : vec) {
+               if (strcmp(item, value) == 0)
+                 return item;
+             }
+             return nullptr;
+           }
+
+           class ClimateDevice {
+            public:
+             void set_custom_fan_modes(std::initializer_list<const char *> modes) {
+               this->custom_fan_modes_ = modes;
+               this->active_custom_fan_mode_ = nullptr;  // Reset when modes change
+             }
+             bool set_custom_fan_mode(const char *mode) {
+               // Find mode in supported list and store that pointer (not the input pointer)
+               const char *validated_mode = vector_find(this->custom_fan_modes_, mode);
+               if (validated_mode != nullptr) {
+                 this->active_custom_fan_mode_ = validated_mode;
+                 return true;
+               }
+               return false;
+             }
+            private:
+             std::vector<const char *> custom_fan_modes_;  // Pointers to string literals in flash
+             const char *active_custom_fan_mode_{nullptr};  // Must point to entry in custom_fan_modes_
+           };
+           ```
+        2. **Invariant coupling:** When multiple fields must remain synchronized to prevent buffer overflows or data corruption.
+           ```cpp
+           class Buffer {
+            public:
+             void resize(size_t new_size) {
+               auto new_data = std::make_unique<uint8_t[]>(new_size);
+               if (this->data_) {
+                 std::memcpy(new_data.get(), this->data_.get(), std::min(this->size_, new_size));
+               }
+               this->data_ = std::move(new_data);
+               this->size_ = new_size;  // Must stay in sync with data_
+             }
+            private:
+             std::unique_ptr<uint8_t[]> data_;
+             size_t size_{0};  // Must match allocated size of data_
+           };
+           ```
+        3. **Resource management:** When setters perform cleanup or registration operations that derived classes might skip.
+    *   **Provide `protected` accessor methods:** When derived classes need controlled access to `private` members.
+
+*   **C++ Preprocessor Directives:**
+    *   **Avoid `#define` for constants:** Using `#define` for constants is discouraged and should be replaced with `const` variables or enums.
+    *   **Use `#define` only for:**
+        - Conditional compilation (`#ifdef`, `#ifndef`)
+        - Compile-time sizes calculated during Python code generation (e.g., configuring `std::array` or `StaticVector` dimensions via `cg.add_define()`)
+
+*   **C++ Additional Conventions:**
+    *   **Member access:** Prefix all class member access with `this->` (e.g., `this->value_` not `value_`)
+    *   **Indentation:** Use spaces (two per indentation level), not tabs
+    *   **Type aliases:** Prefer `using type_t = int;` over `typedef int type_t;`
+    *   **Line length:** Wrap lines at no more than 120 characters
+    *   **Constructor parameters vs setters:** Component properties that are both **required** and **invariant**
+        (never change after construction) should be constructor parameters rather than set via setter methods.
+        This makes the dependency explicit and prevents use of the object in an incompletely-initialized state.
+        In code generation, when calling `cg.new_Pvariable()` or the relevant helper function to create the component, pass these as arguments.
+        ```cpp
+        // Good - required invariant dependency as constructor parameter
+        class SourceTextSensor : public text_sensor::TextSensor, public Component {
+         public:
+          explicit SourceTextSensor(text::Text *source) : source_(source) {}
+         protected:
+          text::Text *source_;
+        };
+        ```
+        ```cpp
+        // Bad - required invariant dependency as setter
+        class SourceTextSensor : public text_sensor::TextSensor, public Component {
+         public:
+          void set_source(text::Text *source) { this->source_ = source; }
+         protected:
+          text::Text *source_{nullptr};
+        };
+        ```
+
+*   **Component Structure:**
+    *   **Standard Files:**
+        ```
+        components/[component_name]/
+        ├── __init__.py          # Component configuration schema and code generation
+        ├── [component].h        # C++ header file (if needed)
+        ├── [component].cpp      # C++ implementation (if needed)
+        └── [platform]/          # Platform-specific implementations
+            ├── __init__.py      # Platform-specific configuration
+            ├── [platform].h     # Platform C++ header
+            └── [platform].cpp   # Platform C++ implementation
+        ```
+
+    *   **Component Metadata:**
+        - `DEPENDENCIES`: List of required components
+        - `AUTO_LOAD`: Components to automatically load
+        - `CONFLICTS_WITH`: Incompatible components
+        - `CODEOWNERS`: GitHub usernames responsible for maintenance
+        - `MULTI_CONF`: Whether multiple instances are allowed
+
+*   **Code Generation & Common Patterns:**
+    *   **Configuration Schema Pattern:**
+        ```python
+        import esphome.codegen as cg
+        import esphome.config_validation as cv
+        from esphome.const import CONF_KEY, CONF_ID
+
+        CONF_PARAM = "param"  # A constant that does not yet exist in esphome/const.py
+
+        my_component_ns = cg.esphome_ns.namespace("my_component")
+        MyComponent = my_component_ns.class_("MyComponent", cg.Component)
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Required(CONF_KEY): cv.string,
+            cv.Optional(CONF_PARAM, default=42): cv.int_,
+        }).extend(cv.COMPONENT_SCHEMA)
+
+        async def to_code(config):
+            var = cg.new_Pvariable(config[CONF_ID])
+            await cg.register_component(var, config)
+            cg.add(var.set_key(config[CONF_KEY]))
+            cg.add(var.set_param(config[CONF_PARAM]))
+        ```
+
+    *   **C++ Class Pattern:**
+        ```cpp
+        namespace esphome::my_component {
+
+        class MyComponent : public Component {
+         public:
+          void setup() override;
+          void loop() override;
+          void dump_config() override;
+
+          void set_key(const std::string &key) { this->key_ = key; }
+          void set_param(int param) { this->param_ = param; }
+
+         protected:
+          std::string key_;
+          int param_{0};
+        };
+
+        }  // namespace esphome::my_component
+        ```
+
+    *   **Common Component Examples:**
+        - **Sensor:**
+          ```python
+          from esphome.components import sensor
+          CONFIG_SCHEMA = sensor.sensor_schema(MySensor).extend(cv.polling_component_schema("60s"))
+          async def to_code(config):
+              var = await sensor.new_sensor(config)
+              await cg.register_component(var, config)
+          ```
+
+        - **Binary Sensor:**
+          ```python
+          from esphome.components import binary_sensor
+          CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend({ ... })
+          async def to_code(config):
+              var = await binary_sensor.new_binary_sensor(config)
+          ```
+
+        - **Switch:**
+          ```python
+          from esphome.components import switch
+          CONFIG_SCHEMA = switch.switch_schema().extend({ ... })
+          async def to_code(config):
+              var = await switch.new_switch(config)
+          ```
+
+*   **Automations (Triggers, Actions, Conditions):**
+
+    Automations have three building blocks: **Triggers** (fire when something happens), **Actions** (do something), and **Conditions** (check if something is true).
+
+    *   **Triggers -- Callback method (preferred):**
+
+        Use `build_callback_automation()` for simple triggers. This eliminates the need for a C++ Trigger class by using a lightweight pointer-sized forwarder struct registered directly as a callback. No `CONF_TRIGGER_ID` in the schema.
+
+        **Python:**
+        ```python
+        from esphome import automation
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Optional(CONF_ON_STATE): automation.validate_automation({}),
+        }).extend(cv.COMPONENT_SCHEMA)
+
+        async def to_code(config):
+            var = cg.new_Pvariable(config[CONF_ID])
+            await cg.register_component(var, config)
+            for conf in config.get(CONF_ON_STATE, []):
+                await automation.build_callback_automation(
+                    var, "add_on_state_callback", [(bool, "x")], conf
+                )
+        ```
+
+        `build_callback_automation` arguments: `parent`, `callback_method` (C++ method name), `args` (template args as `[(type, name)]` tuples), `config`, and optional `forwarder` (defaults to `TriggerForwarder<Ts...>`).
+
+        For boolean filtering (e.g. `on_press`/`on_release`), use built-in forwarders with `args=[]`:
+        ```python
+        for conf_key, forwarder in (
+            (CONF_ON_PRESS, automation.TriggerOnTrueForwarder),
+            (CONF_ON_RELEASE, automation.TriggerOnFalseForwarder),
+        ):
+            for conf in config.get(conf_key, []):
+                await automation.build_callback_automation(
+                    var, "add_on_state_callback", [], conf, forwarder=forwarder
+                )
+        ```
+
+        **C++ -- no trigger class needed.** The callback registration method must be templatized to accept both `std::function` and lightweight forwarder structs (which avoid heap allocation):
+        ```cpp
+        class MyComponent : public Component {
+         public:
+          // Must be a template -- accepts both std::function and pointer-sized forwarder structs
+          template<typename F> void add_on_state_callback(F &&callback) {
+            this->state_callback_.add(std::forward<F>(callback));
+          }
+         protected:
+          // Use CallbackManager when callbacks are always registered (e.g. core components)
+          CallbackManager<void(bool)> state_callback_;
+          // Use LazyCallbackManager when callbacks are often not registered -- saves 8 bytes
+          // (nullptr vs empty std::vector) per instance when no callbacks are added
+          // LazyCallbackManager<void(bool)> state_callback_;
+        };
+        ```
+
+    *   **Triggers -- Trigger class method:**
+
+        Use `build_automation()` with a `Trigger<Ts...>` subclass only when the forwarder needs **mutable state beyond a single `Automation*` pointer** (e.g. edge detection tracking previous state, timing logic).
+
+        **Python:**
+        ```python
+        TurnOnTrigger = my_ns.class_("TurnOnTrigger", automation.Trigger.template())
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.Optional(CONF_ON_TURN_ON): automation.validate_automation(
+                {cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(TurnOnTrigger)}
+            ),
+        })
+
+        async def to_code(config):
+            for conf in config.get(CONF_ON_TURN_ON, []):
+                trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+                await automation.build_automation(trigger, [], conf)
+        ```
+
+        **C++:**
+        ```cpp
+        class TurnOnTrigger : public Trigger<> {
+         public:
+          explicit TurnOnTrigger(MyComponent *parent) : last_on_{false} {
+            parent->add_on_state_callback([this](bool state) {
+              if (state && !this->last_on_)
+                this->trigger();
+              this->last_on_ = state;
+            });
+          }
+         protected:
+          bool last_on_;
+        };
+        ```
+
+    *   **Actions:**
+        ```cpp
+        template<typename... Ts> class MyAction : public Action<Ts...> {
+         public:
+          explicit MyAction(MyComponent *parent) : parent_(parent) {}
+          void play(const Ts &...) override { this->parent_->do_something(); }
+         protected:
+          MyComponent *parent_;
+        };
+        ```
+        Register with `@automation.register_action("my_component.do_something", MyAction, schema, synchronous=True)`. Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
+
+    *   **Conditions:**
+        ```cpp
+        template<typename... Ts> class MyCondition : public Condition<Ts...> {
+         public:
+          explicit MyCondition(MyComponent *parent) : parent_(parent) {}
+          bool check(const Ts &...) override { return this->parent_->is_active(); }
+         protected:
+          MyComponent *parent_;
+        };
+        ```
+        Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.
+
+*   **Configuration Validation:**
+    *   **Common Validators:** `cv.int_`, `cv.float_`, `cv.string`, `cv.boolean`, `cv.int_range(min=0, max=100)`, `cv.positive_int`, `cv.percentage`.
+    *   **Complex Validation:** `cv.All(cv.string, cv.Length(min=1, max=50))`, `cv.Any(cv.int_, cv.string)`.
+    *   **Platform-Specific:** `cv.only_on(["esp32", "esp8266"])`, `esp32.only_on_variant(...)`, `cv.only_on_esp32`, `cv.only_on_esp8266`, `cv.only_on_rp2040`.
+    *   **Framework-Specific:** `cv.only_with_framework(...)`, `cv.only_with_arduino`, `cv.only_with_esp_idf`.
+    *   **Schema Extensions:**
+        ```python
+        CONFIG_SCHEMA = cv.Schema({ ... })
+         .extend(cv.COMPONENT_SCHEMA)
+         .extend(uart.UART_DEVICE_SCHEMA)
+         .extend(i2c.i2c_device_schema(0x48))
+         .extend(spi.spi_device_schema(cs_pin_required=True))
+        ```
+
+## 5. Key Files & Entrypoints
+
+*   **Main Entrypoint(s):** `esphome/__main__.py` is the main entrypoint for the ESPHome command-line interface.
+*   **Configuration:**
+    *   `pyproject.toml`: Defines the Python project metadata and dependencies.
+    *   `platformio.ini`: Configures the PlatformIO build environments for different microcontrollers.
+    *   `.pre-commit-config.yaml`: Configures the pre-commit hooks for linting and formatting.
+*   **CI/CD Pipeline:** Defined in `.github/workflows`.
+*   **Static Analysis & Development:**
+    *   `esphome/core/defines.h`: A comprehensive header file containing all `#define` directives that can be added by components using `cg.add_define()` in Python. This file is used exclusively for development, static analysis tools, and CI testing - it is not used during runtime compilation. When developing components that add new defines, they must be added to this file to ensure proper IDE support and static analysis coverage. The file includes feature flags, build configurations, and platform-specific defines that help static analyzers understand the complete codebase without needing to compile for specific platforms.
+
+## 6. Development & Testing Workflow
+
+*   **Local Development Environment:** Use the provided Docker container or create a Python virtual environment and install dependencies from `requirements_dev.txt`.
+*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py pre-commit run`.
+*   **Testing:**
+    *   **Python:** Run unit tests with `pytest`.
+    *   **C++:** Use `clang-tidy` for static analysis.
+    *   **Component Tests:** YAML-based compilation tests are located in `tests/`. The structure is as follows:
+        ```
+        tests/
+        ├── test_build_components/
+        │   └── common/          # Shared bus packages (uart, i2c, spi, etc.)
+        │       ├── uart/        # UART at default baud rate
+        │       ├── uart_115200/ # UART at 115200 baud
+        │       ├── i2c/         # I2C bus
+        │       └── spi/         # SPI bus
+        └── components/[component]/
+            ├── common.yaml          # Component-only config (no bus definitions)
+            ├── test.esp32-idf.yaml      # config + compile
+            ├── test.esp8266-ard.yaml    # config + compile
+            ├── test-variant.esp32-idf.yaml  # variant test, config + compile
+            ├── validate.esp32-idf.yaml      # config-only (never compiled)
+            └── validate-legacy.esp32-idf.yaml  # config-only variant
+        ```
+        Run them using `script/test_build_components`. Use `-c <component>` to test specific components and `-t <target>` for specific platforms.
+
+    *   **Config-only test files (`validate.*.yaml`):** Use this prefix when a YAML file only needs to exercise schema/validation paths and does not need to be compiled. CI runs `validate.*.yaml` files with `esphome config` only and skips them during compile. The grammar mirrors `test.*.yaml`:
+        - `validate.<platform>.yaml` — base config-only test
+        - `validate-<variant>.<platform>.yaml` — config-only variant
+
+        Use this for things like deprecated-syntax migration tests, schema edge cases, or platform-specific validation branches where building firmware adds no signal. A component may have any mix of `test.*.yaml` and `validate.*.yaml` files. Validate files never participate in bus-grouping; each one runs as its own `esphome config` invocation.
+
+        When a PR's only edits to a component are `validate.*.yaml` files (no source changes, no `test.*.yaml` changes, and the component isn't pulled in as a dependency of another changed component), CI skips the compile stage for that component entirely and only runs config validation. This is decided in `script/determine-jobs.py` via `_component_change_is_validate_only` and surfaced as the `validate_only_components` output that the `test-build-components-split` job consumes.
+
+    *   **Test Grouping with Packages:** Components that use shared bus packages can be grouped together in CI to reduce build count. **Never define buses (uart, i2c, spi, modbus) directly in test YAML files** — always use packages from `test_build_components/common/`:
+        ```yaml
+        # test.esp32-idf.yaml — use packages for buses
+        packages:
+          uart: !include ../../test_build_components/common/uart_115200/esp32-idf.yaml
+
+        <<: !include common.yaml
+        ```
+        ```yaml
+        # common.yaml — component config only, NO bus definitions
+        my_component:
+          id: my_instance
+
+        sensor:
+          - platform: my_component
+            name: My Sensor
+        ```
+        Components that define buses directly are flagged as "NEEDS MIGRATION" and cannot be grouped, increasing CI build time.
+
+    *   **Testing All Components Together:** To verify that all components can be tested together without ID conflicts or configuration issues, use:
+        ```bash
+        ./script/test_component_grouping.py -e config --all
+        ```
+        This tests all components in a single build to catch conflicts that might not appear when testing components individually. Use `-e config` for fast configuration validation, or `-e compile` for full compilation testing.
+*   **Debugging and Troubleshooting:**
+    *   **Debug Tools:**
+        - `esphome config <file>.yaml` to validate configuration.
+        - `esphome compile <file>.yaml` to compile without uploading.
+        - Check the Dashboard for real-time logs.
+        - Use component-specific debug logging.
+    *   **Common Issues:**
+        - **Import Errors**: Check component dependencies and `PYTHONPATH`.
+        - **Validation Errors**: Review configuration schema definitions.
+        - **Build Errors**: Check platform compatibility and library versions.
+        - **Runtime Errors**: Review generated C++ code and component logic.
+
+## 7. Specific Instructions for AI Collaboration
+
+*   **Contribution Workflow (Pull Request Process):**
+    1.  **Fork & Branch:** Create a new branch based on the `dev` branch (always use `git checkout -b <branch-name> dev` to ensure you're branching from `dev`, not the currently checked out branch).
+    2.  **Make Changes:** Adhere to all coding conventions and patterns.
+    3.  **Test:** Create component tests for all supported platforms and run the full test suite locally.
+    4.  **Lint:** Run `pre-commit` to ensure code is compliant.
+    5.  **Commit:** Commit your changes. There is no strict format for commit messages.
+    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title should have a prefix of the component being worked on (e.g., `[display] Fix bug`, `[abc123] Add new component`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+
+*   **Documentation Contributions:**
+    *   Documentation is hosted in the separate `esphome/esphome.io` repository.
+    *   The contribution workflow is the same as for the codebase.
+    *   When editing a component's documentation page, also update the corresponding component index page to ensure both pages remain in sync.
+
+*   **Best Practices:**
+    *   **Component Development:** Keep dependencies minimal, provide clear error messages, and write comprehensive docstrings and tests.
+    *   **Code Generation:** Generate minimal and efficient C++ code. Validate all user inputs thoroughly. Support multiple platform variations.
+    *   **Configuration Design:** Aim for simplicity with sensible defaults, while allowing for advanced customization.
+    *   **Embedded Systems Optimization:** ESPHome targets resource-constrained microcontrollers. Be mindful of flash size and RAM usage.
+
+        **Why Heap Allocation Matters:**
+
+        ESP devices run for months with small heaps shared between Wi-Fi, BLE, LWIP, and application code. Over time, repeated allocations of different sizes fragment the heap. Failures happen when the largest contiguous block shrinks, even if total free heap is still large. We have seen field crashes caused by this.
+
+        **Heap allocation after `setup()` should be avoided unless absolutely unavoidable.** Every allocation/deallocation cycle contributes to fragmentation. ESPHome treats runtime heap allocation as a long-term reliability bug, not a performance issue. Helpers that hide allocation (`std::string`, `std::to_string`, string-returning helpers) are being deprecated and replaced with buffer and view based APIs.
+
+        **STL Container Guidelines:**
+
+        ESPHome runs on embedded systems with limited resources. Choose containers carefully:
+
+        1. **Compile-time-known sizes:** Use `std::array` instead of `std::vector` when size is known at compile time.
+           ```cpp
+           // Bad - generates STL realloc code
+           std::vector<int> values;
+
+           // Good - no dynamic allocation
+           std::array<int, MAX_VALUES> values;
+           ```
+           Use `cg.add_define("MAX_VALUES", count)` to set the size from Python configuration.
+
+           **For byte buffers:** Avoid `std::vector<uint8_t>` unless the buffer needs to grow. Use `std::unique_ptr<uint8_t[]>` instead.
+
+           > **Note:** `std::unique_ptr<uint8_t[]>` does **not** provide bounds checking or iterator support like `std::vector<uint8_t>`. Use it only when you do not need these features and want minimal overhead.
+
+           ```cpp
+           // Bad - STL overhead for simple byte buffer
+           std::vector<uint8_t> buffer;
+           buffer.resize(256);
+
+           // Good - minimal overhead, single allocation
+           std::unique_ptr<uint8_t[]> buffer = std::make_unique<uint8_t[]>(256);
+           // Or if size is constant:
+           std::array<uint8_t, 256> buffer;
+           ```
+
+        2. **Compile-time-known fixed sizes with vector-like API:** Use `StaticVector` from `esphome/core/helpers.h` for compile-time fixed size with `push_back()` interface (no dynamic allocation).
+           ```cpp
+           // Bad - generates STL realloc code (_M_realloc_insert)
+           std::vector<ServiceRecord> services;
+           services.reserve(5);  // Still includes reallocation machinery
+
+           // Good - compile-time fixed size, no dynamic allocation
+           StaticVector<ServiceRecord, MAX_SERVICES> services;
+           services.push_back(record1);
+           ```
+           Use `cg.add_define("MAX_SERVICES", count)` to set the size from Python configuration.
+           Like `std::array` but with vector-like API (`push_back()`, `size()`) and no STL reallocation code.
+
+        3. **Runtime-known sizes:** Use `FixedVector` from `esphome/core/helpers.h` when the size is only known at runtime initialization.
+           ```cpp
+           // Bad - generates STL realloc code (_M_realloc_insert)
+           std::vector<TxtRecord> txt_records;
+           txt_records.reserve(5);  // Still includes reallocation machinery
+
+           // Good - runtime size, single allocation, no reallocation machinery
+           FixedVector<TxtRecord> txt_records;
+           txt_records.init(record_count);  // Initialize with exact size at runtime
+           ```
+           **Benefits:**
+           - Eliminates `_M_realloc_insert`, `_M_default_append` template instantiations (saves 200-500 bytes per instance)
+           - Single allocation, no upper bound needed
+           - No reallocation overhead
+           - Compatible with protobuf code generation when using `[(fixed_vector) = true]` option
+
+        4. **Small datasets (1-16 elements):** Use `std::vector` or `std::array` with simple structs instead of `std::map`/`std::set`/`std::unordered_map`.
+           ```cpp
+           // Bad - 2KB+ overhead for red-black tree/hash table
+           std::map<std::string, int> small_lookup;
+           std::unordered_map<int, std::string> tiny_map;
+
+           // Good - simple struct with linear search (std::vector is fine)
+           struct LookupEntry {
+             const char *key;
+             int value;
+           };
+           std::vector<LookupEntry> small_lookup = {
+             {"key1", 10},
+             {"key2", 20},
+             {"key3", 30},
+           };
+           // Or std::array if size is compile-time constant:
+           // std::array<LookupEntry, 3> small_lookup = {{ ... }};
+           ```
+           Linear search on small datasets (1-16 elements) is often faster than hashing/tree overhead, but this depends on lookup frequency and access patterns. For frequent lookups in hot code paths, the O(1) vs O(n) complexity difference may still matter even for small datasets. `std::vector` with simple structs is usually fine—it's the heavy containers (`map`, `set`, `unordered_map`) that should be avoided for small datasets unless profiling shows otherwise.
+
+        5. **Avoid `std::deque`:** It allocates in 512-byte blocks regardless of element size, guaranteeing at least 512 bytes of RAM usage immediately. This is a major source of crashes on memory-constrained devices.
+
+        6. **Detection:** Look for these patterns in compiler output:
+           - Large code sections with STL symbols (vector, map, set)
+           - `alloc`, `realloc`, `dealloc` in symbol names
+           - `_M_realloc_insert`, `_M_default_append` (vector reallocation)
+           - Red-black tree code (`rb_tree`, `_Rb_tree`)
+           - Hash table infrastructure (`unordered_map`, `hash`)
+
+        **Prioritize optimization effort for:**
+        - Core components (API, network, logger)
+        - Widely-used components (mdns, wifi, ble)
+        - Components causing flash size complaints
+
+        Note: Avoiding heap allocation after `setup()` is always required regardless of component type. The prioritization above is about the effort spent on container optimization (e.g., migrating from `std::vector` to `StaticVector`).
+
+        **Callback Managers:**
+
+        ESPHome provides two callback manager types in `esphome/core/helpers.h` for the observer pattern. Both support `std::function`, lambdas, and lightweight forwarder structs via their templatized `add()` method.
+
+        | Type | Idle overhead (32-bit) | When to use |
+        |------|----------------------|-------------|
+        | `CallbackManager<void(Ts...)>` | 12 bytes (empty `std::vector`) | Callbacks are always or almost always registered |
+        | `LazyCallbackManager<void(Ts...)>` | 4 bytes (`nullptr`) | Callbacks are often not registered (common case) |
+
+        `LazyCallbackManager` is a drop-in replacement for `CallbackManager` that defers allocation until the first callback is added. Prefer it for entity-level callbacks where most instances have no subscribers.
+
+        **Important:** Registration methods that add to a callback manager **must always be templatized** to accept both `std::function` and pointer-sized forwarder structs (used by `build_callback_automation`). Never use `std::function` in the method signature:
+        ```cpp
+        // Bad -- forces heap allocation for forwarder structs
+        void add_on_state_callback(std::function<void(bool)> &&callback) {
+          this->state_callback_.add(std::move(callback));
+        }
+
+        // Good -- accepts any callable without forcing std::function wrapping
+        template<typename F> void add_on_state_callback(F &&callback) {
+          this->state_callback_.add(std::forward<F>(callback));
+        }
+        ```
+
+    *   **State Management:** Use `CORE.data` for component state that needs to persist during configuration generation. Avoid module-level mutable globals.
+
+        **Bad Pattern (Module-Level Globals):**
+        ```python
+        # Don't do this - state persists between compilation runs
+        _component_state = []
+        _use_feature = None
+
+        def enable_feature():
+            global _use_feature
+            _use_feature = True
+        ```
+
+        **Bad Pattern (Flat Keys):**
+        ```python
+        # Don't do this - keys should be namespaced under component domain
+        MY_FEATURE_KEY = "my_component_feature"
+        CORE.data[MY_FEATURE_KEY] = True
+        ```
+
+        **Good Pattern (dataclass):**
+        ```python
+        from dataclasses import dataclass, field
+        from esphome.core import CORE
+
+        DOMAIN = "my_component"
+
+        @dataclass
+        class MyComponentData:
+            feature_enabled: bool = False
+            item_count: int = 0
+            items: list[str] = field(default_factory=list)
+
+        def _get_data() -> MyComponentData:
+            if DOMAIN not in CORE.data:
+                CORE.data[DOMAIN] = MyComponentData()
+            return CORE.data[DOMAIN]
+
+        def request_feature() -> None:
+            _get_data().feature_enabled = True
+
+        def add_item(item: str) -> None:
+            _get_data().items.append(item)
+        ```
+
+        If you need a real-world example, search for components that use `@dataclass` with `CORE.data` in the codebase. Note: Some components may use `TypedDict` for dictionary-based storage; both patterns are acceptable depending on your needs.
+
+        **Why this matters:**
+        - Module-level globals persist between compilation runs if the dashboard doesn't fork/exec
+        - `CORE.data` automatically clears between runs
+        - Namespacing under `DOMAIN` prevents key collisions between components
+        - `@dataclass` provides type safety and cleaner attribute access
+
+*   **Security:** Be mindful of security when making changes to the API, web server, or any other network-related code. Do not hardcode secrets or keys.
+
+*   **Dependencies & Build System Integration:**
+    *   **Python:** When adding a new Python dependency, add it to the appropriate `requirements*.txt` file and `pyproject.toml`.
+    *   **C++ / PlatformIO:** When adding a new C++ dependency, add it to `platformio.ini` and use `cg.add_library`.
+    *   **Build Flags:** Use `cg.add_build_flag(...)` to add compiler flags.
+
+## 8. Public API and Breaking Changes
+
+*   **Public C++ API:**
+    *   **Components**: Only documented features at [esphome.io](https://esphome.io) are public API. Undocumented `public` members are internal.
+    *   **Core/Base Classes** (`esphome/core/`, `Component`, `Sensor`, etc.): All `public` members are public API.
+    *   **Components with Global Accessors** (`global_api_server`, etc.): All `public` members are public API (except config setters).
+
+*   **Public Python API:**
+    *   All documented configuration options at [esphome.io](https://esphome.io) are public API.
+    *   Python code in `esphome/core/` actively used by existing core components is considered stable API.
+    *   Other Python code is internal unless explicitly documented for external component use.
+
+*   **Breaking Changes Policy:**
+    *   Aim for **6-month deprecation window** when possible
+    *   Clean breaks allowed for: signature changes, deep refactorings, resource constraints
+    *   Must document migration path in PR description (generates release notes)
+    *   Blog post required for core/base class changes or significant architectural changes
+    *   Full details: https://developers.esphome.io/contributing/code/#public-api-and-breaking-changes
+
+*   **Breaking Change Checklist:**
+    - [ ] Clear justification (RAM/flash savings, architectural improvement)
+    - [ ] Explored non-breaking alternatives
+    - [ ] Added deprecation warnings if possible (use `ESPDEPRECATED` macro for C++)
+    - [ ] Documented migration path in PR description with before/after examples
+    - [ ] Updated all internal usage and esphome.io
+    - [ ] Tested backward compatibility during deprecation period
+
+*   **Deprecation Pattern (C++):**
+    ```cpp
+    // Remove before 2026.6.0
+    ESPDEPRECATED("Use new_method() instead. Removed in 2026.6.0", "2025.12.0")
+    void old_method() { this->new_method(); }
+    ```
+
+*   **Deprecation Pattern (Python):**
+    ```python
+    # Remove before 2026.6.0
+    if CONF_OLD_KEY in config:
+        _LOGGER.warning(f"'{CONF_OLD_KEY}' deprecated, use '{CONF_NEW_KEY}'. Removed in 2026.6.0")
+        config[CONF_NEW_KEY] = config.pop(CONF_OLD_KEY)  # Auto-migrate
+    ```
@@ -0,0 +1 @@
+AGENTS.md
@@ -9,6 +9,7 @@
 pyproject.toml @esphome/core
 esphome/*.py @esphome/core
 esphome/core/* @esphome/core
+.github/** @esphome/core

 # Integrations
 esphome/components/a01nyub/* @MrSuicideParrot
@@ -18,17 +19,17 @@ esphome/components/ac_dimmer/* @glmnet
 esphome/components/adc/* @esphome/core
 esphome/components/adc128s102/* @DeerMaximum
 esphome/components/addressable_light/* @justfalter
-esphome/components/ade7880/* @kpfleming
 esphome/components/ade7953/* @angelnu
+esphome/components/ade7953_base/* @angelnu
 esphome/components/ade7953_i2c/* @angelnu
 esphome/components/ade7953_spi/* @angelnu
 esphome/components/ads1118/* @solomondg1
 esphome/components/ags10/* @mak-42
 esphome/components/aic3204/* @kbx81
 esphome/components/airthings_ble/* @jeromelaban
-esphome/components/airthings_wave_base/* @jeromelaban @kpfleming @ncareau
+esphome/components/airthings_wave_base/* @jeromelaban @ncareau
 esphome/components/airthings_wave_mini/* @ncareau
-esphome/components/airthings_wave_plus/* @jeromelaban
+esphome/components/airthings_wave_plus/* @jeromelaban @precurse
 esphome/components/alarm_control_panel/* @grahambrown11 @hwstar
 esphome/components/alpha3/* @jan-hofmeier
 esphome/components/am2315c/* @swoboda1337
@@ -39,11 +40,12 @@ esphome/components/analog_threshold/* @ianchi
 esphome/components/animation/* @syndlex
 esphome/components/anova/* @buxtronix
 esphome/components/apds9306/* @aodrenah
-esphome/components/api/* @OttoWinter
+esphome/components/api/* @esphome/core
+esphome/components/aqi/* @freekode @jasstrong @ximex
 esphome/components/as5600/* @ammmze
 esphome/components/as5600/sensor/* @ammmze
 esphome/components/as7341/* @mrgnr
-esphome/components/async_tcp/* @OttoWinter
+esphome/components/async_tcp/* @esphome/core
 esphome/components/at581x/* @X-Ryl669
 esphome/components/atc_mithermometer/* @ahpohl
 esphome/components/atm90e26/* @danieltwagner
@@ -51,6 +53,9 @@ esphome/components/atm90e32/* @circuitsetup @descipher
 esphome/components/audio/* @kahrendt
 esphome/components/audio_adc/* @kbx81
 esphome/components/audio_dac/* @kbx81
+esphome/components/audio_file/* @kahrendt
+esphome/components/audio_file/media_source/* @kahrendt
+esphome/components/audio_http/* @kahrendt
 esphome/components/axs15231/* @clydebarrow
 esphome/components/b_parasite/* @rbaron
 esphome/components/ballu/* @bazuchan
@@ -61,20 +66,24 @@ esphome/components/bedjet/fan/* @jhansche
 esphome/components/bedjet/sensor/* @javawizard @jhansche
 esphome/components/beken_spi_led_strip/* @Mat931
 esphome/components/bh1750/* @OttoWinter
+esphome/components/bh1900nux/* @B48D81EFCC
 esphome/components/binary_sensor/* @esphome/core
 esphome/components/bk72xx/* @kuba2k2
 esphome/components/bl0906/* @athom-tech @jesserockz @tarontop
 esphome/components/bl0939/* @ziceva
-esphome/components/bl0940/* @tobias-
+esphome/components/bl0940/* @dan-s-github @tobias-
 esphome/components/bl0942/* @dbuezas @dwmw2
 esphome/components/ble_client/* @buxtronix @clydebarrow
-esphome/components/bluetooth_proxy/* @jesserockz
+esphome/components/ble_nus/* @tomaszduda23
+esphome/components/bluetooth_proxy/* @bdraco @jesserockz
+esphome/components/bm8563/* @abmantis
 esphome/components/bme280_base/* @esphome/core
 esphome/components/bme280_spi/* @apbodrov
 esphome/components/bme680_bsec/* @trvrnrth
 esphome/components/bme68x_bsec2/* @kbx81 @neffs
 esphome/components/bme68x_bsec2_i2c/* @kbx81 @neffs
 esphome/components/bmi160/* @flaviut
+esphome/components/bmi270/* @clydebarrow
 esphome/components/bmp280_base/* @ademuri
 esphome/components/bmp280_i2c/* @ademuri
 esphome/components/bmp280_spi/* @ademuri
@@ -82,17 +91,24 @@ esphome/components/bmp3xx/* @latonita
 esphome/components/bmp3xx_base/* @latonita @martgras
 esphome/components/bmp3xx_i2c/* @latonita
 esphome/components/bmp3xx_spi/* @latonita
-esphome/components/bmp581/* @kahrendt
+esphome/components/bmp581_base/* @danielkent-net @kahrendt
+esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
+esphome/components/bmp581_spi/* @danielkent-net @kahrendt
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
+esphome/components/bthome_mithermometer/* @nagyrobi
 esphome/components/button/* @esphome/core
 esphome/components/bytebuffer/* @clydebarrow
+esphome/components/camera/* @bdraco @DT-art1
+esphome/components/camera_encoder/* @DT-art1
 esphome/components/canbus/* @danielschramm @mvturnho
 esphome/components/cap1188/* @mreditor97
-esphome/components/captive_portal/* @OttoWinter
+esphome/components/captive_portal/* @esphome/core
+esphome/components/cc1101/* @gabest11 @lygris
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
 esphome/components/ch422g/* @clydebarrow @jesterret
+esphome/components/ch423/* @dwmw2
 esphome/components/chsc6x/* @kkosik20
 esphome/components/climate/* @esphome/core
 esphome/components/climate_ir/* @glmnet
@@ -116,66 +132,77 @@ esphome/components/dallas_temp/* @ssieb
 esphome/components/daly_bms/* @s1lvi0
 esphome/components/dashboard_import/* @esphome/core
 esphome/components/datetime/* @jesserockz @rfdarter
-esphome/components/debug/* @OttoWinter
+esphome/components/debug/* @esphome/core
 esphome/components/delonghi/* @grob6000
+esphome/components/dew_point/* @CFlix
 esphome/components/dfplayer/* @glmnet
 esphome/components/dfrobot_sen0395/* @niklasweber
 esphome/components/dht/* @OttoWinter
 esphome/components/display_menu_base/* @numo68
+esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
-esphome/components/dsmr/* @glmnet @zuidwijk
+esphome/components/ds2484/* @mrk-its
+esphome/components/dsmr/* @glmnet @PolarGoose
 esphome/components/duty_time/* @dudanov
 esphome/components/ee895/* @Stock-M
 esphome/components/ektf2232/touchscreen/* @jesserockz
 esphome/components/emc2101/* @ellull
 esphome/components/emmeti/* @E440QF
+esphome/components/emontx/* @FredM67 @glynhudson @TrystanLea
 esphome/components/ens160/* @latonita
 esphome/components/ens160_base/* @latonita @vincentscode
 esphome/components/ens160_i2c/* @latonita
 esphome/components/ens160_spi/* @latonita
 esphome/components/ens210/* @itn3rd77
+esphome/components/epaper_spi/* @esphome/core
 esphome/components/es7210/* @kahrendt
 esphome/components/es7243e/* @kbx81
 esphome/components/es8156/* @kbx81
 esphome/components/es8311/* @kahrendt @kroimon
 esphome/components/es8388/* @P4uLT
 esphome/components/esp32/* @esphome/core
-esphome/components/esp32_ble/* @Rapsssito @jesserockz
-esphome/components/esp32_ble_client/* @jesserockz
-esphome/components/esp32_ble_server/* @Rapsssito @clydebarrow @jesserockz
+esphome/components/esp32_ble/* @bdraco @jesserockz @Rapsssito
+esphome/components/esp32_ble_client/* @bdraco @jesserockz
+esphome/components/esp32_ble_server/* @clydebarrow @jesserockz @Rapsssito
+esphome/components/esp32_ble_tracker/* @bdraco
 esphome/components/esp32_camera_web_server/* @ayufan
 esphome/components/esp32_can/* @Sympatron
+esphome/components/esp32_hosted/* @swoboda1337
+esphome/components/esp32_hosted/update/* @swoboda1337
 esphome/components/esp32_improv/* @jesserockz
 esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
 esphome/components/esp_ldo/* @clydebarrow
+esphome/components/espnow/* @jesserockz
+esphome/components/espnow/packet_transport/* @EasilyBoredEngineer
 esphome/components/ethernet_info/* @gtjadsonsantos
 esphome/components/event/* @nohat
-esphome/components/event_emitter/* @Rapsssito
 esphome/components/exposure_notifications/* @OttoWinter
 esphome/components/ezo/* @ssieb
 esphome/components/ezo_pmp/* @carlos-sarmiento
 esphome/components/factory_reset/* @anatoly-savchenkov
 esphome/components/fastled_base/* @OttoWinter
 esphome/components/feedback/* @ianchi
-esphome/components/fingerprint_grow/* @OnFreund @alexborro @loongyh
+esphome/components/fingerprint_grow/* @alexborro @loongyh @OnFreund
 esphome/components/font/* @clydebarrow @esphome/core
 esphome/components/fs3000/* @kahrendt
 esphome/components/ft5x06/* @clydebarrow
 esphome/components/ft63x6/* @gpambrozio
 esphome/components/gcja5/* @gcormier
 esphome/components/gdk101/* @Szewcson
+esphome/components/gl_r01_i2c/* @pkejval
 esphome/components/globals/* @esphome/core
 esphome/components/gp2y1010au0f/* @zry98
-esphome/components/gp8403/* @jesserockz
+esphome/components/gp8403/* @jesserockz @sebydocky
 esphome/components/gpio/* @esphome/core
 esphome/components/gpio/one_wire/* @ssieb
 esphome/components/gps/* @coogle @ximex
 esphome/components/graph/* @synco
 esphome/components/graphical_display_menu/* @MrMDavidson
 esphome/components/gree/* @orestismers
+esphome/components/gree/switch/* @nagyrobi
 esphome/components/grove_gas_mc_v2/* @YorkshireIoT
 esphome/components/grove_tb6612fng/* @max246
 esphome/components/growatt_solar/* @leeuwte
@@ -190,12 +217,19 @@ esphome/components/havells_solar/* @sourabhjaiswal
 esphome/components/hbridge/fan/* @WeekendWarrior
 esphome/components/hbridge/light/* @DotNetDann
 esphome/components/hbridge/switch/* @dwmw2
+esphome/components/hc8/* @omartijn
+esphome/components/hdc2010/* @optimusprimespace @ssieb
+esphome/components/hdc2080/* @G-Pereira @jesserockz
+esphome/components/hdc302x/* @joshuasing
 esphome/components/he60r/* @clydebarrow
 esphome/components/heatpumpir/* @rob-deutsch
 esphome/components/hitachi_ac424/* @sourabhjaiswal
+esphome/components/hlk_fm22x/* @OnFreund
+esphome/components/hlw8032/* @rici4kubicek
 esphome/components/hm3301/* @freekode
 esphome/components/hmac_md5/* @dwmw2
-esphome/components/homeassistant/* @OttoWinter @esphome/core
+esphome/components/hmac_sha256/* @dwmw2
+esphome/components/homeassistant/* @esphome/core @OttoWinter
 esphome/components/homeassistant/number/* @landonr
 esphome/components/homeassistant/switch/* @Links2004
 esphome/components/honeywell_hih_i2c/* @Benichou34
@@ -208,30 +242,32 @@ esphome/components/hte501/* @Stock-M
 esphome/components/http_request/ota/* @oarcher
 esphome/components/http_request/update/* @jesserockz
 esphome/components/htu31d/* @betterengineering
+esphome/components/hub75/* @stuartparmenter
 esphome/components/hydreon_rgxx/* @functionpointer
 esphome/components/hyt271/* @Philippe12
 esphome/components/i2c/* @esphome/core
 esphome/components/i2c_device/* @gabest11
 esphome/components/i2s_audio/* @jesserockz
-esphome/components/i2s_audio/media_player/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
 esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
 esphome/components/iaqcore/* @yozik04
 esphome/components/ili9xxx/* @clydebarrow @nielsnl68
 esphome/components/improv_base/* @esphome/core
 esphome/components/improv_serial/* @esphome/core
-esphome/components/ina226/* @Sergio303 @latonita
+esphome/components/ina226/* @latonita @Sergio303
 esphome/components/ina260/* @mreditor97
 esphome/components/ina2xx_base/* @latonita
 esphome/components/ina2xx_i2c/* @latonita
 esphome/components/ina2xx_spi/* @latonita
+esphome/components/infrared/* @kbx81
 esphome/components/inkbird_ibsth1_mini/* @fkirill
-esphome/components/inkplate6/* @jesserockz
+esphome/components/inkplate/* @jesserockz @JosipKuci
 esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
+esphome/components/ir_rf_proxy/* @kbx81
 esphome/components/jsn_sr04t/* @Mafus1
-esphome/components/json/* @OttoWinter
+esphome/components/json/* @esphome/core
 esphome/components/kamstrup_kmp/* @cfeenstra1024
 esphome/components/key_collector/* @ssieb
 esphome/components/key_provider/* @ssieb
@@ -239,17 +275,23 @@ esphome/components/kuntze/* @ssieb
 esphome/components/lc709203f/* @ilikecake
 esphome/components/lcd_menu/* @numo68
 esphome/components/ld2410/* @regevbr @sebcaps
+esphome/components/ld2412/* @Rihan9
 esphome/components/ld2420/* @descipher
 esphome/components/ld2450/* @hareeshmu
+esphome/components/ld24xx/* @kbx81
 esphome/components/ledc/* @OttoWinter
 esphome/components/libretiny/* @kuba2k2
 esphome/components/libretiny_pwm/* @kuba2k2
 esphome/components/light/* @esphome/core
 esphome/components/lightwaverf/* @max246
 esphome/components/lilygo_t5_47/touchscreen/* @jesserockz
+esphome/components/lm75b/* @beormund
+esphome/components/ln882x/* @lamauny
 esphome/components/lock/* @esphome/core
 esphome/components/logger/* @esphome/core
 esphome/components/logger/select/* @clydebarrow
+esphome/components/lps22/* @nagisa
+esphome/components/lsm6ds/* @clydebarrow
 esphome/components/ltr390/* @latonita @sjtrny
 esphome/components/ltr501/* @latonita
 esphome/components/ltr_als_ps/* @latonita
@@ -265,13 +307,14 @@ esphome/components/max7219digit/* @rspaargaren
 esphome/components/max9611/* @mckaymatthew
 esphome/components/mcp23008/* @jesserockz
 esphome/components/mcp23017/* @jesserockz
-esphome/components/mcp23s08/* @SenexCrenshaw @jesserockz
-esphome/components/mcp23s17/* @SenexCrenshaw @jesserockz
+esphome/components/mcp23s08/* @jesserockz @SenexCrenshaw
+esphome/components/mcp23s17/* @jesserockz @SenexCrenshaw
 esphome/components/mcp23x08_base/* @jesserockz
 esphome/components/mcp23x17_base/* @jesserockz
 esphome/components/mcp23xxx_base/* @jesserockz
 esphome/components/mcp2515/* @danielschramm @mvturnho
 esphome/components/mcp3204/* @rsumner
+esphome/components/mcp3221/* @philippderdiedas
 esphome/components/mcp4461/* @p1ngb4ck
 esphome/components/mcp4728/* @berfenger
 esphome/components/mcp47a1/* @jesserockz
@@ -280,14 +323,18 @@ esphome/components/mcp9808/* @k7hpn
 esphome/components/md5/* @esphome/core
 esphome/components/mdns/* @esphome/core
 esphome/components/media_player/* @jesserockz
+esphome/components/media_source/* @kahrendt
 esphome/components/micro_wake_word/* @jesserockz @kahrendt
-esphome/components/micronova/* @jorre05
+esphome/components/micronova/* @edenhaus @jorre05
 esphome/components/microphone/* @jesserockz @kahrendt
 esphome/components/mics_4514/* @jesserockz
 esphome/components/midea/* @dudanov
 esphome/components/midea_ir/* @dudanov
+esphome/components/mipi_dsi/* @clydebarrow
+esphome/components/mipi_rgb/* @clydebarrow
 esphome/components/mipi_spi/* @clydebarrow
 esphome/components/mitsubishi/* @RubyBailey
+esphome/components/mitsubishi_cn105/* @crnjan
 esphome/components/mixer/speaker/* @kahrendt
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
@@ -301,9 +348,11 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
+esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
+esphome/components/motion/* @esphome/core
 esphome/components/mpl3115a2/* @kbickar
 esphome/components/mpu6886/* @fabaff
 esphome/components/ms8607/* @e28eta
@@ -318,18 +367,22 @@ esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
 esphome/components/npi19/* @bakerkj
+esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core
 esphome/components/one_wire/* @ssieb
 esphome/components/online_image/* @clydebarrow @guillempages
 esphome/components/opentherm/* @olegtarasov
 esphome/components/openthread/* @mrene
+esphome/components/opt3001/* @ccutrer
 esphome/components/ota/* @esphome/core
 esphome/components/output/* @esphome/core
 esphome/components/packet_transport/* @clydebarrow
 esphome/components/pca6416a/* @Mat931
-esphome/components/pca9554/* @clydebarrow @hwstar
+esphome/components/pca9554/* @bdraco @clydebarrow @hwstar
 esphome/components/pcf85063/* @brogon
 esphome/components/pcf8563/* @KoenBreeman
+esphome/components/pcm5122/* @remcom
+esphome/components/pi4ioe5v6408/* @jesserockz
 esphome/components/pid/* @OttoWinter
 esphome/components/pipsolar/* @andreashergert1984
 esphome/components/pm1006/* @habbie
@@ -337,9 +390,9 @@ esphome/components/pm2005/* @andrewjswan
 esphome/components/pmsa003i/* @sjtrny
 esphome/components/pmsx003/* @ximex
 esphome/components/pmwcs3/* @SeByDocKy
-esphome/components/pn532/* @OttoWinter @jesserockz
-esphome/components/pn532_i2c/* @OttoWinter @jesserockz
-esphome/components/pn532_spi/* @OttoWinter @jesserockz
+esphome/components/pn532/* @jesserockz @OttoWinter
+esphome/components/pn532_i2c/* @jesserockz @OttoWinter
+esphome/components/pn532_spi/* @jesserockz @OttoWinter
 esphome/components/pn7150/* @jesserockz @kbx81
 esphome/components/pn7150_i2c/* @jesserockz @kbx81
 esphome/components/pn7160/* @jesserockz @kbx81
@@ -348,28 +401,36 @@ esphome/components/pn7160_spi/* @jesserockz @kbx81
 esphome/components/power_supply/* @esphome/core
 esphome/components/preferences/* @esphome/core
 esphome/components/psram/* @esphome/core
-esphome/components/pulse_meter/* @TrentHouliston @cstaahl @stevebaxter
+esphome/components/pulse_meter/* @cstaahl @stevebaxter @TrentHouliston
 esphome/components/pvvx_mithermometer/* @pasiz
 esphome/components/pylontech/* @functionpointer
 esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
 esphome/components/qspi_dbi/* @clydebarrow
 esphome/components/qwiic_pir/* @kahrendt
+esphome/components/radio_frequency/* @kbx81
 esphome/components/radon_eye_ble/* @jeffeb3
 esphome/components/radon_eye_rd200/* @jeffeb3
 esphome/components/rc522/* @glmnet
 esphome/components/rc522_i2c/* @glmnet
 esphome/components/rc522_spi/* @glmnet
+esphome/components/rd03d/* @jasstrong
 esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
+esphome/components/ring_buffer/* @kahrendt
+esphome/components/router/speaker/* @kahrendt
 esphome/components/rp2040/* @jesserockz
+esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
 esphome/components/rpi_dpi_rgb/* @clydebarrow
 esphome/components/rtl87xx/* @kuba2k2
-esphome/components/rtttl/* @glmnet
+esphome/components/rtttl/* @glmnet @ximex
+esphome/components/runtime_image/* @clydebarrow @guillempages @kahrendt
+esphome/components/runtime_stats/* @bdraco
+esphome/components/rx8130/* @beormund
 esphome/components/safe_mode/* @jsuanet @kbx81 @paulmonigatti
 esphome/components/scd4x/* @martgras @sjtrny
 esphome/components/script/* @esphome/core
@@ -384,11 +445,19 @@ esphome/components/select/* @esphome/core
 esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
+esphome/components/sen6x/* @martgras @mebner86 @tuct
+esphome/components/sendspin/* @kahrendt
+esphome/components/sendspin/media_player/* @kahrendt
+esphome/components/sendspin/media_source/* @kahrendt
+esphome/components/sendspin/sensor/* @kahrendt
+esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
+esphome/components/serial_proxy/* @kbx81
 esphome/components/sfa30/* @ghsensdev
 esphome/components/sgp40/* @SenexCrenshaw
-esphome/components/sgp4x/* @SenexCrenshaw @martgras
+esphome/components/sgp4x/* @martgras @SenexCrenshaw
+esphome/components/sha256/* @esphome/core
 esphome/components/shelly_dimmer/* @edge90 @rnauber
 esphome/components/sht3xd/* @mrtoy-me
 esphome/components/sht4x/* @sjtrny
@@ -405,11 +474,16 @@ esphome/components/sn74hc165/* @jesserockz
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
 esphome/components/sound_level/* @kahrendt
+esphome/components/spa06_base/* @danielkent-net
+esphome/components/spa06_i2c/* @danielkent-net
+esphome/components/spa06_spi/* @danielkent-net
 esphome/components/speaker/* @jesserockz @kahrendt
 esphome/components/speaker/media_player/* @kahrendt @synesthesiam
+esphome/components/speaker_source/* @kahrendt
 esphome/components/spi/* @clydebarrow @esphome/core
 esphome/components/spi_device/* @clydebarrow
 esphome/components/spi_led_strip/* @clydebarrow
+esphome/components/split_buffer/* @jesserockz
 esphome/components/sprinkler/* @kbx81
 esphome/components/sps30/* @martgras
 esphome/components/ssd1322_base/* @kbx81
@@ -431,11 +505,15 @@ esphome/components/st7735/* @SenexCrenshaw
 esphome/components/st7789v/* @kbx81
 esphome/components/st7920/* @marsjan155
 esphome/components/statsd/* @Links2004
+esphome/components/stts22h/* @B48D81EFCC
 esphome/components/substitutions/* @esphome/core
 esphome/components/sun/* @OttoWinter
 esphome/components/sun_gtil2/* @Mat931
 esphome/components/switch/* @esphome/core
 esphome/components/switch/binary_sensor/* @ssieb
+esphome/components/sx126x/* @swoboda1337
+esphome/components/sx127x/* @swoboda1337
+esphome/components/sy6970/* @linkedupbits
 esphome/components/syslog/* @clydebarrow
 esphome/components/t6615/* @tylermenezes
 esphome/components/tc74/* @sethgirvan
@@ -450,14 +528,16 @@ esphome/components/template/datetime/* @rfdarter
 esphome/components/template/event/* @nohat
 esphome/components/template/fan/* @ssieb
 esphome/components/text/* @mauritskorse
+esphome/components/thermopro_ble/* @sittner
 esphome/components/thermostat/* @kbx81
-esphome/components/time/* @OttoWinter
+esphome/components/time/* @esphome/core
+esphome/components/tinyusb/* @kbx81
 esphome/components/tlc5947/* @rnauber
 esphome/components/tlc5971/* @IJIJI
 esphome/components/tm1621/* @Philippe12
 esphome/components/tm1637/* @glmnet
 esphome/components/tm1638/* @skykingjwc
-esphome/components/tm1651/* @freekode
+esphome/components/tm1651/* @mrtoy-me
 esphome/components/tmp102/* @timsavage
 esphome/components/tmp1075/* @sybrenstuvel
 esphome/components/tmp117/* @Azimath
@@ -476,13 +556,16 @@ esphome/components/tuya/switch/* @jesserockz
 esphome/components/tuya/text_sensor/* @dentra
 esphome/components/uart/* @esphome/core
 esphome/components/uart/button/* @ssieb
+esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
-esphome/components/ultrasonic/* @OttoWinter
+esphome/components/ufm01/* @ljungqvist
+esphome/components/ultrasonic/* @ssieb @swoboda1337
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
+esphome/components/usb_cdc_acm/* @kbx81
 esphome/components/usb_host/* @clydebarrow
 esphome/components/usb_uart/* @clydebarrow
 esphome/components/valve/* @esphome/core
@@ -490,11 +573,13 @@ esphome/components/vbus/* @ssieb
 esphome/components/veml3235/* @kbx81
 esphome/components/veml7700/* @latonita
 esphome/components/version/* @esphome/core
-esphome/components/voice_assistant/* @jesserockz
+esphome/components/voice_assistant/* @jesserockz @kahrendt
 esphome/components/wake_on_lan/* @clydebarrow @willwill2will54
 esphome/components/watchdog/* @oarcher
+esphome/components/water_heater/* @dhoeben
 esphome/components/waveshare_epaper/* @clydebarrow
-esphome/components/web_server_base/* @OttoWinter
+esphome/components/web_server/ota/* @esphome/core
+esphome/components/web_server_base/* @esphome/core
 esphome/components/web_server_idf/* @dentra
 esphome/components/weikai/* @DrCoolZic
 esphome/components/weikai_i2c/* @DrCoolZic
@@ -512,7 +597,9 @@ esphome/components/wk2204_spi/* @DrCoolZic
 esphome/components/wk2212_i2c/* @DrCoolZic
 esphome/components/wk2212_spi/* @DrCoolZic
 esphome/components/wl_134/* @hobbypunk90
+esphome/components/wts01/* @alepee
 esphome/components/x9c/* @EtienneMD
+esphome/components/xdb401/* @RT530
 esphome/components/xgzp68xx/* @gcormier
 esphome/components/xiaomi_hhccjcy10/* @fariouche
 esphome/components/xiaomi_lywsd02mmc/* @juanluss31
@@ -520,8 +607,13 @@ esphome/components/xiaomi_lywsd03mmc/* @ahpohl
 esphome/components/xiaomi_mhoc303/* @drug123
 esphome/components/xiaomi_mhoc401/* @vevsvevs
 esphome/components/xiaomi_rtcgq02lm/* @jesserockz
+esphome/components/xiaomi_xmwsdj04mmc/* @medusalix
 esphome/components/xl9535/* @mreditor97
 esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
 esphome/components/xxtea/* @clydebarrow
+esphome/components/zephyr/* @tomaszduda23
+esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
 esphome/components/zhlt01/* @cfeenstra1024
+esphome/components/zigbee/* @luar123 @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt
+esphome/components/zwave_proxy/* @kbx81
@@ -2,12 +2,12 @@

 We welcome contributions to the ESPHome suite of code and documentation!

-Please read our [contributing guide](https://esphome.io/guides/contributing.html) if you wish to contribute to the
+Please read our [contributing guide](https://developers.esphome.io/contributing/code/) if you wish to contribute to the
 project and be sure to join us on [Discord](https://discord.gg/KhAMKrd).

 **See also:**

-[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/issues/issues) -- [Feature requests](https://github.com/esphome/feature-requests/issues)
+[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/esphome/issues) -- [Feature requests](https://github.com/orgs/esphome/discussions)

 ---

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 2025.6.1
+PROJECT_NUMBER         = 2026.7.0-dev

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -0,0 +1 @@
+AGENTS.md
@@ -1,6 +1,8 @@
 include LICENSE
 include README.md
 include requirements.txt
+recursive-include esphome *.yaml
 recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
+recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt
@@ -1,15 +1,15 @@
-# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/)
+# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/) [![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://codspeed.io/esphome/esphome)

 <a href="https://esphome.io/">
  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://esphome.io/_static/logo-text-on-dark.svg", alt="ESPHome Logo">
-    <img src="https://esphome.io/_static/logo-text-on-light.svg" alt="ESPHome Logo">
+    <source media="(prefers-color-scheme: dark)" srcset="https://media.esphome.io/logo/logo-text-on-dark.svg">
+    <img src="https://media.esphome.io/logo/logo-text-on-light.svg" alt="ESPHome Logo">
  </picture>
 </a>

 ---

-[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/issues/issues) -- [Feature requests](https://github.com/esphome/feature-requests/issues)
+[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/esphome/issues) -- [Feature requests](https://github.com/orgs/esphome/discussions)

 ---

@@ -0,0 +1,104 @@
+# ESPHome Threat Model
+
+This document defines the trust boundary for the **ESPHome** repository — the
+Python compiler/CLI and the device firmware it generates — so that real security
+bugs can be told apart from defense-in-depth improvements. It gives contributors,
+reviewers, and security researchers a clear answer to one question:
+**does this issue let an _unauthenticated_ attacker do something they shouldn't?**
+
+Related documents:
+
+- Deployment guidance for operators:
+  https://esphome.io/guides/security_best_practices/
+- The **Device Builder dashboard** (the web UI, its authentication, ingress,
+  Origin/Host gates, and peer-link pairing) lives in a separate repository and
+  has its own threat model. If your report concerns any of that, please read and
+  report there instead:
+  https://github.com/esphome/device-builder/blob/main/docs/THREAT_MODEL.md
+
+## The trust boundary
+
+For this repository there are two trusted inputs by design:
+
+1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
+   (see below).
+2. **Authenticated peers of a running device** — clients holding the device's
+   API encryption key / password, OTA password, or web server credentials.
+
+The security boundary is therefore **unauthenticated network traffic vs. those
+trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
+security bug.
+
+## Config authors are host-equivalent by design
+
+Anyone who can supply or edit a configuration is **trusted with full code
+execution on the host that runs `esphome`**, on purpose. This is what the product
+does, not a flaw. A config author can already, through fully supported features:
+
+- Run arbitrary **Python** at validation/compile time via `external_components:`
+  (and other component-import mechanisms) — ESPHome imports those packages as
+  ordinary Python.
+- Run arbitrary **shell** commands through the compile/validate/flash toolchain
+  that ESPHome invokes as subprocesses.
+- Read and write arbitrary files reachable by the process (e.g. via `!include`,
+  `packages:`, `dashboard_import:`, and generated build output).
+
+Because of this, a malicious config author is equivalent to shell access on the
+host running the build.
+
+## What is *not* a security vulnerability
+
+If exploiting an issue requires the ability to supply or edit configuration, it
+is **not** a vulnerability in ESPHome, because that ability already grants host
+code execution. This explicitly includes, among others:
+
+- Template / expression injection in substitutions or any YAML string value
+  (e.g. Jinja `${...}` evaluation reaching Python internals). This grants no
+  capability a config author lacks.
+- `!include` / `packages:` / `dashboard_import:` reading or fetching content
+  from surprising or remote locations.
+- The validator or compiler crashing or behaving unexpectedly on adversarial
+  YAML.
+- ESPHome running as root in the official container — that is the documented
+  deployment posture, reachable by the same caller through the features above.
+
+These do not warrant a CVE or coordinated disclosure. Hardening in these areas
+(for example, sandboxing template evaluation as least-surprise defense-in-depth)
+is welcome as a normal enhancement PR, framed as cleanliness rather than a
+security fix — not as a vulnerability remediation.
+
+## What we do defend
+
+These *are* security bugs in this repo, and we want to hear about them privately:
+
+- Memory-safety or protocol bugs in the generated **device firmware** that are
+  remotely triggerable over the network (native API, web server, OTA, BLE,
+  captive portal, etc.) **without** valid credentials.
+- Authentication or encryption bypass on the device — reaching API calls, OTA
+  updates, or the web server without the configured key/password.
+- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
+  below their documented guarantees.
+
+## Explicitly out of scope
+
+- Local attackers who already have shell access on the host that runs `esphome`.
+- Supply-chain attacks against ESPHome or its dependencies.
+- Operator-supplied hostile YAML (covered above — config authoring is trusted).
+- Attacks that require an already-authenticated device peer (someone who already
+  holds the API key / OTA / web credentials).
+- Anything in the dashboard / device-builder — report that in its own repository
+  (linked at the top).
+- The legacy bundled dashboard in this repo (`esphome/dashboard/`) — it is
+  deprecated and being replaced by Device Builder; report dashboard issues there.
+- Deployments where the operator removed protections or exposed credentials. See
+  the security best practices guide:
+  https://esphome.io/guides/security_best_practices/
+
+## Reporting a vulnerability
+
+If you believe you've found an issue that crosses the unauthenticated boundary
+above, please report it privately via GitHub Security Advisories rather than a
+public issue. For issues that require config-write access, please review this
+document first — they are very likely out of scope by design. For dashboard /
+device-builder issues, report against that repository and consult its threat
+model (linked at the top).
@@ -0,0 +1,18 @@
+coverage:
+  status:
+    patch:
+      default:
+        target: 100%
+        threshold: 0%
+    project:
+      default:
+        informational: true
+
+ignore:
+  - "esphome/components/**/*"
+  - "esphome/analyze_memory/**/*"
+  - "tests/integration/**/*"
+
+comment:
+  layout: "reach, diff, flags, files"
+  require_changes: true
@@ -1,19 +1,29 @@
 ARG BUILD_VERSION=dev
-ARG BUILD_OS=alpine
-ARG BUILD_BASE_VERSION=2025.04.0
+ARG BUILD_BASE_VERSION=2026.06.0
 ARG BUILD_TYPE=docker

-FROM ghcr.io/esphome/docker-base:${BUILD_OS}-${BUILD_BASE_VERSION} AS base-source-docker
-FROM ghcr.io/esphome/docker-base:${BUILD_OS}-ha-addon-${BUILD_BASE_VERSION} AS base-source-ha-addon
+FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base-source-docker
+FROM ghcr.io/esphome/docker-base:debian-ha-addon-${BUILD_BASE_VERSION} AS base-source-ha-addon

 ARG BUILD_TYPE
 FROM base-source-${BUILD_TYPE} AS base

-RUN git config --system --add safe.directory "*"
+RUN git config --system --add safe.directory "*" \
+    && git config --system advice.detachedHead false
+
+# Install build tools for Python packages that require compilation
+# (e.g., ruamel.yaml.clib used by ESP-IDF's idf-component-manager).
+# Also install libusb-1.0 at runtime so the ESP-IDF tools installer can
+# validate openocd-esp32 (it dynamically links libusb-1.0.so.0); without
+# it idf_tools.py rejects the openocd install with exit 127 and aborts
+# the whole framework setup.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends build-essential libusb-1.0-0 \
+    && rm -rf /var/lib/apt/lists/*

 ENV PIP_DISABLE_PIP_VERSION_CHECK=1

-RUN pip install --no-cache-dir -U pip uv==0.6.14
+RUN pip install --no-cache-dir -U pip uv==0.10.1

 COPY requirements.txt /

@@ -21,6 +31,9 @@ RUN \
    uv pip install --no-cache-dir \
    -r /requirements.txt

+# Install the ESPHome Device Builder dashboard.
+RUN uv pip install --no-cache-dir esphome-device-builder==1.0.12
+
 RUN \
    platformio settings set enable_telemetry No \
    && platformio settings set check_platformio_interval 1000000 \
@@ -20,6 +20,10 @@ TYPE_HA_ADDON = "ha-addon"
 TYPE_LINT = "lint"
 TYPES = [TYPE_DOCKER, TYPE_HA_ADDON, TYPE_LINT]

+REGISTRY_GHCR = "ghcr"
+REGISTRY_DOCKERHUB = "dockerhub"
+REGISTRIES = [REGISTRY_GHCR, REGISTRY_DOCKERHUB]
+

 parser = argparse.ArgumentParser()
 parser.add_argument(
@@ -34,6 +38,12 @@ parser.add_argument(
 parser.add_argument(
    "--build-type", choices=TYPES, required=True, help="The type of build to run"
 )
+parser.add_argument(
+    "--registry",
+    choices=REGISTRIES,
+    action="append",
+    help="Restrict to specific registries (default: all). May be passed multiple times.",
+)
 parser.add_argument(
    "--dry-run", action="store_true", help="Don't run any commands, just print them"
 )
@@ -45,6 +55,11 @@ build_parser.add_argument("--push", help="Also push the images", action="store_t
 build_parser.add_argument(
    "--load", help="Load the docker image locally", action="store_true"
 )
+build_parser.add_argument(
+    "--no-cache-to",
+    help="Don't write the build cache (avoids polluting the shared cache)",
+    action="store_true",
+)
 manifest_parser = subparsers.add_parser(
    "manifest", help="Create a manifest from already pushed images"
 )
@@ -90,16 +105,19 @@ def main():
    def run_command(*cmd, ignore_error: bool = False):
        print(f"$ {shlex.join(list(cmd))}")
        if not args.dry_run:
-            rc = subprocess.call(list(cmd))
+            rc = subprocess.call(list(cmd), close_fds=False)
            if rc != 0 and not ignore_error:
                print("Command failed")
                sys.exit(1)

+    registries = args.registry or REGISTRIES
+
    # detect channel from tag
    match = re.match(r"^(\d+\.\d+)(?:\.\d+)?(b\d+)?$", args.tag)
    major_minor_version = None
    if match is None:
-        channel = CHANNEL_DEV
+        # Custom tag (e.g. a branch name) -- push only the tag itself
+        channel = None
    elif match.group(2) is None:
        major_minor_version = match.group(1)
        channel = CHANNEL_RELEASE
@@ -128,11 +146,18 @@ def main():
            CHANNEL_DEV: "cache-dev",
            CHANNEL_BETA: "cache-beta",
            CHANNEL_RELEASE: "cache-latest",
-        }[channel]
-        cache_img = f"ghcr.io/{params.build_to}:{cache_tag}"
+        }.get(channel, "cache-dev")
+        # Cache images live alongside the pushed images; prefer GHCR when it is
+        # one of the selected registries, otherwise fall back to Docker Hub so a
+        # registry-restricted build doesn't need GHCR auth.
+        cache_prefix = "ghcr.io/" if REGISTRY_GHCR in registries else ""
+        cache_img = f"{cache_prefix}{params.build_to}:{cache_tag}"

-        imgs = [f"{params.build_to}:{tag}" for tag in tags_to_push]
-        imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]
+        imgs = []
+        if REGISTRY_DOCKERHUB in registries:
+            imgs += [f"{params.build_to}:{tag}" for tag in tags_to_push]
+        if REGISTRY_GHCR in registries:
+            imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]

        # 3. build
        cmd = [
@@ -155,7 +180,9 @@ def main():
        for img in imgs:
            cmd += ["--tag", img]
        if args.push:
-            cmd += ["--push", "--cache-to", f"type=registry,ref={cache_img},mode=max"]
+            cmd += ["--push"]
+            if not args.no_cache_to:
+                cmd += ["--cache-to", f"type=registry,ref={cache_img},mode=max"]
        if args.load:
            cmd += ["--load"]

@@ -163,20 +190,22 @@ def main():
    elif args.command == "manifest":
        manifest = DockerParams.for_type_arch(args.build_type, ARCH_AMD64).manifest_to

-        targets = [f"{manifest}:{tag}" for tag in tags_to_push]
-        targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
-        # 1. Create manifests
+        targets = []
+        if REGISTRY_DOCKERHUB in registries:
+            targets += [f"{manifest}:{tag}" for tag in tags_to_push]
+        if REGISTRY_GHCR in registries:
+            targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
+        # Use buildx imagetools (not `docker manifest`) so the per-arch sources,
+        # which buildx pushes as single-platform manifest lists, are combined
+        # and pushed correctly in one step.
        for target in targets:
-            cmd = ["docker", "manifest", "create", target]
+            cmd = ["docker", "buildx", "imagetools", "create", "--tag", target]
            for arch in ARCHS:
                src = f"{DockerParams.for_type_arch(args.build_type, arch).build_to}:{args.tag}"
                if target.startswith("ghcr.io"):
                    src = f"ghcr.io/{src}"
                cmd.append(src)
            run_command(*cmd)
-        # 2. Push manifests
-        for target in targets:
-            run_command("docker", "manifest", "push", target)


 if __name__ == "__main__":
@@ -27,4 +27,12 @@ if [[ -d /build ]]; then
    export ESPHOME_BUILD_PATH=/build
 fi

+# The default CMD is "dashboard /config". Route the dashboard to the new
+# Device Builder, but pass every other subcommand (compile, run, config,
+# logs, ...) straight through to the esphome CLI so direct CLI use keeps working.
+if [[ "$1" == "dashboard" ]]; then
+    shift
+    exec esphome-device-builder "$@"
+fi
+
 exec esphome "$@"
@@ -1,96 +0,0 @@
-types {
-    text/html                                        html htm shtml;
-    text/css                                         css;
-    text/xml                                         xml;
-    image/gif                                        gif;
-    image/jpeg                                       jpeg jpg;
-    application/javascript                           js;
-    application/atom+xml                             atom;
-    application/rss+xml                              rss;
-
-    text/mathml                                      mml;
-    text/plain                                       txt;
-    text/vnd.sun.j2me.app-descriptor                 jad;
-    text/vnd.wap.wml                                 wml;
-    text/x-component                                 htc;
-
-    image/png                                        png;
-    image/svg+xml                                    svg svgz;
-    image/tiff                                       tif tiff;
-    image/vnd.wap.wbmp                               wbmp;
-    image/webp                                       webp;
-    image/x-icon                                     ico;
-    image/x-jng                                      jng;
-    image/x-ms-bmp                                   bmp;
-
-    font/woff                                        woff;
-    font/woff2                                       woff2;
-
-    application/java-archive                         jar war ear;
-    application/json                                 json;
-    application/mac-binhex40                         hqx;
-    application/msword                               doc;
-    application/pdf                                  pdf;
-    application/postscript                           ps eps ai;
-    application/rtf                                  rtf;
-    application/vnd.apple.mpegurl                    m3u8;
-    application/vnd.google-earth.kml+xml             kml;
-    application/vnd.google-earth.kmz                 kmz;
-    application/vnd.ms-excel                         xls;
-    application/vnd.ms-fontobject                    eot;
-    application/vnd.ms-powerpoint                    ppt;
-    application/vnd.oasis.opendocument.graphics      odg;
-    application/vnd.oasis.opendocument.presentation  odp;
-    application/vnd.oasis.opendocument.spreadsheet   ods;
-    application/vnd.oasis.opendocument.text          odt;
-    application/vnd.openxmlformats-officedocument.presentationml.presentation
-                                                     pptx;
-    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
-                                                     xlsx;
-    application/vnd.openxmlformats-officedocument.wordprocessingml.document
-                                                     docx;
-    application/vnd.wap.wmlc                         wmlc;
-    application/x-7z-compressed                      7z;
-    application/x-cocoa                              cco;
-    application/x-java-archive-diff                  jardiff;
-    application/x-java-jnlp-file                     jnlp;
-    application/x-makeself                           run;
-    application/x-perl                               pl pm;
-    application/x-pilot                              prc pdb;
-    application/x-rar-compressed                     rar;
-    application/x-redhat-package-manager             rpm;
-    application/x-sea                                sea;
-    application/x-shockwave-flash                    swf;
-    application/x-stuffit                            sit;
-    application/x-tcl                                tcl tk;
-    application/x-x509-ca-cert                       der pem crt;
-    application/x-xpinstall                          xpi;
-    application/xhtml+xml                            xhtml;
-    application/xspf+xml                             xspf;
-    application/zip                                  zip;
-
-    application/octet-stream                         bin exe dll;
-    application/octet-stream                         deb;
-    application/octet-stream                         dmg;
-    application/octet-stream                         iso img;
-    application/octet-stream                         msi msp msm;
-
-    audio/midi                                       mid midi kar;
-    audio/mpeg                                       mp3;
-    audio/ogg                                        ogg;
-    audio/x-m4a                                      m4a;
-    audio/x-realaudio                                ra;
-
-    video/3gpp                                       3gpp 3gp;
-    video/mp2t                                       ts;
-    video/mp4                                        mp4;
-    video/mpeg                                       mpeg mpg;
-    video/quicktime                                  mov;
-    video/webm                                       webm;
-    video/x-flv                                      flv;
-    video/x-m4v                                      m4v;
-    video/x-mng                                      mng;
-    video/x-ms-asf                                   asx asf;
-    video/x-ms-wmv                                   wmv;
-    video/x-msvideo                                  avi;
-}
@@ -1,16 +0,0 @@
-proxy_http_version          1.1;
-proxy_ignore_client_abort   off;
-proxy_read_timeout          86400s;
-proxy_redirect              off;
-proxy_send_timeout          86400s;
-proxy_max_temp_file_size    0;
-
-proxy_set_header Accept-Encoding "";
-proxy_set_header Connection $connection_upgrade;
-proxy_set_header Host $http_host;
-proxy_set_header Upgrade $http_upgrade;
-proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-proxy_set_header X-Forwarded-Proto $scheme;
-proxy_set_header X-NginX-Proxy true;
-proxy_set_header X-Real-IP $remote_addr;
-proxy_set_header Authorization "";
@@ -1,8 +0,0 @@
-root            /dev/null;
-server_name     $hostname;
-
-client_max_body_size 512m;
-
-add_header X-Content-Type-Options nosniff;
-add_header X-XSS-Protection "1; mode=block";
-add_header X-Robots-Tag none;
@@ -1,8 +0,0 @@
-ssl_protocols TLSv1.2 TLSv1.3;
-ssl_prefer_server_ciphers off;
-ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
-ssl_session_timeout  10m;
-ssl_session_cache shared:SSL:10m;
-ssl_session_tickets off;
-ssl_stapling on;
-ssl_stapling_verify on;
@@ -1,3 +0,0 @@
-upstream esphome {
-    server unix:/var/run/esphome.sock;
-}
@@ -1,30 +0,0 @@
-daemon off;
-user root;
-pid /var/run/nginx.pid;
-worker_processes 1;
-error_log /proc/1/fd/1 error;
-events {
-    worker_connections 1024;
-}
-
-http {
-    include /etc/nginx/includes/mime.types;
-
-    access_log              off;
-    default_type            application/octet-stream;
-    gzip                    on;
-    keepalive_timeout       65;
-    sendfile                on;
-    server_tokens           off;
-
-    tcp_nodelay             on;
-    tcp_nopush              on;
-
-    map $http_upgrade $connection_upgrade {
-        default upgrade;
-        ''      close;
-    }
-
-    include /etc/nginx/includes/upstream.conf;
-    include /etc/nginx/servers/*.conf;
-}
@@ -1 +0,0 @@
-Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley)
@@ -1,28 +0,0 @@
-server {
-    {{ if not .ssl }}
-    listen 6052 default_server;
-    {{ else }}
-    listen 6052 default_server ssl http2;
-    {{ end }}
-
-    include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
-
-    {{ if .ssl }}
-    include /etc/nginx/includes/ssl_params.conf;
-
-    ssl_certificate /ssl/{{ .certfile }};
-    ssl_certificate_key /ssl/{{ .keyfile }};
-
-    # Redirect http requests to https on the same port.
-    # https://rageagainstshell.com/2016/11/redirect-http-to-https-on-the-same-port-in-nginx/
-    error_page 497 https://$http_host$request_uri;
-    {{ end }}
-
-    # Clear Home Assistant Ingress header
-    proxy_set_header X-HA-Ingress "";
-
-    location / {
-        proxy_pass http://esphome;
-    }
-}
@@ -1,18 +0,0 @@
-server {
-    listen 127.0.0.1:{{ .port }} default_server;
-    listen {{ .interface }}:{{ .port }} default_server;
-
-    include /etc/nginx/includes/server_params.conf;
-    include /etc/nginx/includes/proxy_params.conf;
-
-    # Set Home Assistant Ingress header
-    proxy_set_header X-HA-Ingress "YES";
-
-    location / {
-        allow   172.30.32.2;
-        allow   127.0.0.1;
-        deny    all;
-
-        proxy_pass http://esphome;
-    }
-}
@@ -16,7 +16,7 @@ fi

 port=$(bashio::addon.ingress_port)

-# Wait for NGINX to become available
+# Wait for the ESPHome Device Builder to become available
 bashio::net.wait_for "${port}" "127.0.0.1" 300

 config=$(\
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # ==============================================================================
 # Home Assistant Community Add-on: ESPHome
-# Take down the S6 supervision tree when ESPHome dashboard fails
+# Take down the S6 supervision tree when ESPHome Device Builder fails
 # ==============================================================================
 declare exit_code
 readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
@@ -10,7 +10,7 @@ readonly exit_code_service="${1}"
 readonly exit_code_signal="${2}"

 bashio::log.info \
-  "Service ESPHome dashboard exited with code ${exit_code_service}" \
+  "Service ESPHome Device Builder exited with code ${exit_code_service}" \
  "(by signal ${exit_code_signal})"

 if [[ "${exit_code_service}" -eq 256 ]]; then
@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # ==============================================================================
 # Community Hass.io Add-ons: ESPHome
-# Runs the ESPHome dashboard
+# Runs the ESPHome Device Builder
 # ==============================================================================
 readonly pio_cache_base=/data/cache/platformio

@@ -49,5 +49,21 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
    rm -rf /config/esphome/.esphome
 fi

-bashio::log.info "Starting ESPHome dashboard..."
-exec esphome dashboard /config/esphome --socket /var/run/esphome.sock --ha-addon
+# Only signal device-builder to expose the public LAN port when the operator
+# mapped port 6052, matching the legacy dashboard where nginx listened on the
+# fixed port 6052 only when it was configured. We use the mapping purely as a
+# presence check and don't forward the published value; device-builder binds
+# its default port 6052 (the fixed container port, as the legacy
+# "listen 6052" did). --ha-addon-allow-public is inert on its own: the no-auth
+# gate is the DISABLE_HA_AUTHENTICATION env var set above, so both opt-ins are
+# required to bind 6052 unauthenticated; either alone stays ingress-only.
+set --
+if bashio::var.has_value "$(bashio::addon.port 6052)"; then
+    set -- --ha-addon-allow-public
+fi
+
+bashio::log.info "Starting ESPHome Device Builder..."
+exec esphome-device-builder /config/esphome \
+    --ha-addon \
+    --ingress-port "$(bashio::addon.ingress_port)" \
+    "$@"
@@ -1,27 +0,0 @@
-#!/command/with-contenv bashio
-# shellcheck shell=bash
-# ==============================================================================
-# Community Hass.io Add-ons: ESPHome
-# Configures NGINX for use with ESPHome
-# ==============================================================================
-mkdir -p /var/log/nginx
-
-# Generate Ingress configuration
-bashio::var.json \
-    interface "$(bashio::addon.ip_address)" \
-    port "^$(bashio::addon.ingress_port)" \
-    | tempio \
-        -template /etc/nginx/templates/ingress.gtpl \
-        -out /etc/nginx/servers/ingress.conf
-
-# Generate direct access configuration, if enabled.
-if bashio::var.has_value "$(bashio::addon.port 6052)"; then
-    bashio::config.require.ssl
-    bashio::var.json \
-        certfile "$(bashio::config 'certfile')" \
-        keyfile "$(bashio::config 'keyfile')" \
-        ssl "^$(bashio::config 'ssl')" \
-        | tempio \
-            -template /etc/nginx/templates/direct.gtpl \
-            -out /etc/nginx/servers/direct.conf
-fi
@@ -1 +0,0 @@
-oneshot
@@ -1 +0,0 @@
-/etc/s6-overlay/s6-rc.d/init-nginx/run
@@ -1,25 +0,0 @@
-#!/command/with-contenv bashio
-# ==============================================================================
-# Community Hass.io Add-ons: ESPHome
-# Take down the S6 supervision tree when NGINX fails
-# ==============================================================================
-declare exit_code
-readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
-readonly exit_code_service="${1}"
-readonly exit_code_signal="${2}"
-
-bashio::log.info \
-  "Service NGINX exited with code ${exit_code_service}" \
-  "(by signal ${exit_code_signal})"
-
-if [[ "${exit_code_service}" -eq 256 ]]; then
-  if [[ "${exit_code_container}" -eq 0 ]]; then
-    echo $((128 + $exit_code_signal)) > /run/s6-linux-init-container-results/exitcode
-  fi
-  [[ "${exit_code_signal}" -eq 15 ]] && exec /run/s6/basedir/bin/halt
-elif [[ "${exit_code_service}" -ne 0 ]]; then
-  if [[ "${exit_code_container}" -eq 0 ]]; then
-    echo "${exit_code_service}" > /run/s6-linux-init-container-results/exitcode
-  fi
-  exec /run/s6/basedir/bin/halt
-fi
@@ -1,15 +0,0 @@
-#!/command/with-contenv bashio
-# shellcheck shell=bash
-# ==============================================================================
-# Community Hass.io Add-ons: ESPHome
-# Runs the NGINX proxy
-# ==============================================================================
-
-bashio::log.info "Waiting for ESPHome dashboard to come up..."
-
-while [[ ! -S /var/run/esphome.sock ]]; do
-  sleep 0.5
-done
-
-bashio::log.info "Starting NGINX..."
-exec nginx
@@ -1 +0,0 @@
-longrun
@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-bk72xx-arduino
+
+bk72xx:
+  board: generic-bk7231n-qfn32-tuya
+
+logger:
@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-ard-idf
+
+esp32:
+  variant: esp32
+  framework:
+    type: arduino
+  toolchain: esp-idf
+
+logger:
@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-ard-pio
+
+esp32:
+  variant: esp32
+  framework:
+    type: arduino
+  toolchain: platformio
+
+logger:
@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-idf-idf
+
+esp32:
+  variant: esp32
+  framework:
+    type: esp-idf
+  toolchain: esp-idf
+
+logger:
@@ -0,0 +1,10 @@
+esphome:
+  name: docker-test-esp32-idf-pio
+
+esp32:
+  variant: esp32
+  framework:
+    type: esp-idf
+  toolchain: platformio
+
+logger:
@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-esp8266-arduino
+
+esp8266:
+  board: d1_mini
+
+logger:
@@ -0,0 +1,6 @@
+esphome:
+  name: docker-test-host
+
+host:
+
+logger:
@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-ln882x-arduino
+
+ln882x:
+  board: generic-ln882hki
+
+logger:
@@ -0,0 +1,8 @@
+esphome:
+  name: docker-test-nrf52
+
+nrf52:
+  board: adafruit_itsybitsy_nrf52840
+  bootloader: adafruit_nrf52_sd140_v6
+
+logger:
@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-rp2040-arduino
+
+rp2040:
+  variant: rp2040
+
+logger:
@@ -0,0 +1,7 @@
+esphome:
+  name: docker-test-rtl87xx-arduino
+
+rtl87xx:
+  board: generic-rtl8710bn-2mb-788k
+
+logger:
@@ -0,0 +1,153 @@
+"""Address cache for DNS and mDNS lookups."""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Iterable
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def normalize_hostname(hostname: str) -> str:
+    """Normalize hostname for cache lookups.
+
+    Removes trailing dots and converts to lowercase.
+    """
+    return hostname.rstrip(".").lower()
+
+
+class AddressCache:
+    """Cache for DNS and mDNS address lookups.
+
+    This cache stores pre-resolved addresses from command-line arguments
+    to avoid slow DNS/mDNS lookups during builds.
+    """
+
+    def __init__(
+        self,
+        mdns_cache: dict[str, list[str]] | None = None,
+        dns_cache: dict[str, list[str]] | None = None,
+    ) -> None:
+        """Initialize the address cache.
+
+        Args:
+            mdns_cache: Pre-populated mDNS addresses (hostname -> IPs)
+            dns_cache: Pre-populated DNS addresses (hostname -> IPs)
+        """
+        self.mdns_cache = mdns_cache or {}
+        self.dns_cache = dns_cache or {}
+
+    def _get_cached_addresses(
+        self, hostname: str, cache: dict[str, list[str]], cache_type: str
+    ) -> list[str] | None:
+        """Get cached addresses from a specific cache.
+
+        Args:
+            hostname: The hostname to look up
+            cache: The cache dictionary to check
+            cache_type: Type of cache for logging ("mDNS" or "DNS")
+
+        Returns:
+            List of IP addresses if found in cache, None otherwise
+        """
+        normalized = normalize_hostname(hostname)
+        if addresses := cache.get(normalized):
+            _LOGGER.debug("Using %s cache for %s: %s", cache_type, hostname, addresses)
+            return addresses
+        return None
+
+    def get_mdns_addresses(self, hostname: str) -> list[str] | None:
+        """Get cached mDNS addresses for a hostname.
+
+        Args:
+            hostname: The hostname to look up (should end with .local)
+
+        Returns:
+            List of IP addresses if found in cache, None otherwise
+        """
+        return self._get_cached_addresses(hostname, self.mdns_cache, "mDNS")
+
+    def get_dns_addresses(self, hostname: str) -> list[str] | None:
+        """Get cached DNS addresses for a hostname.
+
+        Args:
+            hostname: The hostname to look up
+
+        Returns:
+            List of IP addresses if found in cache, None otherwise
+        """
+        return self._get_cached_addresses(hostname, self.dns_cache, "DNS")
+
+    def get_addresses(self, hostname: str) -> list[str] | None:
+        """Get cached addresses for a hostname.
+
+        Checks mDNS cache for .local domains, DNS cache otherwise.
+
+        Args:
+            hostname: The hostname to look up
+
+        Returns:
+            List of IP addresses if found in cache, None otherwise
+        """
+        normalized = normalize_hostname(hostname)
+        if normalized.endswith(".local"):
+            return self.get_mdns_addresses(hostname)
+        return self.get_dns_addresses(hostname)
+
+    def has_cache(self) -> bool:
+        """Check if any cache entries exist."""
+        return bool(self.mdns_cache or self.dns_cache)
+
+    def add_mdns_addresses(self, hostname: str, addresses: list[str]) -> None:
+        """Store resolved mDNS addresses for ``hostname`` in the cache.
+
+        Callers that discover ``.local`` hosts (e.g. via mDNS browse) can use
+        this to avoid a second resolution round-trip during the upload path.
+        No-op when ``addresses`` is empty.
+        """
+        if not addresses:
+            return
+        self.mdns_cache[normalize_hostname(hostname)] = addresses
+
+    @classmethod
+    def from_cli_args(
+        cls, mdns_args: Iterable[str], dns_args: Iterable[str]
+    ) -> AddressCache:
+        """Create cache from command-line arguments.
+
+        Args:
+            mdns_args: List of mDNS cache entries like ['host=ip1,ip2']
+            dns_args: List of DNS cache entries like ['host=ip1,ip2']
+
+        Returns:
+            Configured AddressCache instance
+        """
+        mdns_cache = cls._parse_cache_args(mdns_args)
+        dns_cache = cls._parse_cache_args(dns_args)
+        return cls(mdns_cache=mdns_cache, dns_cache=dns_cache)
+
+    @staticmethod
+    def _parse_cache_args(cache_args: Iterable[str]) -> dict[str, list[str]]:
+        """Parse cache arguments into a dictionary.
+
+        Args:
+            cache_args: List of cache mappings like ['host1=ip1,ip2', 'host2=ip3']
+
+        Returns:
+            Dictionary mapping normalized hostnames to list of IP addresses
+        """
+        cache: dict[str, list[str]] = {}
+        for arg in cache_args:
+            if "=" not in arg:
+                _LOGGER.warning(
+                    "Invalid cache format: %s (expected 'hostname=ip1,ip2')", arg
+                )
+                continue
+            hostname, ips = arg.split("=", 1)
+            # Normalize hostname for consistent lookups
+            normalized = normalize_hostname(hostname)
+            cache[normalized] = [ip.strip() for ip in ips.split(",")]
+        return cache
@@ -0,0 +1,6 @@
+"""Main entry point for running the memory analyzer as a module."""
+
+from .cli import main
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,809 @@
+"""CLI interface for memory analysis with report generation."""
+
+from __future__ import annotations
+
+from collections import defaultdict
+from collections.abc import Callable
+import heapq
+from operator import itemgetter
+from pathlib import Path
+import sys
+from typing import TYPE_CHECKING
+
+from . import (
+    _COMPONENT_API,
+    _COMPONENT_CORE,
+    _COMPONENT_PREFIX_ESPHOME,
+    _COMPONENT_PREFIX_EXTERNAL,
+    _COMPONENT_PREFIX_LIB,
+    _PSTORAGE_SUFFIX,
+    RAM_SECTIONS,
+    MemoryAnalyzer,
+)
+
+if TYPE_CHECKING:
+    from . import ComponentMemory
+
+
+def _format_pstorage_name(name: str) -> str:
+    """Format a __pstorage symbol as 'storage for {id}'."""
+    if not name.endswith(_PSTORAGE_SUFFIX):
+        return name
+    prefix = name[: -len(_PSTORAGE_SUFFIX)]
+    # Strip component namespace prefix: {component}__{id} -> {id}
+    dunder_pos = prefix.find("__")
+    var_id = prefix[dunder_pos + 2 :] if dunder_pos != -1 else prefix
+    return f"storage for {var_id}"
+
+
+class MemoryAnalyzerCLI(MemoryAnalyzer):
+    """Memory analyzer with CLI-specific report generation."""
+
+    # Symbol size threshold for detailed analysis
+    SYMBOL_SIZE_THRESHOLD: int = (
+        100  # Show symbols larger than this in detailed analysis
+    )
+    # Lower threshold for RAM symbols (RAM is more constrained)
+    RAM_SYMBOL_SIZE_THRESHOLD: int = 24
+    # Number of top symbols to show in the largest symbols report
+    TOP_SYMBOLS_LIMIT: int = 30
+    # Width for symbol name display in top symbols report
+    COL_TOP_SYMBOL_NAME: int = 55
+
+    # Column width constants
+    COL_COMPONENT: int = 29
+    COL_FLASH_TEXT: int = 14
+    COL_FLASH_DATA: int = 14
+    COL_RAM_DATA: int = 12
+    COL_RAM_BSS: int = 12
+    COL_TOTAL_FLASH: int = 15
+    COL_TOTAL_RAM: int = 12
+    COL_SEPARATOR: int = 3  # " | "
+
+    # Core analysis column widths
+    COL_CORE_SUBCATEGORY: int = 30
+    COL_CORE_SIZE: int = 12
+    COL_CORE_COUNT: int = 6
+    COL_CORE_PERCENT: int = 10
+
+    # Calculate table width once at class level
+    TABLE_WIDTH: int = (
+        COL_COMPONENT
+        + COL_SEPARATOR
+        + COL_FLASH_TEXT
+        + COL_SEPARATOR
+        + COL_FLASH_DATA
+        + COL_SEPARATOR
+        + COL_RAM_DATA
+        + COL_SEPARATOR
+        + COL_RAM_BSS
+        + COL_SEPARATOR
+        + COL_TOTAL_FLASH
+        + COL_SEPARATOR
+        + COL_TOTAL_RAM
+    )
+
+    @staticmethod
+    def _make_separator_line(*widths: int) -> str:
+        """Create a separator line with given column widths.
+
+        Args:
+            widths: Column widths to create separators for
+
+        Returns:
+            Separator line like "----+---------+-----"
+        """
+        return "-+-".join("-" * width for width in widths)
+
+    # Pre-computed separator lines
+    MAIN_TABLE_SEPARATOR: str = _make_separator_line(
+        COL_COMPONENT,
+        COL_FLASH_TEXT,
+        COL_FLASH_DATA,
+        COL_RAM_DATA,
+        COL_RAM_BSS,
+        COL_TOTAL_FLASH,
+        COL_TOTAL_RAM,
+    )
+
+    CORE_TABLE_SEPARATOR: str = _make_separator_line(
+        COL_CORE_SUBCATEGORY,
+        COL_CORE_SIZE,
+        COL_CORE_COUNT,
+        COL_CORE_PERCENT,
+    )
+
+    def _add_section_header(self, lines: list[str], title: str) -> None:
+        """Add a section header with title centered between separator lines."""
+        lines.append("")
+        lines.append("=" * self.TABLE_WIDTH)
+        lines.append(title.center(self.TABLE_WIDTH))
+        lines.append("=" * self.TABLE_WIDTH)
+        lines.append("")
+
+    def _add_top_consumers(
+        self,
+        lines: list[str],
+        title: str,
+        components: list[tuple[str, ComponentMemory]],
+        get_size: Callable[[ComponentMemory], int],
+        total: int,
+        memory_type: str,
+        limit: int = 25,
+    ) -> None:
+        """Add a formatted list of top memory consumers to the report.
+
+        Args:
+            lines: List of report lines to append the output to.
+            title: Section title to print before the list.
+            components: Sequence of (name, ComponentMemory) tuples to analyze.
+            get_size: Callable that takes a ComponentMemory and returns the
+                size in bytes to use for ranking and display.
+            total: Total size in bytes for computing percentage usage.
+            memory_type: Label for the memory region (e.g., "flash" or "RAM").
+            limit: Maximum number of components to include in the list.
+        """
+        lines.append("")
+        lines.append(f"{title}:")
+        for i, (name, mem) in enumerate(components[:limit]):
+            size = get_size(mem)
+            if size > 0:
+                percentage = (size / total * 100) if total > 0 else 0
+                lines.append(
+                    f"{i + 1}. {name} ({size:,} B) - {percentage:.1f}% of analyzed {memory_type}"
+                )
+
+    def _format_symbol_with_section(
+        self, demangled: str, size: int, section: str | None = None
+    ) -> str:
+        """Format a symbol entry, optionally adding a RAM section label.
+
+        If section is one of the RAM sections (.data or .bss), a label like
+        " [data]" or " [bss]" is appended. For non-RAM sections or when
+        section is None, no section label is added.
+
+        Placement new storage symbols are formatted as "storage for {id}".
+        """
+        display_name = _format_pstorage_name(demangled)
+        section_label = ""
+        if section in RAM_SECTIONS:
+            section_label = f" [{section[1:]}]"  # .data -> [data], .bss -> [bss]
+        return f"{display_name} ({size:,} B){section_label}"
+
+    def _add_top_symbols(self, lines: list[str]) -> None:
+        """Add a section showing the top largest symbols in the binary."""
+        # Collect all symbols from all components: (symbol, demangled, size, section, component)
+        all_symbols = [
+            (symbol, demangled, size, section, component)
+            for component, symbols in self._component_symbols.items()
+            for symbol, demangled, size, section in symbols
+        ]
+
+        # Get top N symbols by size using heapq for efficiency
+        top_symbols = heapq.nlargest(
+            self.TOP_SYMBOLS_LIMIT, all_symbols, key=itemgetter(2)
+        )
+
+        lines.append("")
+        lines.append(f"Top {self.TOP_SYMBOLS_LIMIT} Largest Symbols:")
+        # Calculate truncation limit from column width (leaving room for "...")
+        truncate_limit = self.COL_TOP_SYMBOL_NAME - 3
+        for i, (_, demangled, size, section, component) in enumerate(top_symbols):
+            # Format section label
+            section_label = f"[{section[1:]}]" if section else ""
+            # Format storage symbols readably
+            display_name = _format_pstorage_name(demangled)
+            # Truncate if too long
+            demangled_display = (
+                f"{display_name[:truncate_limit]}..."
+                if len(display_name) > self.COL_TOP_SYMBOL_NAME
+                else display_name
+            )
+            lines.append(
+                f"{i + 1:>2}. {size:>7,} B {section_label:<8} {demangled_display:<{self.COL_TOP_SYMBOL_NAME}} {component}"
+            )
+
+    def _add_cswtch_analysis(self, lines: list[str]) -> None:
+        """Add CSWTCH (GCC switch table lookup) analysis section."""
+        self._add_section_header(lines, "CSWTCH Analysis (GCC Switch Table Lookups)")
+
+        total_size = sum(size for _, size, _, _ in self._cswtch_symbols)
+        lines.append(
+            f"Total: {len(self._cswtch_symbols)} switch table(s), {total_size:,} B"
+        )
+        lines.append("")
+
+        # Group by component
+        by_component: dict[str, list[tuple[str, int, str]]] = defaultdict(list)
+        for sym_name, size, source_file, component in self._cswtch_symbols:
+            by_component[component].append((sym_name, size, source_file))
+
+        # Sort components by total size descending
+        sorted_components = sorted(
+            by_component.items(),
+            key=lambda x: sum(s[1] for s in x[1]),
+            reverse=True,
+        )
+
+        for component, symbols in sorted_components:
+            comp_total = sum(s[1] for s in symbols)
+            lines.append(f"{component} ({comp_total:,} B, {len(symbols)} tables):")
+
+            # Group by source file within component
+            by_file: dict[str, list[tuple[str, int]]] = defaultdict(list)
+            for sym_name, size, source_file in symbols:
+                by_file[source_file].append((sym_name, size))
+
+            for source_file, file_symbols in sorted(
+                by_file.items(),
+                key=lambda x: sum(s[1] for s in x[1]),
+                reverse=True,
+            ):
+                file_total = sum(s[1] for s in file_symbols)
+                lines.append(
+                    f"  {source_file} ({file_total:,} B, {len(file_symbols)} tables)"
+                )
+                for sym_name, size in sorted(
+                    file_symbols, key=lambda x: x[1], reverse=True
+                ):
+                    lines.append(f"    {size:>6,} B  {sym_name}")
+            lines.append("")
+
+    # Number of top called functions to show
+    TOP_CALLS_LIMIT: int = 50
+    # Number of inlining candidates to show
+    INLINE_CANDIDATES_LIMIT: int = 25
+    # Maximum function size in bytes to consider for inlining
+    INLINE_SIZE_THRESHOLD: int = 16
+
+    def _build_symbol_sizes(self) -> dict[str, int]:
+        """Build a size lookup from all component symbols: mangled_name -> size."""
+        return {
+            symbol: size
+            for symbols in self._component_symbols.values()
+            for symbol, _, size, _ in symbols
+        }
+
+    def _format_call_row(
+        self, index: int, mangled: str, count: int, symbol_sizes: dict[str, int]
+    ) -> str:
+        """Format a single row for call frequency tables."""
+        demangled = self._demangle_cache.get(mangled, mangled)
+        if len(demangled) > 80:
+            demangled = f"{demangled[:77]}..."
+        size = symbol_sizes.get(mangled)
+        size_str = f"{size:>5,} B" if size is not None else "      ?"
+        return f"{index:>3}  {count:>5}  {size_str}  {demangled}"
+
+    def _add_call_table_header(self, lines: list[str]) -> None:
+        """Add the header row for call frequency tables."""
+        lines.append(f"{'#':>3}  {'Calls':>5}  {'Size':>7}  Function")
+        lines.append(f"{'---':>3}  {'-----':>5}  {'-------':>7}  {'-' * 60}")
+
+    def _add_function_call_analysis(self, lines: list[str]) -> None:
+        """Add function call frequency analysis section.
+
+        Shows the most frequently called functions by call site count.
+        """
+        self._add_section_header(lines, "Top Called Functions")
+
+        symbol_sizes = self._build_symbol_sizes()
+
+        # Sort by call count descending
+        sorted_calls = sorted(
+            self._function_call_counts.items(), key=lambda x: x[1], reverse=True
+        )
+
+        self._add_call_table_header(lines)
+
+        for i, (mangled, count) in enumerate(sorted_calls[: self.TOP_CALLS_LIMIT]):
+            lines.append(self._format_call_row(i + 1, mangled, count, symbol_sizes))
+
+        total_calls = sum(self._function_call_counts.values())
+        lines.append("")
+        lines.append(
+            f"Total: {len(self._function_call_counts)} unique targets, "
+            f"{total_calls:,} call sites"
+        )
+        lines.append("")
+
+    def _add_inline_candidates(self, lines: list[str]) -> None:
+        """Add inlining candidates section.
+
+        Shows frequently called functions that are small enough to benefit
+        from inlining (< 16 bytes). These are the best candidates for
+        reducing call overhead.
+        """
+        self._add_section_header(
+            lines,
+            f"Inlining Candidates (<{self.INLINE_SIZE_THRESHOLD} B, by call count)",
+        )
+
+        symbol_sizes = self._build_symbol_sizes()
+
+        # Filter to small functions with known size, sort by call count
+        candidates = sorted(
+            (
+                (mangled, count)
+                for mangled, count in self._function_call_counts.items()
+                if mangled in symbol_sizes
+                and symbol_sizes[mangled] < self.INLINE_SIZE_THRESHOLD
+            ),
+            key=lambda x: x[1],
+            reverse=True,
+        )
+
+        if not candidates:
+            lines.append("No candidates found.")
+            lines.append("")
+            return
+
+        self._add_call_table_header(lines)
+
+        for i, (mangled, count) in enumerate(
+            candidates[: self.INLINE_CANDIDATES_LIMIT]
+        ):
+            lines.append(self._format_call_row(i + 1, mangled, count, symbol_sizes))
+
+        lines.append("")
+        lines.append(
+            f"Showing top {min(len(candidates), self.INLINE_CANDIDATES_LIMIT)} "
+            f"of {len(candidates)} functions under "
+            f"{self.INLINE_SIZE_THRESHOLD} B"
+        )
+        lines.append("")
+
+    def generate_report(self, detailed: bool = False) -> str:
+        """Generate a formatted memory report."""
+        components = sorted(
+            self.components.items(), key=lambda x: x[1].flash_total, reverse=True
+        )
+
+        # Calculate totals
+        total_flash = sum(c.flash_total for _, c in components)
+        total_ram = sum(c.ram_total for _, c in components)
+
+        # Build report
+        lines: list[str] = []
+
+        lines.append("=" * self.TABLE_WIDTH)
+        lines.append("Component Memory Analysis".center(self.TABLE_WIDTH))
+        lines.append("=" * self.TABLE_WIDTH)
+        lines.append("")
+
+        # Main table - fixed column widths
+        lines.append(
+            f"{'Component':<{self.COL_COMPONENT}} | {'Flash (text)':>{self.COL_FLASH_TEXT}} | {'Flash (data)':>{self.COL_FLASH_DATA}} | {'RAM (data)':>{self.COL_RAM_DATA}} | {'RAM (bss)':>{self.COL_RAM_BSS}} | {'Total Flash':>{self.COL_TOTAL_FLASH}} | {'Total RAM':>{self.COL_TOTAL_RAM}}"
+        )
+        lines.append(self.MAIN_TABLE_SEPARATOR)
+
+        for name, mem in components:
+            if mem.flash_total > 0 or mem.ram_total > 0:
+                flash_rodata = mem.rodata_size + mem.data_size
+                lines.append(
+                    f"{name:<{self.COL_COMPONENT}} | {mem.text_size:>{self.COL_FLASH_TEXT - 2},} B | {flash_rodata:>{self.COL_FLASH_DATA - 2},} B | "
+                    f"{mem.data_size:>{self.COL_RAM_DATA - 2},} B | {mem.bss_size:>{self.COL_RAM_BSS - 2},} B | "
+                    f"{mem.flash_total:>{self.COL_TOTAL_FLASH - 2},} B | {mem.ram_total:>{self.COL_TOTAL_RAM - 2},} B"
+                )
+
+        lines.append(self.MAIN_TABLE_SEPARATOR)
+        lines.append(
+            f"{'TOTAL':<{self.COL_COMPONENT}} | {' ':>{self.COL_FLASH_TEXT}} | {' ':>{self.COL_FLASH_DATA}} | "
+            f"{' ':>{self.COL_RAM_DATA}} | {' ':>{self.COL_RAM_BSS}} | "
+            f"{total_flash:>{self.COL_TOTAL_FLASH - 2},} B | {total_ram:>{self.COL_TOTAL_RAM - 2},} B"
+        )
+
+        # Show unattributed RAM (SDK/framework overhead)
+        unattributed_bss, unattributed_data, unattributed_total = (
+            self.get_unattributed_ram()
+        )
+        if unattributed_total > 0:
+            lines.append("")
+            lines.append(
+                f"Unattributed RAM: {unattributed_total:,} B (SDK/framework overhead)"
+            )
+            if unattributed_bss > 0 and unattributed_data > 0:
+                lines.append(
+                    f"  .bss: {unattributed_bss:,} B | .data: {unattributed_data:,} B"
+                )
+
+            # Show SDK symbol breakdown if available
+            sdk_by_lib = self.get_sdk_ram_by_library()
+            if sdk_by_lib:
+                lines.append("")
+                lines.append("SDK library breakdown (static symbols not in ELF):")
+                # Sort libraries by total size
+                lib_totals = [
+                    (lib, sum(s.size for s in syms), syms)
+                    for lib, syms in sdk_by_lib.items()
+                ]
+                lib_totals.sort(key=lambda x: x[1], reverse=True)
+
+                for lib_name, lib_total, syms in lib_totals:
+                    if lib_total == 0:
+                        continue
+                    lines.append(f"  {lib_name}: {lib_total:,} B")
+                    # Show top symbols from this library
+                    for sym in sorted(syms, key=lambda s: s.size, reverse=True)[:3]:
+                        section_label = sym.section.lstrip(".")
+                        # Use demangled name (falls back to original if not demangled)
+                        display_name = sym.demangled or sym.name
+                        if len(display_name) > 50:
+                            display_name = f"{display_name[:47]}..."
+                        lines.append(
+                            f"    {sym.size:>6,} B [{section_label}] {display_name}"
+                        )
+
+        # Top consumers
+        self._add_top_consumers(
+            lines,
+            "Top Flash Consumers",
+            components,
+            lambda m: m.flash_total,
+            total_flash,
+            "flash",
+        )
+
+        ram_components = sorted(components, key=lambda x: x[1].ram_total, reverse=True)
+        self._add_top_consumers(
+            lines,
+            "Top RAM Consumers",
+            ram_components,
+            lambda m: m.ram_total,
+            total_ram,
+            "RAM",
+        )
+
+        # Top largest symbols in the binary
+        self._add_top_symbols(lines)
+
+        # Add ESPHome core detailed analysis if there are core symbols
+        if self._esphome_core_symbols:
+            self._add_section_header(lines, f"{_COMPONENT_CORE} Detailed Analysis")
+
+            # Group core symbols by subcategory
+            core_subcategories: dict[str, list[tuple[str, str, int]]] = defaultdict(
+                list
+            )
+
+            for symbol, demangled, size in self._esphome_core_symbols:
+                # Categorize based on demangled name patterns
+                subcategory = self._categorize_esphome_core_symbol(demangled)
+                core_subcategories[subcategory].append((symbol, demangled, size))
+
+            # Sort subcategories by total size
+            sorted_subcategories = sorted(
+                [
+                    (name, symbols, sum(s[2] for s in symbols))
+                    for name, symbols in core_subcategories.items()
+                ],
+                key=lambda x: x[2],
+                reverse=True,
+            )
+
+            lines.append(
+                f"{'Subcategory':<{self.COL_CORE_SUBCATEGORY}} | {'Size':>{self.COL_CORE_SIZE}} | "
+                f"{'Count':>{self.COL_CORE_COUNT}} | {'% of Core':>{self.COL_CORE_PERCENT}}"
+            )
+            lines.append(self.CORE_TABLE_SEPARATOR)
+
+            core_total = sum(size for _, _, size in self._esphome_core_symbols)
+
+            for subcategory, symbols, total_size in sorted_subcategories:
+                percentage = (total_size / core_total * 100) if core_total > 0 else 0
+                lines.append(
+                    f"{subcategory:<{self.COL_CORE_SUBCATEGORY}} | {total_size:>{self.COL_CORE_SIZE - 2},} B | "
+                    f"{len(symbols):>{self.COL_CORE_COUNT}} | {percentage:>{self.COL_CORE_PERCENT - 1}.1f}%"
+                )
+
+            # All core symbols above threshold
+            lines.append("")
+            sorted_core_symbols = sorted(
+                self._esphome_core_symbols, key=lambda x: x[2], reverse=True
+            )
+            large_core_symbols = [
+                (symbol, demangled, size)
+                for symbol, demangled, size in sorted_core_symbols
+                if size > self.SYMBOL_SIZE_THRESHOLD
+            ]
+
+            lines.append(
+                f"{_COMPONENT_CORE} Symbols > {self.SYMBOL_SIZE_THRESHOLD} B ({len(large_core_symbols)} symbols):"
+            )
+            for i, (_symbol, demangled, size) in enumerate(large_core_symbols):
+                # Core symbols only track (symbol, demangled, size) without section info,
+                # so we don't show section labels here
+                lines.append(
+                    f"{i + 1}. {self._format_symbol_with_section(demangled, size)}"
+                )
+
+            lines.append("=" * self.TABLE_WIDTH)
+
+        # Add detailed analysis for top ESPHome and external components
+        esphome_components = [
+            (name, mem)
+            for name, mem in components
+            if name.startswith(_COMPONENT_PREFIX_ESPHOME) and name != _COMPONENT_CORE
+        ]
+        external_components = [
+            (name, mem)
+            for name, mem in components
+            if name.startswith(_COMPONENT_PREFIX_EXTERNAL)
+        ]
+        library_components = [
+            (name, mem)
+            for name, mem in components
+            if name.startswith(_COMPONENT_PREFIX_LIB)
+        ]
+
+        top_esphome_components = sorted(
+            esphome_components, key=lambda x: x[1].flash_total, reverse=True
+        )[:30]
+
+        # Include all external components (they're usually important)
+        top_external_components = sorted(
+            external_components, key=lambda x: x[1].flash_total, reverse=True
+        )
+
+        # Include all library components
+        top_library_components = sorted(
+            library_components, key=lambda x: x[1].flash_total, reverse=True
+        )
+
+        # Check if API component exists and ensure it's included
+        api_component = None
+        for name, mem in components:
+            if name == _COMPONENT_API:
+                api_component = (name, mem)
+                break
+
+        # Also include wifi_stack and other important system components if they exist
+        system_components_to_include = [
+            # Empty list - we've finished debugging symbol categorization
+            # Add component names here if you need to debug their symbols
+        ]
+        system_components = [
+            (name, mem)
+            for name, mem in components
+            if name in system_components_to_include
+        ]
+
+        # Combine all components to analyze: top ESPHome + all external + libraries + API if not already included + system components
+        components_to_analyze = (
+            list(top_esphome_components)
+            + list(top_external_components)
+            + list(top_library_components)
+            + system_components
+        )
+        if api_component and api_component not in components_to_analyze:
+            components_to_analyze.append(api_component)
+
+        if components_to_analyze:
+            for comp_name, comp_mem in components_to_analyze:
+                if not (comp_symbols := self._component_symbols.get(comp_name, [])):
+                    continue
+                self._add_section_header(lines, f"{comp_name} Detailed Analysis")
+
+                # Sort symbols by size
+                sorted_symbols = sorted(comp_symbols, key=lambda x: x[2], reverse=True)
+
+                lines.append(f"Total symbols: {len(sorted_symbols)}")
+                lines.append(f"Total size: {comp_mem.flash_total:,} B")
+                lines.append("")
+
+                # Show symbols above threshold, always include storage symbols
+                large_symbols = [
+                    (sym, dem, size, sec)
+                    for sym, dem, size, sec in sorted_symbols
+                    if size > self.SYMBOL_SIZE_THRESHOLD
+                    or dem.endswith(_PSTORAGE_SUFFIX)
+                ]
+
+                lines.append(
+                    f"{comp_name} Symbols > {self.SYMBOL_SIZE_THRESHOLD} B & storage ({len(large_symbols)} symbols):"
+                )
+                for i, (_symbol, demangled, size, section) in enumerate(large_symbols):
+                    lines.append(
+                        f"{i + 1}. {self._format_symbol_with_section(demangled, size, section)}"
+                    )
+
+                lines.append("=" * self.TABLE_WIDTH)
+
+        # Detailed RAM analysis by component (at end, before RAM strings analysis)
+        self._add_section_header(lines, "RAM Symbol Analysis by Component")
+
+        # Show top 15 RAM consumers with their large symbols
+        for name, mem in ram_components[:15]:
+            if mem.ram_total == 0:
+                continue
+            ram_syms = self._ram_symbols.get(name, [])
+            if not ram_syms:
+                continue
+
+            # Sort by size descending
+            sorted_ram_syms = sorted(ram_syms, key=lambda x: x[2], reverse=True)
+            large_ram_syms = [
+                s
+                for s in sorted_ram_syms
+                if s[2] > self.RAM_SYMBOL_SIZE_THRESHOLD
+                or s[1].endswith(_PSTORAGE_SUFFIX)
+            ]
+
+            lines.append(f"{name} ({mem.ram_total:,} B total RAM):")
+
+            # Show breakdown by section type
+            data_size = sum(s[2] for s in ram_syms if s[3] == ".data")
+            bss_size = sum(s[2] for s in ram_syms if s[3] == ".bss")
+            lines.append(f"  .data (initialized): {data_size:,} B")
+            lines.append(f"  .bss (uninitialized): {bss_size:,} B")
+
+            if large_ram_syms:
+                lines.append(
+                    f"  Symbols > {self.RAM_SYMBOL_SIZE_THRESHOLD} B ({len(large_ram_syms)}):"
+                )
+                for _symbol, demangled, size, section in large_ram_syms[:10]:
+                    # Format section label consistently by stripping leading dot
+                    section_label = section.lstrip(".") if section else ""
+                    display_name = _format_pstorage_name(demangled)
+                    # Add ellipsis if name is truncated
+                    display_name = (
+                        f"{display_name[:70]}..."
+                        if len(display_name) > 70
+                        else display_name
+                    )
+                    lines.append(f"    {size:>6,} B [{section_label}] {display_name}")
+                if len(large_ram_syms) > 10:
+                    lines.append(f"    ... and {len(large_ram_syms) - 10} more")
+            lines.append("")
+
+        # CSWTCH (GCC switch table) analysis
+        if self._cswtch_symbols:
+            self._add_cswtch_analysis(lines)
+
+        # Function call frequency analysis
+        if self._function_call_counts:
+            self._add_function_call_analysis(lines)
+            self._add_inline_candidates(lines)
+
+        lines.append(
+            "Note: This analysis covers symbols in the ELF file. Some runtime allocations may not be included."
+        )
+        lines.append("=" * self.TABLE_WIDTH)
+
+        return "\n".join(lines)
+
+    def dump_uncategorized_symbols(self, output_file: str | None = None) -> None:
+        """Dump uncategorized symbols for analysis."""
+        # Sort by size descending
+        sorted_symbols = sorted(
+            self._uncategorized_symbols, key=lambda x: x[2], reverse=True
+        )
+
+        lines = ["Uncategorized Symbols Analysis", "=" * 80]
+        lines.append(f"Total uncategorized symbols: {len(sorted_symbols)}")
+        lines.append(
+            f"Total uncategorized size: {sum(s[2] for s in sorted_symbols):,} bytes"
+        )
+        lines.append("")
+        lines.append(f"{'Size':>10} | {'Symbol':<60} | Demangled")
+        lines.append("-" * 10 + "-+-" + "-" * 60 + "-+-" + "-" * 40)
+
+        for symbol, demangled, size in sorted_symbols[:100]:  # Top 100
+            demangled_display = (
+                demangled[:100] if symbol != demangled else "[not demangled]"
+            )
+            lines.append(f"{size:>10,} | {symbol[:60]:<60} | {demangled_display}")
+
+        if len(sorted_symbols) > 100:
+            lines.append(f"\n... and {len(sorted_symbols) - 100} more symbols")
+
+        content = "\n".join(lines)
+
+        if output_file:
+            with Path(output_file).open("w", encoding="utf-8") as f:
+                f.write(content)
+        else:
+            print(content)
+
+
+def analyze_elf(
+    elf_path: str,
+    objdump_path: str | None = None,
+    readelf_path: str | None = None,
+    detailed: bool = False,
+    external_components: set[str] | None = None,
+) -> str:
+    """Analyze an ELF file and return a memory report."""
+    analyzer = MemoryAnalyzerCLI(
+        elf_path, objdump_path, readelf_path, external_components
+    )
+    analyzer.analyze()
+    return analyzer.generate_report(detailed)
+
+
+def main():
+    """CLI entrypoint for memory analysis."""
+    if len(sys.argv) < 2:
+        print("Usage: python -m esphome.analyze_memory <build_directory>")
+        print("\nAnalyze memory usage from an ESPHome build directory.")
+        print("The build directory should contain firmware.elf and idedata will be")
+        print("loaded from ~/.esphome/.internal/idedata/<device>.json")
+        print("\nExamples:")
+        print("  python -m esphome.analyze_memory ~/.esphome/build/my-device")
+        print("  python -m esphome.analyze_memory .esphome/build/my-device")
+        print("  python -m esphome.analyze_memory my-device  # Short form")
+        sys.exit(1)
+
+    build_dir = sys.argv[1]
+
+    # Load build directory
+    import json
+
+    from esphome.platformio.toolchain import IDEData
+
+    build_path = Path(build_dir)
+
+    # If no path separator in name, assume it's a device name
+    if "/" not in build_dir and not build_path.is_dir():
+        # Try current directory first
+        cwd_path = Path.cwd() / ".esphome" / "build" / build_dir
+        if cwd_path.is_dir():
+            build_path = cwd_path
+            print(f"Using build directory: {build_path}", file=sys.stderr)
+        else:
+            # Fall back to home directory
+            build_path = Path.home() / ".esphome" / "build" / build_dir
+            print(f"Using build directory: {build_path}", file=sys.stderr)
+
+    if not build_path.is_dir():
+        print(f"Error: {build_path} is not a directory", file=sys.stderr)
+        sys.exit(1)
+
+    # Find firmware.elf
+    elf_file = None
+    for elf_candidate in [
+        build_path / "firmware.elf",
+        build_path / ".pioenvs" / build_path.name / "firmware.elf",
+    ]:
+        if elf_candidate.exists():
+            elf_file = str(elf_candidate)
+            break
+
+    if not elf_file:
+        print(f"Error: firmware.elf not found in {build_dir}", file=sys.stderr)
+        sys.exit(1)
+
+    # Find idedata.json - check current directory first, then home
+    device_name = build_path.name
+    idedata_candidates = [
+        Path.cwd() / ".esphome" / "idedata" / f"{device_name}.json",
+        Path.home() / ".esphome" / "idedata" / f"{device_name}.json",
+    ]
+
+    idedata = None
+    for idedata_path in idedata_candidates:
+        if not idedata_path.exists():
+            continue
+        try:
+            with idedata_path.open(encoding="utf-8") as f:
+                raw_data = json.load(f)
+            idedata = IDEData(raw_data)
+            print(f"Loaded idedata from: {idedata_path}", file=sys.stderr)
+            break
+        except (json.JSONDecodeError, OSError) as e:
+            print(f"Warning: Failed to load idedata: {e}", file=sys.stderr)
+
+    if not idedata:
+        print(
+            f"Warning: idedata not found (searched {idedata_candidates[0]} and {idedata_candidates[1]})",
+            file=sys.stderr,
+        )
+
+    analyzer = MemoryAnalyzerCLI(elf_file, idedata=idedata)
+    analyzer.analyze()
+    report = analyzer.generate_report()
+    print(report)
+
+
+if __name__ == "__main__":
+    main()
@@ -0,0 +1,182 @@
+"""Symbol demangling utilities for memory analysis.
+
+This module provides functions for demangling C++ symbol names using c++filt.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+import subprocess
+
+from .toolchain import find_tool
+
+_LOGGER = logging.getLogger(__name__)
+
+# GCC global constructor/destructor prefix annotations
+GCC_PREFIX_ANNOTATIONS = {
+    "_GLOBAL__sub_I_": "global constructor for",
+    "_GLOBAL__sub_D_": "global destructor for",
+}
+
+# GCC optimization suffix pattern (e.g., $isra$0, $part$1, $constprop$2)
+GCC_OPTIMIZATION_SUFFIX_PATTERN = re.compile(r"(\$(?:isra|part|constprop)\$\d+)")
+
+
+def _strip_gcc_annotations(symbol: str) -> tuple[str, str]:
+    """Strip GCC optimization suffixes and prefixes from a symbol.
+
+    Args:
+        symbol: The mangled symbol name
+
+    Returns:
+        Tuple of (stripped_symbol, removed_prefix)
+    """
+    # Remove GCC optimization markers
+    stripped = GCC_OPTIMIZATION_SUFFIX_PATTERN.sub("", symbol)
+
+    # Handle GCC global constructor/initializer prefixes
+    prefix = ""
+    for gcc_prefix in GCC_PREFIX_ANNOTATIONS:
+        if stripped.startswith(gcc_prefix):
+            prefix = gcc_prefix
+            stripped = stripped[len(prefix) :]
+            break
+
+    return stripped, prefix
+
+
+def _restore_symbol_prefix(prefix: str, stripped: str, demangled: str) -> str:
+    """Restore prefix that was removed before demangling.
+
+    Args:
+        prefix: Prefix that was removed (e.g., "_GLOBAL__sub_I_")
+        stripped: Stripped symbol name
+        demangled: Demangled symbol name
+
+    Returns:
+        Demangled name with prefix restored/annotated
+    """
+    if not prefix:
+        return demangled
+
+    # Successfully demangled - add descriptive prefix
+    if demangled != stripped and (annotation := GCC_PREFIX_ANNOTATIONS.get(prefix)):
+        return f"[{annotation}: {demangled}]"
+
+    # Failed to demangle - restore original prefix
+    return prefix + demangled
+
+
+def _restore_symbol_suffix(original: str, demangled: str) -> str:
+    """Restore GCC optimization suffix that was removed before demangling.
+
+    Args:
+        original: Original symbol name with suffix
+        demangled: Demangled symbol name without suffix
+
+    Returns:
+        Demangled name with suffix annotation
+    """
+    if suffix_match := GCC_OPTIMIZATION_SUFFIX_PATTERN.search(original):
+        return f"{demangled} [{suffix_match.group(1)}]"
+    return demangled
+
+
+def batch_demangle(
+    symbols: list[str],
+    cppfilt_path: str | None = None,
+    objdump_path: str | None = None,
+) -> dict[str, str]:
+    """Batch demangle C++ symbol names.
+
+    Args:
+        symbols: List of symbol names to demangle
+        cppfilt_path: Path to c++filt binary (auto-detected if not provided)
+        objdump_path: Path to objdump binary to derive c++filt path from
+
+    Returns:
+        Dictionary mapping original symbol names to demangled names
+    """
+    cache: dict[str, str] = {}
+
+    if not symbols:
+        return cache
+
+    # Find c++filt tool
+    cppfilt_cmd = cppfilt_path or find_tool("c++filt", objdump_path)
+    if not cppfilt_cmd:
+        _LOGGER.warning("Could not find c++filt, symbols will not be demangled")
+        return {s: s for s in symbols}
+
+    _LOGGER.debug("Demangling %d symbols using %s", len(symbols), cppfilt_cmd)
+
+    # Strip GCC optimization suffixes and prefixes before demangling
+    symbols_stripped: list[str] = []
+    symbols_prefixes: list[str] = []
+    for symbol in symbols:
+        stripped, prefix = _strip_gcc_annotations(symbol)
+        symbols_stripped.append(stripped)
+        symbols_prefixes.append(prefix)
+
+    try:
+        result = subprocess.run(
+            [cppfilt_cmd],
+            input="\n".join(symbols_stripped),
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except (subprocess.SubprocessError, OSError, UnicodeDecodeError) as e:
+        _LOGGER.warning("Failed to batch demangle symbols: %s", e)
+        return {s: s for s in symbols}
+
+    if result.returncode != 0:
+        _LOGGER.warning(
+            "c++filt exited with code %d: %s",
+            result.returncode,
+            result.stderr[:200] if result.stderr else "(no error output)",
+        )
+        return {s: s for s in symbols}
+
+    # Process demangled output
+    demangled_lines = result.stdout.strip().split("\n")
+
+    # Check for output length mismatch
+    if len(demangled_lines) != len(symbols):
+        _LOGGER.warning(
+            "c++filt output mismatch: expected %d lines, got %d",
+            len(symbols),
+            len(demangled_lines),
+        )
+        return {s: s for s in symbols}
+
+    failed_count = 0
+
+    for original, stripped, prefix, demangled in zip(
+        symbols, symbols_stripped, symbols_prefixes, demangled_lines, strict=True
+    ):
+        # Add back any prefix that was removed
+        demangled = _restore_symbol_prefix(prefix, stripped, demangled)
+
+        # If we stripped a suffix, add it back to the demangled name for clarity
+        if original != stripped and not prefix:
+            demangled = _restore_symbol_suffix(original, demangled)
+
+        cache[original] = demangled
+
+        # Count symbols that failed to demangle
+        if stripped == demangled and stripped.startswith("_Z"):
+            failed_count += 1
+            if failed_count <= 5:
+                _LOGGER.debug("Failed to demangle: %s", original)
+
+    if failed_count > 0:
+        _LOGGER.debug(
+            "Failed to demangle %d/%d symbols using %s",
+            failed_count,
+            len(symbols),
+            cppfilt_cmd,
+        )
+
+    return cache
@@ -0,0 +1,121 @@
+"""Helper functions for memory analysis."""
+
+from functools import cache
+from pathlib import Path
+
+from .const import SECTION_MAPPING
+
+# Import namespace constant from parent module
+# Note: This would create a circular import if done at module level,
+# so we'll define it locally here as well
+_NAMESPACE_ESPHOME = "esphome::"
+
+
+# Get the list of actual ESPHome components by scanning the components directory
+@cache
+def get_esphome_components():
+    """Get set of actual ESPHome components from the components directory."""
+    # Find the components directory relative to this file
+    # Go up two levels from analyze_memory/helpers.py to esphome/
+    current_dir = Path(__file__).parent.parent
+    components_dir = current_dir / "components"
+
+    if not components_dir.exists() or not components_dir.is_dir():
+        return frozenset()
+
+    return frozenset(
+        item.name
+        for item in components_dir.iterdir()
+        if item.is_dir()
+        and not item.name.startswith(".")
+        and not item.name.startswith("__")
+    )
+
+
+@cache
+def get_component_class_patterns(component_name: str) -> list[str]:
+    """Generate component class name patterns for symbol matching.
+
+    Args:
+        component_name: The component name (e.g., "ota", "wifi", "api")
+
+    Returns:
+        List of pattern strings to match against demangled symbols
+    """
+    component_upper = component_name.upper()
+    component_camel = component_name.replace("_", "").title()
+    return [
+        f"{_NAMESPACE_ESPHOME}{component_upper}Component",  # e.g., esphome::OTAComponent
+        f"{_NAMESPACE_ESPHOME}ESPHome{component_upper}Component",  # e.g., esphome::ESPHomeOTAComponent
+        f"{_NAMESPACE_ESPHOME}{component_camel}Component",  # e.g., esphome::OtaComponent
+        f"{_NAMESPACE_ESPHOME}ESPHome{component_camel}Component",  # e.g., esphome::ESPHomeOtaComponent
+    ]
+
+
+def map_section_name(raw_section: str) -> str | None:
+    """Map raw section name to standard section.
+
+    Args:
+        raw_section: Raw section name from ELF file (e.g., ".iram0.text", ".rodata.str1.1")
+
+    Returns:
+        Standard section name (".text", ".rodata", ".data", ".bss") or None
+    """
+    for standard_section, patterns in SECTION_MAPPING.items():
+        if any(pattern in raw_section for pattern in patterns):
+            return standard_section
+    return None
+
+
+def parse_symbol_line(line: str) -> tuple[str, str, int, str] | None:
+    """Parse a single symbol line from objdump output.
+
+    Args:
+        line: Line from objdump -t output
+
+    Returns:
+        Tuple of (section, name, size, address) or None if not a valid symbol.
+        Format: address l/g w/d F/O section size name
+        Example: 40084870 l     F .iram0.text    00000000 _xt_user_exc
+    """
+    parts = line.split()
+    if len(parts) < 5:
+        return None
+
+    try:
+        # Validate and extract address
+        address = parts[0]
+        int(address, 16)
+    except ValueError:
+        return None
+
+    # Look for F (function) or O (object) flag
+    if "F" not in parts and "O" not in parts:
+        return None
+
+    # Find section, size, and name
+    # Try each part as a potential section name
+    for i, part in enumerate(parts):
+        # Skip parts that are clearly flags, addresses, or other metadata
+        # Sections start with '.' (standard ELF) or are known section names (Zephyr)
+        section = map_section_name(part)
+        if not section:
+            continue
+
+        # Need at least size field after section
+        if i + 1 >= len(parts):
+            break
+
+        try:
+            size = int(parts[i + 1], 16)
+        except ValueError:
+            break
+
+        # Need symbol name and non-zero size
+        if i + 2 >= len(parts) or size == 0:
+            break
+
+        name = " ".join(parts[i + 2 :])
+        return (section, name, size, address)
+
+    return None
@@ -0,0 +1,493 @@
+"""Analyzer for RAM-stored strings in ESP8266/ESP32 firmware ELF files.
+
+This module identifies strings that are stored in RAM sections (.data, .bss, .rodata)
+rather than in flash sections (.irom0.text, .irom.text), which is important for
+memory-constrained platforms like ESP8266.
+"""
+
+from __future__ import annotations
+
+from collections import defaultdict
+from dataclasses import dataclass
+import logging
+from pathlib import Path
+import re
+import subprocess
+
+from .demangle import batch_demangle
+from .toolchain import find_tool
+
+_LOGGER = logging.getLogger(__name__)
+
+# ESP8266: .rodata is in RAM (DRAM), not flash
+# ESP32: .rodata is in flash, mapped to data bus
+ESP8266_RAM_SECTIONS = frozenset([".data", ".rodata", ".bss"])
+ESP8266_FLASH_SECTIONS = frozenset([".irom0.text", ".irom.text", ".text"])
+
+# ESP32: .rodata is memory-mapped from flash
+ESP32_RAM_SECTIONS = frozenset([".data", ".bss", ".dram0.data", ".dram0.bss"])
+ESP32_FLASH_SECTIONS = frozenset([".text", ".rodata", ".flash.text", ".flash.rodata"])
+
+# nm symbol types for data symbols (D=global data, d=local data, R=rodata, B=bss)
+DATA_SYMBOL_TYPES = frozenset(["D", "d", "R", "r", "B", "b"])
+
+
+@dataclass
+class SectionInfo:
+    """Information about an ELF section."""
+
+    name: str
+    address: int
+    size: int
+
+
+@dataclass
+class RamString:
+    """A string found in RAM."""
+
+    section: str
+    address: int
+    content: str
+
+    @property
+    def size(self) -> int:
+        """Size in bytes including null terminator."""
+        return len(self.content) + 1
+
+
+@dataclass
+class RamSymbol:
+    """A symbol found in RAM."""
+
+    name: str
+    sym_type: str
+    address: int
+    size: int
+    section: str
+    demangled: str = ""  # Demangled name, set after batch demangling
+
+
+class RamStringsAnalyzer:
+    """Analyzes ELF files to find strings stored in RAM."""
+
+    def __init__(
+        self,
+        elf_path: str,
+        objdump_path: str | None = None,
+        min_length: int = 8,
+        platform: str = "esp32",
+    ) -> None:
+        """Initialize the RAM strings analyzer.
+
+        Args:
+            elf_path: Path to the ELF file to analyze
+            objdump_path: Path to objdump binary (used to find other tools)
+            min_length: Minimum string length to report (default: 8)
+            platform: Platform name ("esp8266", "esp32", etc.) for section mapping
+        """
+        self.elf_path = Path(elf_path)
+        if not self.elf_path.exists():
+            raise FileNotFoundError(f"ELF file not found: {elf_path}")
+
+        self.objdump_path = objdump_path
+        self.min_length = min_length
+        self.platform = platform
+
+        # Set RAM/flash sections based on platform
+        if self.platform == "esp8266":
+            self.ram_sections = ESP8266_RAM_SECTIONS
+            self.flash_sections = ESP8266_FLASH_SECTIONS
+        else:
+            # ESP32 and other platforms
+            self.ram_sections = ESP32_RAM_SECTIONS
+            self.flash_sections = ESP32_FLASH_SECTIONS
+
+        self.sections: dict[str, SectionInfo] = {}
+        self.ram_strings: list[RamString] = []
+        self.ram_symbols: list[RamSymbol] = []
+
+    def _run_command(self, cmd: list[str]) -> str:
+        """Run a command and return its output."""
+        try:
+            result = subprocess.run(cmd, capture_output=True, text=True, check=True)
+            return result.stdout
+        except subprocess.CalledProcessError as e:
+            _LOGGER.debug("Command failed: %s - %s", " ".join(cmd), e.stderr)
+            raise
+        except FileNotFoundError:
+            _LOGGER.warning("Command not found: %s", cmd[0])
+            raise
+
+    def analyze(self) -> None:
+        """Perform the full RAM analysis."""
+        self._parse_sections()
+        self._extract_strings()
+        self._analyze_symbols()
+        self._demangle_symbols()
+
+    def _parse_sections(self) -> None:
+        """Parse section headers from ELF file."""
+        objdump = find_tool("objdump", self.objdump_path)
+        if not objdump:
+            _LOGGER.error("Could not find objdump command")
+            return
+
+        try:
+            output = self._run_command([objdump, "-h", str(self.elf_path)])
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            return
+
+        # Parse section headers
+        # Format: Idx Name          Size      VMA       LMA       File off  Algn
+        section_pattern = re.compile(
+            r"^\s*\d+\s+(\S+)\s+([0-9a-fA-F]+)\s+([0-9a-fA-F]+)"
+        )
+
+        for line in output.split("\n"):
+            if match := section_pattern.match(line):
+                name = match.group(1)
+                size = int(match.group(2), 16)
+                vma = int(match.group(3), 16)
+                self.sections[name] = SectionInfo(name, vma, size)
+
+    def _extract_strings(self) -> None:
+        """Extract strings from RAM sections."""
+        objdump = find_tool("objdump", self.objdump_path)
+        if not objdump:
+            return
+
+        for section_name in self.ram_sections:
+            if section_name not in self.sections:
+                continue
+
+            try:
+                output = self._run_command(
+                    [objdump, "-s", "-j", section_name, str(self.elf_path)]
+                )
+            except subprocess.CalledProcessError:
+                # Section may exist but have no content (e.g., .bss)
+                continue
+            except FileNotFoundError:
+                continue
+
+            strings = self._parse_hex_dump(output, section_name)
+            self.ram_strings.extend(strings)
+
+    def _parse_hex_dump(self, output: str, section_name: str) -> list[RamString]:
+        """Parse hex dump output to extract strings.
+
+        Args:
+            output: Output from objdump -s
+            section_name: Name of the section being parsed
+
+        Returns:
+            List of RamString objects
+        """
+        strings: list[RamString] = []
+        current_string = bytearray()
+        string_start_addr = 0
+
+        for line in output.split("\n"):
+            # Lines look like: " 3ffef8a0 00000000 00000000 00000000 00000000  ................"
+            match = re.match(r"^\s+([0-9a-fA-F]+)\s+((?:[0-9a-fA-F]{2,8}\s*)+)", line)
+            if not match:
+                continue
+
+            addr = int(match.group(1), 16)
+            hex_data = match.group(2).strip()
+
+            # Convert hex to bytes
+            hex_bytes = hex_data.split()
+            byte_offset = 0
+            for hex_chunk in hex_bytes:
+                # Handle both byte-by-byte and word formats
+                for i in range(0, len(hex_chunk), 2):
+                    byte_val = int(hex_chunk[i : i + 2], 16)
+                    if 0x20 <= byte_val <= 0x7E:  # Printable ASCII
+                        if not current_string:
+                            string_start_addr = addr + byte_offset
+                        current_string.append(byte_val)
+                    else:
+                        if byte_val == 0 and len(current_string) >= self.min_length:
+                            # Found null terminator
+                            strings.append(
+                                RamString(
+                                    section=section_name,
+                                    address=string_start_addr,
+                                    content=current_string.decode(
+                                        "ascii", errors="ignore"
+                                    ),
+                                )
+                            )
+                        current_string = bytearray()
+                    byte_offset += 1
+
+        return strings
+
+    def _analyze_symbols(self) -> None:
+        """Analyze symbols in RAM sections."""
+        nm = find_tool("nm", self.objdump_path)
+        if not nm:
+            return
+
+        try:
+            output = self._run_command([nm, "-S", "--size-sort", str(self.elf_path)])
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            return
+
+        for line in output.split("\n"):
+            parts = line.split()
+            if len(parts) < 4:
+                continue
+
+            try:
+                addr = int(parts[0], 16)
+                size = int(parts[1], 16) if parts[1] != "?" else 0
+            except ValueError:
+                continue
+
+            sym_type = parts[2]
+            name = " ".join(parts[3:])
+
+            # Filter for data symbols
+            if sym_type not in DATA_SYMBOL_TYPES:
+                continue
+
+            # Check if symbol is in a RAM section
+            for section_name in self.ram_sections:
+                if section_name not in self.sections:
+                    continue
+
+                section = self.sections[section_name]
+                if section.address <= addr < section.address + section.size:
+                    self.ram_symbols.append(
+                        RamSymbol(
+                            name=name,
+                            sym_type=sym_type,
+                            address=addr,
+                            size=size,
+                            section=section_name,
+                        )
+                    )
+                    break
+
+    def _demangle_symbols(self) -> None:
+        """Batch demangle all RAM symbol names."""
+        if not self.ram_symbols:
+            return
+
+        # Collect all symbol names and demangle them
+        symbol_names = [s.name for s in self.ram_symbols]
+        demangle_cache = batch_demangle(symbol_names, objdump_path=self.objdump_path)
+
+        # Assign demangled names to symbols
+        for symbol in self.ram_symbols:
+            symbol.demangled = demangle_cache.get(symbol.name, symbol.name)
+
+    def _get_sections_size(self, section_names: frozenset[str]) -> int:
+        """Get total size of specified sections."""
+        return sum(
+            section.size
+            for name, section in self.sections.items()
+            if name in section_names
+        )
+
+    def get_total_ram_usage(self) -> int:
+        """Get total RAM usage from RAM sections."""
+        return self._get_sections_size(self.ram_sections)
+
+    def get_total_flash_usage(self) -> int:
+        """Get total flash usage from flash sections."""
+        return self._get_sections_size(self.flash_sections)
+
+    def get_total_string_bytes(self) -> int:
+        """Get total bytes used by strings in RAM."""
+        return sum(s.size for s in self.ram_strings)
+
+    def get_repeated_strings(self) -> list[tuple[str, int]]:
+        """Find strings that appear multiple times.
+
+        Returns:
+            List of (string, count) tuples sorted by potential savings
+        """
+        string_counts: dict[str, int] = defaultdict(int)
+        for ram_string in self.ram_strings:
+            string_counts[ram_string.content] += 1
+
+        return sorted(
+            [(s, c) for s, c in string_counts.items() if c > 1],
+            key=lambda x: x[1] * (len(x[0]) + 1),
+            reverse=True,
+        )
+
+    def get_long_strings(self, min_len: int = 20) -> list[RamString]:
+        """Get strings longer than the specified length.
+
+        Args:
+            min_len: Minimum string length
+
+        Returns:
+            List of RamString objects sorted by length
+        """
+        return sorted(
+            [s for s in self.ram_strings if len(s.content) >= min_len],
+            key=lambda x: len(x.content),
+            reverse=True,
+        )
+
+    def get_largest_symbols(self, min_size: int = 100) -> list[RamSymbol]:
+        """Get RAM symbols larger than the specified size.
+
+        Args:
+            min_size: Minimum symbol size in bytes
+
+        Returns:
+            List of RamSymbol objects sorted by size
+        """
+        return sorted(
+            [s for s in self.ram_symbols if s.size >= min_size],
+            key=lambda x: x.size,
+            reverse=True,
+        )
+
+    def generate_report(self, show_all_sections: bool = False) -> str:
+        """Generate a formatted RAM strings analysis report.
+
+        Args:
+            show_all_sections: If True, show all sections, not just RAM
+
+        Returns:
+            Formatted report string
+        """
+        lines: list[str] = []
+        table_width = 80
+
+        lines.append("=" * table_width)
+        lines.append(
+            f"RAM Strings Analysis ({self.platform.upper()})".center(table_width)
+        )
+        lines.append("=" * table_width)
+        lines.append("")
+
+        # Section Analysis
+        lines.append("SECTION ANALYSIS")
+        lines.append("-" * table_width)
+        lines.append(f"{'Section':<20} {'Address':<12} {'Size':<12} {'Location'}")
+        lines.append("-" * table_width)
+
+        total_ram_usage = 0
+        total_flash_usage = 0
+
+        for name, section in sorted(self.sections.items(), key=lambda x: x[1].address):
+            if name in self.ram_sections:
+                location = "RAM"
+                total_ram_usage += section.size
+            elif name in self.flash_sections:
+                location = "FLASH"
+                total_flash_usage += section.size
+            else:
+                location = "OTHER"
+
+            if show_all_sections or name in self.ram_sections:
+                lines.append(
+                    f"{name:<20} 0x{section.address:08x}   {section.size:>8} B   {location}"
+                )
+
+        lines.append("-" * table_width)
+        lines.append(f"Total RAM sections size: {total_ram_usage:,} bytes")
+        lines.append(f"Total Flash sections size: {total_flash_usage:,} bytes")
+
+        # Strings in RAM
+        lines.append("")
+        lines.append("=" * table_width)
+        lines.append("STRINGS IN RAM SECTIONS")
+        lines.append("=" * table_width)
+        lines.append(
+            "Note: .bss sections contain uninitialized data (no strings to extract)"
+        )
+
+        # Group strings by section
+        strings_by_section: dict[str, list[RamString]] = defaultdict(list)
+        for ram_string in self.ram_strings:
+            strings_by_section[ram_string.section].append(ram_string)
+
+        for section_name in sorted(strings_by_section.keys()):
+            section_strings = strings_by_section[section_name]
+            lines.append(f"\nSection: {section_name}")
+            lines.append("-" * 40)
+            for ram_string in sorted(section_strings, key=lambda x: x.address):
+                clean_string = ram_string.content[:100] + (
+                    "..." if len(ram_string.content) > 100 else ""
+                )
+                lines.append(
+                    f'  0x{ram_string.address:08x}: "{clean_string}" (len={len(ram_string.content)})'
+                )
+
+        # Large RAM symbols
+        lines.append("")
+        lines.append("=" * table_width)
+        lines.append("LARGE DATA SYMBOLS IN RAM (>= 50 bytes)")
+        lines.append("=" * table_width)
+
+        largest_symbols = self.get_largest_symbols(50)
+        lines.append(f"\n{'Symbol':<50} {'Type':<6} {'Size':<10} {'Section'}")
+        lines.append("-" * table_width)
+
+        for symbol in largest_symbols:
+            # Use demangled name if available, otherwise raw name
+            display_name = symbol.demangled or symbol.name
+            name_display = display_name[:49] if len(display_name) > 49 else display_name
+            lines.append(
+                f"{name_display:<50} {symbol.sym_type:<6} {symbol.size:>8} B  {symbol.section}"
+            )
+
+        # Summary
+        lines.append("")
+        lines.append("=" * table_width)
+        lines.append("SUMMARY")
+        lines.append("=" * table_width)
+        lines.append(f"Total strings found in RAM: {len(self.ram_strings)}")
+        total_string_bytes = self.get_total_string_bytes()
+        lines.append(f"Total bytes used by strings: {total_string_bytes:,}")
+
+        # Optimization targets
+        lines.append("")
+        lines.append("=" * table_width)
+        lines.append("POTENTIAL OPTIMIZATION TARGETS")
+        lines.append("=" * table_width)
+
+        # Repeated strings
+        repeated = self.get_repeated_strings()[:10]
+        if repeated:
+            lines.append("\nRepeated strings (could be deduplicated):")
+            for string, count in repeated:
+                savings = (count - 1) * (len(string) + 1)
+                clean_string = string[:50] + ("..." if len(string) > 50 else "")
+                lines.append(
+                    f'  "{clean_string}" - appears {count} times (potential savings: {savings} bytes)'
+                )
+
+        # Long strings - platform-specific advice
+        long_strings = self.get_long_strings(20)[:10]
+        if long_strings:
+            if self.platform == "esp8266":
+                lines.append(
+                    "\nLong strings that could be moved to PROGMEM (>= 20 chars):"
+                )
+            else:
+                # ESP32: strings in DRAM are typically there for a reason
+                # (interrupt handlers, pre-flash-init code, etc.)
+                lines.append("\nLong strings in DRAM (>= 20 chars):")
+                lines.append(
+                    "Note: ESP32 DRAM strings may be required for interrupt/early-boot contexts"
+                )
+            for ram_string in long_strings:
+                clean_string = ram_string.content[:60] + (
+                    "..." if len(ram_string.content) > 60 else ""
+                )
+                lines.append(
+                    f'  {ram_string.section} @ 0x{ram_string.address:08x}: "{clean_string}" ({len(ram_string.content)} bytes)'
+                )
+
+        lines.append("")
+        return "\n".join(lines)
@@ -0,0 +1,172 @@
+"""Toolchain utilities for memory analysis."""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+import subprocess
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from collections.abc import Sequence
+
+_LOGGER = logging.getLogger(__name__)
+
+# Platform-specific toolchain prefixes
+TOOLCHAIN_PREFIXES = [
+    "xtensa-lx106-elf-",  # ESP8266
+    "xtensa-esp32-elf-",  # ESP32
+    "xtensa-esp-elf-",  # ESP32 (newer IDF)
+    "arm-zephyr-eabi-",  # nRF52/Zephyr SDK
+    "arm-none-eabi-",  # Generic ARM (RP2040, etc.)
+    "",  # System default (no prefix)
+]
+
+
+def _find_in_platformio_packages(tool_name: str) -> str | None:
+    """Search for a tool in PlatformIO package directories.
+
+    This handles cases like Zephyr SDK where tools are installed in nested
+    directories that aren't in PATH.
+
+    Args:
+        tool_name: Name of the tool (e.g., "readelf", "objdump")
+
+    Returns:
+        Full path to the tool or None if not found
+    """
+    # Get PlatformIO packages directory
+    platformio_home = Path("~/.platformio/packages").expanduser()
+    if not platformio_home.exists():
+        return None
+
+    # Search patterns for toolchains that might contain the tool
+    # Order matters - more specific patterns first
+    search_patterns = [
+        # Zephyr SDK deeply nested structure (4 levels)
+        # e.g., toolchain-gccarmnoneeabi/zephyr-sdk-0.17.4/arm-zephyr-eabi/bin/arm-zephyr-eabi-objdump
+        f"toolchain-*/*/*/bin/*-{tool_name}",
+        # Zephyr SDK nested structure (3 levels)
+        f"toolchain-*/*/bin/*-{tool_name}",
+        f"toolchain-*/bin/*-{tool_name}",
+        # Standard PlatformIO toolchain structure
+        f"toolchain-*/bin/*{tool_name}",
+    ]
+
+    for pattern in search_patterns:
+        matches = list(platformio_home.glob(pattern))
+        if matches:
+            # Sort to get consistent results, prefer arm-zephyr-eabi over arm-none-eabi
+            matches.sort(key=lambda p: ("zephyr" not in str(p), str(p)))
+            tool_path = str(matches[0])
+            _LOGGER.debug("Found %s in PlatformIO packages: %s", tool_name, tool_path)
+            return tool_path
+
+    return None
+
+
+def resolve_tool_path(
+    tool_name: str,
+    derived_path: str | None,
+    objdump_path: str | None = None,
+) -> str | None:
+    """Resolve a tool path, falling back to find_tool if derived path doesn't exist.
+
+    Args:
+        tool_name: Name of the tool (e.g., "objdump", "readelf")
+        derived_path: Path derived from idedata (may not exist for some platforms)
+        objdump_path: Path to objdump binary to derive other tool paths from
+
+    Returns:
+        Resolved path to the tool, or the original derived_path if it exists
+    """
+    if derived_path and not Path(derived_path).exists():
+        found = find_tool(tool_name, objdump_path)
+        if found:
+            _LOGGER.debug(
+                "Derived %s path %s not found, using %s",
+                tool_name,
+                derived_path,
+                found,
+            )
+            return found
+    return derived_path
+
+
+def find_tool(
+    tool_name: str,
+    objdump_path: str | None = None,
+) -> str | None:
+    """Find a toolchain tool by name.
+
+    First tries to derive the tool path from objdump_path (if provided),
+    then searches PlatformIO package directories (for cross-compile toolchains),
+    and finally falls back to searching for platform-specific tools in PATH.
+
+    Args:
+        tool_name: Name of the tool (e.g., "objdump", "nm", "c++filt")
+        objdump_path: Path to objdump binary to derive other tool paths from
+
+    Returns:
+        Path to the tool or None if not found
+    """
+    # Try to derive from objdump path first (most reliable)
+    if objdump_path and objdump_path != "objdump":
+        objdump_file = Path(objdump_path)
+        # Replace just the filename portion, preserving any prefix (e.g., xtensa-esp32-elf-)
+        new_name = objdump_file.name.replace("objdump", tool_name)
+        potential_path = str(objdump_file.with_name(new_name))
+        if Path(potential_path).exists():
+            _LOGGER.debug("Found %s at: %s", tool_name, potential_path)
+            return potential_path
+
+    # Search in PlatformIO packages directory first (handles Zephyr SDK, etc.)
+    # This must come before PATH search because system tools (e.g., /usr/bin/objdump)
+    # are for the host architecture, not the target (ARM, Xtensa, etc.)
+    if found := _find_in_platformio_packages(tool_name):
+        return found
+
+    # Try platform-specific tools in PATH (fallback for when tools are installed globally)
+    for prefix in TOOLCHAIN_PREFIXES:
+        cmd = f"{prefix}{tool_name}"
+        try:
+            subprocess.run([cmd, "--version"], capture_output=True, check=True)
+            _LOGGER.debug("Found %s: %s", tool_name, cmd)
+            return cmd
+        except (subprocess.CalledProcessError, FileNotFoundError):
+            continue
+
+    _LOGGER.warning("Could not find %s tool", tool_name)
+    return None
+
+
+def run_tool(
+    cmd: Sequence[str],
+    timeout: int = 30,
+) -> subprocess.CompletedProcess[str] | None:
+    """Run a toolchain command and return the result.
+
+    Args:
+        cmd: Command and arguments to run
+        timeout: Timeout in seconds
+
+    Returns:
+        CompletedProcess on success, None on failure
+    """
+    try:
+        return subprocess.run(
+            cmd,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+            check=False,
+        )
+    except subprocess.TimeoutExpired:
+        _LOGGER.warning("Command timed out: %s", " ".join(cmd))
+        return None
+    except FileNotFoundError:
+        _LOGGER.warning("Command not found: %s", cmd[0])
+        return None
+    except OSError as e:
+        _LOGGER.warning("Failed to run command %s: %s", cmd[0], e)
+        return None
@@ -0,0 +1,56 @@
+"""Helpers for running an async coroutine from sync code via a daemon thread.
+
+``asyncio.run(coro())`` in the main thread blocks until the loop's cleanup
+cycle finishes, which can add hundreds of milliseconds before the caller
+receives the result. Running the loop in a daemon thread lets the caller
+observe the result as soon as the coroutine completes while cleanup finishes
+in the background.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable
+import threading
+from typing import Generic, TypeVar
+
+_T = TypeVar("_T")
+
+
+class AsyncThreadRunner(threading.Thread, Generic[_T]):
+    """Run an async coroutine in a daemon thread and expose its result.
+
+    The runner catches all exceptions from the coroutine and stores them in
+    ``exception`` so ``event`` is always set — this prevents callers waiting
+    on ``event`` from hanging forever when the coroutine crashes.
+
+    Typical usage::
+
+        runner = AsyncThreadRunner(lambda: my_coro(arg))
+        runner.start()
+        if not runner.event.wait(timeout=5.0):
+            ...  # timed out
+        if runner.exception is not None:
+            raise runner.exception
+        result = runner.result
+    """
+
+    def __init__(self, coro_factory: Callable[[], Awaitable[_T]]) -> None:
+        super().__init__(daemon=True)
+        self._coro_factory = coro_factory
+        self.result: _T | None = None
+        self.exception: BaseException | None = None
+        self.event = threading.Event()
+
+    async def _runner(self) -> None:
+        try:
+            self.result = await self._coro_factory()
+        except Exception as exc:  # noqa: BLE001  # pylint: disable=broad-except
+            # Capture all exceptions so ``event`` is always set — otherwise a
+            # crash would hang the waiter forever.
+            self.exception = exc
+        finally:
+            self.event.set()
+
+    def run(self) -> None:
+        asyncio.run(self._runner())
@@ -1,3 +1,6 @@
+from dataclasses import dataclass, field
+import logging
+
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -15,7 +18,15 @@ from esphome.const import (
    CONF_TYPE_ID,
    CONF_UPDATE_INTERVAL,
 )
+from esphome.core import ID, Lambda
+from esphome.cpp_generator import (
+    LambdaExpression,
+    MockObj,
+    MockObjClass,
+    TemplateArgsType,
+)
 from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
+from esphome.types import ConfigType
 from esphome.util import Registry


@@ -49,11 +60,45 @@ def maybe_conf(conf, *validators):
    return validate


-def register_action(name, action_type, schema):
-    return ACTION_REGISTRY.register(name, action_type, schema)
+_LOGGER = logging.getLogger(__name__)


-def register_condition(name, condition_type, schema):
+def register_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool | None = None,
+):
+    """Register an action type.
+
+    All callers must pass ``synchronous`` explicitly.
+
+    ``synchronous=True`` — the action never defers ``play_next_()`` to a
+    later point (callback, timer, or ``loop()``).  Trigger arguments are
+    only used during the initial call, so string args can use non-owning
+    StringRef for zero-copy access.
+
+    ``synchronous=False`` — the action defers ``play_next_()`` via a
+    callback, timer, or ``Component::loop()``.  Trigger arguments must
+    outlive the initial call, so string args use owning std::string to
+    prevent dangling references.
+    """
+    if synchronous is None:
+        _LOGGER.warning(
+            "register_action('%s', ...) is missing the synchronous= parameter. "
+            "Defaulting to synchronous=False (safe but prevents StringRef "
+            "optimization). Check the C++ class: use synchronous=False if "
+            "play_next_() is deferred to a callback, timer, or loop(); "
+            "use synchronous=True if play_next_() always runs before the "
+            "initial play/play_complex call returns",
+            name,
+        )
+        synchronous = False
+    return ACTION_REGISTRY.register(name, action_type, schema, synchronous=synchronous)
+
+
+def register_condition(name: str, condition_type: MockObjClass, schema: cv.Schema):
    return CONDITION_REGISTRY.register(name, condition_type, schema)


@@ -82,8 +127,9 @@ def validate_potentially_or_condition(value):
    return validate_condition(value)


-DelayAction = cg.esphome_ns.class_("DelayAction", Action, cg.Component)
+DelayAction = cg.esphome_ns.class_("DelayAction", Action)
 LambdaAction = cg.esphome_ns.class_("LambdaAction", Action)
+StatelessLambdaAction = cg.esphome_ns.class_("StatelessLambdaAction", Action)
 IfAction = cg.esphome_ns.class_("IfAction", Action)
 WhileAction = cg.esphome_ns.class_("WhileAction", Action)
 RepeatAction = cg.esphome_ns.class_("RepeatAction", Action)
@@ -92,11 +138,45 @@ UpdateComponentAction = cg.esphome_ns.class_("UpdateComponentAction", Action)
 SuspendComponentAction = cg.esphome_ns.class_("SuspendComponentAction", Action)
 ResumeComponentAction = cg.esphome_ns.class_("ResumeComponentAction", Action)
 Automation = cg.esphome_ns.class_("Automation")
+TriggerForwarder = cg.esphome_ns.class_("TriggerForwarder")
+TriggerOnTrueForwarder = cg.esphome_ns.class_("TriggerOnTrueForwarder")
+TriggerOnFalseForwarder = cg.esphome_ns.class_("TriggerOnFalseForwarder")

 LambdaCondition = cg.esphome_ns.class_("LambdaCondition", Condition)
+StatelessLambdaCondition = cg.esphome_ns.class_("StatelessLambdaCondition", Condition)
 ForCondition = cg.esphome_ns.class_("ForCondition", Condition, cg.Component)


+def new_lambda_pvariable(
+    id_obj: ID,
+    lambda_expr: LambdaExpression,
+    stateless_class: MockObjClass,
+    template_arg: cg.TemplateArguments | None = None,
+) -> MockObj:
+    """Create Pvariable for lambda, using stateless class if applicable.
+
+    Combines ID selection and Pvariable creation in one call. For stateless
+    lambdas (empty capture), uses function pointer instead of std::function.
+
+    Args:
+        id_obj: The ID object (action_id, condition_id, or filter_id)
+        lambda_expr: The lambda expression object
+        stateless_class: The stateless class to use for stateless lambdas
+        template_arg: Optional template arguments (for actions/conditions)
+
+    Returns:
+        The created Pvariable
+    """
+    # For stateless lambdas, use function pointer instead of std::function
+    if lambda_expr.capture == "":
+        id_obj = id_obj.copy()
+        id_obj.type = stateless_class
+
+    if template_arg is not None:
+        return cg.new_Pvariable(id_obj, template_arg, lambda_expr)
+    return cg.new_Pvariable(id_obj, lambda_expr)
+
+
 def validate_automation(extra_schema=None, extra_validators=None, single=False):
    if extra_schema is None:
        extra_schema = {}
@@ -119,11 +199,10 @@ def validate_automation(extra_schema=None, extra_validators=None, single=False):
                    return cv.Schema([schema])(value)
                except cv.Invalid as err2:
                    if "extra keys not allowed" in str(err2) and len(err2.path) == 2:
-                        # pylint: disable=raise-missing-from
-                        raise err
+                        raise err from None
                    if "Unable to find action" in str(err):
-                        raise err2
-                    raise cv.MultipleInvalid([err, err2])
+                        raise err2 from None
+                    raise cv.MultipleInvalid([err, err2]) from None
        elif isinstance(value, dict):
            if CONF_THEN in value:
                return [schema(value)]
@@ -142,7 +221,7 @@ def validate_automation(extra_schema=None, extra_validators=None, single=False):
            value = cv.Schema([extra_validators])(value)
        if single:
            if len(value) != 1:
-                raise cv.Invalid("Cannot have more than 1 automation for templates")
+                raise cv.Invalid("This trigger allows only a single automation")
            return value[0]
        return value

@@ -164,45 +243,92 @@ XorCondition = cg.esphome_ns.class_("XorCondition", Condition)


@register_condition("and", AndCondition, validate_condition_list)
-async def and_condition_to_code(config, condition_id, template_arg, args):
+async def and_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )


@register_condition("or", OrCondition, validate_condition_list)
-async def or_condition_to_code(config, condition_id, template_arg, args):
+async def or_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )


@register_condition("all", AndCondition, validate_condition_list)
-async def all_condition_to_code(config, condition_id, template_arg, args):
+async def all_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )


@register_condition("any", OrCondition, validate_condition_list)
-async def any_condition_to_code(config, condition_id, template_arg, args):
+async def any_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )


@register_condition("not", NotCondition, validate_potentially_and_condition)
-async def not_condition_to_code(config, condition_id, template_arg, args):
+async def not_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    condition = await build_condition(config, template_arg, args)
    return cg.new_Pvariable(condition_id, template_arg, condition)


@register_condition("xor", XorCondition, validate_condition_list)
-async def xor_condition_to_code(config, condition_id, template_arg, args):
+async def xor_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )


@register_condition("lambda", LambdaCondition, cv.returning_lambda)
-async def lambda_condition_to_code(config, condition_id, template_arg, args):
+async def lambda_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    lambda_ = await cg.process_lambda(config, args, return_type=bool)
-    return cg.new_Pvariable(condition_id, template_arg, lambda_)
+    return new_lambda_pvariable(
+        condition_id, lambda_, StatelessLambdaCondition, template_arg
+    )


@register_condition(
@@ -217,7 +343,12 @@ async def lambda_condition_to_code(config, condition_id, template_arg, args):
        }
    ).extend(cv.COMPONENT_SCHEMA),
 )
-async def for_condition_to_code(config, condition_id, template_arg, args):
+async def for_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    condition = await build_condition(
        config[CONF_CONDITION], cg.TemplateArguments(), []
    )
@@ -228,12 +359,43 @@ async def for_condition_to_code(config, condition_id, template_arg, args):
    return var


-@register_action(
-    "delay", DelayAction, cv.templatable(cv.positive_time_period_milliseconds)
+@register_condition(
+    "component.is_idle",
+    LambdaCondition,
+    maybe_simple_id(
+        {
+            cv.Required(CONF_ID): cv.use_id(cg.Component),
+        }
+    ),
 )
-async def delay_action_to_code(config, action_id, template_arg, args):
+async def component_is_idle_condition_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    comp = await cg.get_variable(config[CONF_ID])
+    lambda_ = await cg.process_lambda(
+        Lambda(f"return {comp}->is_idle();"), args, return_type=bool
+    )
+    return new_lambda_pvariable(
+        condition_id, lambda_, StatelessLambdaCondition, template_arg
+    )
+
+
+@register_action(
+    "delay",
+    DelayAction,
+    cv.templatable(cv.positive_time_period_milliseconds),
+    synchronous=False,
+)
+async def delay_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
-    await cg.register_component(var, {})
    template_ = await cg.templatable(config, args, cg.uint32)
    cg.add(var.set_delay(template_))
    return var
@@ -255,15 +417,24 @@ async def delay_action_to_code(config, action_id, template_arg, args):
        cv.has_at_least_one_key(CONF_THEN, CONF_ELSE),
        cv.has_at_least_one_key(CONF_CONDITION, CONF_ANY, CONF_ALL),
    ),
+    synchronous=True,
 )
-async def if_action_to_code(config, action_id, template_arg, args):
+async def if_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    has_else = CONF_ELSE in config
+    # Prepend HasElse bool to template arguments: IfAction<HasElse, Ts...>
+    if_template_arg = cg.TemplateArguments(has_else, *template_arg)
    cond_conf = next(el for el in config if el in (CONF_ANY, CONF_ALL, CONF_CONDITION))
-    conditions = await build_condition(config[cond_conf], template_arg, args)
-    var = cg.new_Pvariable(action_id, template_arg, conditions)
+    condition = await build_condition(config[cond_conf], template_arg, args)
+    var = cg.new_Pvariable(action_id, if_template_arg, condition)
    if CONF_THEN in config:
        actions = await build_action_list(config[CONF_THEN], template_arg, args)
        cg.add(var.add_then(actions))
-    if CONF_ELSE in config:
+    if has_else:
        actions = await build_action_list(config[CONF_ELSE], template_arg, args)
        cg.add(var.add_else(actions))
    return var
@@ -278,10 +449,16 @@ async def if_action_to_code(config, action_id, template_arg, args):
            cv.Required(CONF_THEN): validate_action_list,
        }
    ),
+    synchronous=True,
 )
-async def while_action_to_code(config, action_id, template_arg, args):
-    conditions = await build_condition(config[CONF_CONDITION], template_arg, args)
-    var = cg.new_Pvariable(action_id, template_arg, conditions)
+async def while_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    condition = await build_condition(config[CONF_CONDITION], template_arg, args)
+    var = cg.new_Pvariable(action_id, template_arg, condition)
    actions = await build_action_list(config[CONF_THEN], template_arg, args)
    cg.add(var.add_then(actions))
    return var
@@ -296,8 +473,14 @@ async def while_action_to_code(config, action_id, template_arg, args):
            cv.Required(CONF_THEN): validate_action_list,
        }
    ),
+    synchronous=True,
 )
-async def repeat_action_to_code(config, action_id, template_arg, args):
+async def repeat_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
    count_template = await cg.templatable(config[CONF_COUNT], args, cg.uint32)
    cg.add(var.set_count(count_template))
@@ -319,10 +502,15 @@ _validate_wait_until = cv.maybe_simple_value(
 )


-@register_action("wait_until", WaitUntilAction, _validate_wait_until)
-async def wait_until_action_to_code(config, action_id, template_arg, args):
-    conditions = await build_condition(config[CONF_CONDITION], template_arg, args)
-    var = cg.new_Pvariable(action_id, template_arg, conditions)
+@register_action("wait_until", WaitUntilAction, _validate_wait_until, synchronous=False)
+async def wait_until_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
+    condition = await build_condition(config[CONF_CONDITION], template_arg, args)
+    var = cg.new_Pvariable(action_id, template_arg, condition)
    if CONF_TIMEOUT in config:
        template_ = await cg.templatable(config[CONF_TIMEOUT], args, cg.uint32)
        cg.add(var.set_timeout_value(template_))
@@ -330,10 +518,20 @@ async def wait_until_action_to_code(config, action_id, template_arg, args):
    return var


-@register_action("lambda", LambdaAction, cv.lambda_)
-async def lambda_action_to_code(config, action_id, template_arg, args):
+# Lambda executes user C++ inline and returns — synchronous by execution model.
+# User code could theoretically store the StringRef for deferred use, but StringRef
+# is a view type and storing views beyond their scope is always unsafe regardless
+# of this optimization.  Marking non-synchronous would disable StringRef for nearly
+# all user services since most use lambda.
+@register_action("lambda", LambdaAction, cv.lambda_, synchronous=True)
+async def lambda_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    lambda_ = await cg.process_lambda(config, args, return_type=cg.void)
-    return cg.new_Pvariable(action_id, template_arg, lambda_)
+    return new_lambda_pvariable(action_id, lambda_, StatelessLambdaAction, template_arg)


@register_action(
@@ -344,8 +542,14 @@ async def lambda_action_to_code(config, action_id, template_arg, args):
            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
        }
    ),
+    synchronous=True,
 )
-async def component_update_action_to_code(config, action_id, template_arg, args):
+async def component_update_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    comp = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, comp)

@@ -358,8 +562,14 @@ async def component_update_action_to_code(config, action_id, template_arg, args)
            cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
        }
    ),
+    synchronous=True,
 )
-async def component_suspend_action_to_code(config, action_id, template_arg, args):
+async def component_suspend_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    comp = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, comp)

@@ -375,56 +585,164 @@ async def component_suspend_action_to_code(config, action_id, template_arg, args
            ),
        }
    ),
+    synchronous=True,
 )
-async def component_resume_action_to_code(config, action_id, template_arg, args):
+async def component_resume_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    comp = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, comp)
    if CONF_UPDATE_INTERVAL in config:
-        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, int)
+        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, cg.uint32)
        cg.add(var.set_update_interval(template_))
    return var


-async def build_action(full_config, template_arg, args):
+async def build_action(
+    full_config: ConfigType, template_arg: cg.TemplateArguments, args: TemplateArgsType
+) -> MockObj:
    registry_entry, config = cg.extract_registry_entry_config(
        ACTION_REGISTRY, full_config
    )
    action_id = full_config[CONF_TYPE_ID]
    builder = registry_entry.coroutine_fun
-    ret = await builder(config, action_id, template_arg, args)
-    return ret
+    return await builder(config, action_id, template_arg, args)


-async def build_action_list(config, templ, arg_type):
-    actions = []
+async def build_action_list(
+    config: list[ConfigType], templ: cg.TemplateArguments, arg_type: TemplateArgsType
+) -> list[MockObj]:
+    actions: list[MockObj] = []
    for conf in config:
        action = await build_action(conf, templ, arg_type)
        actions.append(action)
    return actions


-async def build_condition(full_config, template_arg, args):
+async def build_condition(
+    full_config: ConfigType, template_arg: cg.TemplateArguments, args: TemplateArgsType
+) -> MockObj:
    registry_entry, config = cg.extract_registry_entry_config(
        CONDITION_REGISTRY, full_config
    )
    action_id = full_config[CONF_TYPE_ID]
    builder = registry_entry.coroutine_fun
-    ret = await builder(config, action_id, template_arg, args)
-    return ret
+    return await builder(config, action_id, template_arg, args)


-async def build_condition_list(config, templ, args):
-    conditions = []
+async def build_condition_list(
+    config: ConfigType, templ: cg.TemplateArguments, args: TemplateArgsType
+) -> list[MockObj]:
+    conditions: list[MockObj] = []
    for conf in config:
        condition = await build_condition(conf, templ, args)
        conditions.append(condition)
    return conditions


-async def build_automation(trigger, args, config):
+def has_non_synchronous_actions(actions: ConfigType) -> bool:
+    """Check if a validated action list contains any non-synchronous actions.
+
+    Non-synchronous actions (delay, wait_until, script.wait, etc.) store
+    trigger args for later execution, making non-owning types like StringRef
+    unsafe.
+    """
+    if isinstance(actions, list):
+        return any(has_non_synchronous_actions(item) for item in actions)
+    if isinstance(actions, dict):
+        for key in actions:
+            if key in ACTION_REGISTRY and not ACTION_REGISTRY[key].synchronous:
+                return True
+        return any(
+            has_non_synchronous_actions(v)
+            for v in actions.values()
+            if isinstance(v, (list, dict))
+        )
+    return False
+
+
+async def build_automation(
+    trigger: MockObj, args: TemplateArgsType, config: ConfigType
+) -> MockObj:
    arg_types = [arg[0] for arg in args]
    templ = cg.TemplateArguments(*arg_types)
    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ, trigger)
    actions = await build_action_list(config[CONF_THEN], templ, args)
    cg.add(obj.add_actions(actions))
    return obj
+
+
+async def build_callback_automation(
+    parent: MockObj,
+    callback_method: str,
+    args: TemplateArgsType,
+    config: ConfigType,
+    forwarder: MockObj | MockObjClass | None = None,
+) -> None:
+    """Build an Automation and register it as a callback on the parent.
+
+    Eliminates the need for a Trigger wrapper object by registering the
+    automation's trigger() directly as a callback on the parent component.
+
+    Uses template forwarder structs so the compiler deduplicates the operator()
+    body across all call sites with the same signature. The forwarder must be
+    pointer-sized (single Automation* field) to fit inline in Callback::ctx_
+    and avoid heap allocation.
+
+    :param parent: The component object (e.g., button, sensor).
+    :param callback_method: Name of the callback method (e.g., "add_on_press_callback").
+    :param args: Automation template args as list of (type, name) tuples.
+    :param config: The automation config dict.
+    :param forwarder: Optional forwarder type to use instead of the default
+        TriggerForwarder<Ts...>. Pass any struct type whose aggregate init takes
+        a single Automation pointer (e.g., TriggerOnTrueForwarder).
+    """
+    arg_types = [arg[0] for arg in args]
+    templ = cg.TemplateArguments(*arg_types)
+    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ)
+    actions = await build_action_list(config[CONF_THEN], templ, args)
+    cg.add(obj.add_actions(actions))
+    # Use template forwarder structs for deduplication. The compiler generates
+    # one operator() per forwarder type; different automation pointers are just
+    # data in the struct.
+    if forwarder is None:
+        forwarder = TriggerForwarder.template(templ)
+    # RawExpression for aggregate init — both forwarder and obj are codegen
+    # MockObjs (not user input), and there's no Expression type for positional
+    # aggregate initialization (StructInitializer uses named fields).
+    cg.add(getattr(parent, callback_method)(cg.RawExpression(f"{forwarder}{{{obj}}}")))
+
+
+@dataclass(frozen=True, slots=True)
+class CallbackAutomation:
+    """A single callback automation entry for build_callback_automations."""
+
+    conf_key: str
+    callback_method: str
+    args: TemplateArgsType = field(default_factory=list)
+    forwarder: MockObj | MockObjClass | None = None
+
+
+async def build_callback_automations(
+    parent: MockObj,
+    config: ConfigType,
+    entries: tuple[CallbackAutomation, ...],
+) -> None:
+    """Build multiple callback automations from a tuple of entries.
+
+    :param parent: The component object (e.g., button, sensor).
+    :param config: The full component config dict.
+    :param entries: Tuple of CallbackAutomation entries to process.
+    """
+    for entry in entries:
+        for conf in config.get(entry.conf_key, []):
+            await build_callback_automation(
+                parent,
+                entry.callback_method,
+                entry.args,
+                conf,
+                forwarder=entry.forwarder,
+            )
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley)`