Merge branch 'central-netif' into multi-interface-poc

# Conflicts:
#	esphome/components/wifi/wifi_component.cpp

.clang-tidy

@@ -5,24 +5,30 @@ Checks: >-
   -altera-*,
   -android-*,
   -boost-*,
+  -bugprone-derived-method-shadowing-base-method,
   -bugprone-easily-swappable-parameters,
   -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-invalid-enum-default-initialization,
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
+  -bugprone-tagged-union-member-count,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
   -cert-err33-c,
   -cert-err58-cpp,
+  -cert-int09-c,
   -cert-oop57-cpp,
   -cert-str34-c,
   -clang-analyzer-optin.core.EnumCastOutOfRange,
   -clang-analyzer-optin.cplusplus.UninitializedObject,
   -clang-analyzer-osx.*,
+  -clang-analyzer-security.ArrayBound,
   -clang-diagnostic-delete-abstract-non-virtual-dtor,
   -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
   -clang-diagnostic-deprecated-declarations,
   -clang-diagnostic-ignored-optimization-argument,
+  -clang-diagnostic-missing-designated-field-initializers,
   -clang-diagnostic-missing-field-initializers,
   -clang-diagnostic-shadow-field,
   -clang-diagnostic-unused-const-variable,
@@ -42,6 +48,7 @@ Checks: >-
   -cppcoreguidelines-owning-memory,
   -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -cppcoreguidelines-pro-type-const-cast,
@@ -54,12 +61,13 @@ Checks: >-
   -cppcoreguidelines-rvalue-reference-param-not-moved,
   -cppcoreguidelines-special-member-functions,
   -cppcoreguidelines-use-default-member-init,
+  -cppcoreguidelines-use-enum-class,
   -cppcoreguidelines-virtual-class-destructor,
+  -fuchsia-default-arguments-calls,
+  -fuchsia-default-arguments-declarations,
   -fuchsia-multiple-inheritance,
   -fuchsia-overloaded-operator,
   -fuchsia-statically-constructed-objects,
-  -fuchsia-default-arguments-declarations,
-  -fuchsia-default-arguments-calls,
   -google-build-using-namespace,
   -google-explicit-constructor,
   -google-readability-braces-around-statements,
@@ -71,49 +79,63 @@ Checks: >-
   -llvm-else-after-return,
   -llvm-header-guard,
   -llvm-include-order,
+  -llvm-prefer-static-over-anonymous-namespace,
   -llvm-qualified-auto,
+  -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
   -misc-include-cleaner,
+  -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
+  -misc-override-with-different-visibility,
   -misc-unused-parameters,
   -misc-use-anonymous-namespace,
+  -misc-use-internal-linkage,
   -modernize-avoid-bind,
+  -modernize-avoid-variadic-functions,
   -modernize-avoid-c-arrays,
-  -modernize-concat-nested-namespaces,
+  -modernize-avoid-c-style-cast,
   -modernize-macro-to-enum,
   -modernize-return-braced-init-list,
   -modernize-type-traits,
   -modernize-use-auto,
   -modernize-use-constraints,
   -modernize-use-default-member-init,
+  -modernize-use-designated-initializers,
   -modernize-use-equals-default,
+  -modernize-use-integer-sign-comparison,
   -modernize-use-nodiscard,
   -modernize-use-nullptr,
-  -modernize-use-nodiscard,
-  -modernize-use-nullptr,
+  -modernize-use-ranges,
   -modernize-use-trailing-return-type,
   -mpi-*,
   -objc-*,
   -performance-enum-size,
+  -portability-avoid-pragma-once,
+  -portability-template-virtual-member-function,
+  -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
-  -readability-container-contains,
   -readability-container-data-pointer,
   -readability-convert-member-functions-to-static,
   -readability-else-after-return,
+  -readability-enum-initial-value,
   -readability-function-cognitive-complexity,
   -readability-implicit-bool-conversion,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
+  -readability-math-missing-parentheses,
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
   -readability-redundant-member-init,
-  -readability-redundant-string-init,
+  -readability-redundant-parentheses,
+  -readability-redundant-typename,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
+  -readability-use-std-min-max,
+  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
 FormatStyle:     google
 CheckOptions:

.clang-tidy.hash

@@ -1 +1 @@
-d272a88e8ca28ae9340a9a03295a566432a52cb696501908f57764475bf7ca65
+27aaab4e0ebfc10491720345aa746fc2dffa6a3985f73ec111b12dd99078d46f

.claude/skills/pr-workflow/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: pr-workflow
+description: Create pull requests for esphome. Use when creating PRs, submitting changes, or preparing contributions.
+allowed-tools: Read, Bash, Glob, Grep
+---
+
+# ESPHome PR Workflow
+
+When creating a pull request for esphome, follow these steps:
+
+## 1. Create Branch from Upstream
+
+Always base your branch on **upstream** (not origin/fork) to ensure you have the latest code:
+
+```bash
+git fetch upstream
+git checkout -b <branch-name> upstream/dev
+```
+
+## 2. Read the PR Template
+
+Before creating a PR, read `.github/PULL_REQUEST_TEMPLATE.md` to understand required fields.
+
+## 3. Create the PR
+
+Use `gh pr create` with the **full template** filled in. Never skip or abbreviate sections.
+
+Required fields:
+- **What does this implement/fix?**: Brief description of changes
+- **Types of changes**: Check ONE appropriate box (Bugfix, New feature, Breaking change, etc.)
+- **Related issue**: Use `fixes <link>` syntax if applicable
+- **Pull request in esphome-docs**: Link if docs are needed
+- **Test Environment**: Check platforms you tested on
+- **Example config.yaml**: Include working example YAML
+- **Checklist**: Verify code is tested and tests added
+
+## 4. Example PR Body
+
+```markdown
+# What does this implement/fix?
+
+<describe your changes here>
+
+## Types of changes
+
+- [ ] Bugfix (non-breaking change which fixes an issue)
+- [x] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Developer breaking change (an API change that could break external components)
+- [ ] Code quality improvements to existing code or addition of tests
+- [ ] Other
+
+**Related issue or feature (if applicable):**
+
+- fixes https://github.com/esphome/esphome/issues/XXX
+
+**Pull request in [esphome-docs](https://github.com/esphome/esphome-docs) with documentation (if applicable):**
+
+- esphome/esphome-docs#XXX
+
+## Test Environment
+
+- [x] ESP32
+- [x] ESP32 IDF
+- [ ] ESP8266
+- [ ] RP2040
+- [ ] BK72xx
+- [ ] RTL87xx
+- [ ] LN882x
+- [ ] nRF52840
+
+## Example entry for `config.yaml`:
+
+```yaml
+# Example config.yaml
+component_name:
+  id: my_component
+  option: value
+```
+
+## Checklist:
+  - [x] The code change is tested and works locally.
+  - [x] Tests have been added to verify that the new code works (under `tests/` folder).
+
+If user exposed functionality or configuration variables are added/changed:
+  - [ ] Documentation added/updated in [esphome-docs](https://github.com/esphome/esphome-docs).
+```
+
+## 5. Push and Create PR
+
+```bash
+git push -u origin <branch-name>
+gh pr create --repo esphome/esphome --base dev --title "[component] Brief description"
+```
+
+Title should be prefixed with the component name in brackets, e.g. `[safe_mode] Add feature`.

.devcontainer/devcontainer.json

@@ -12,7 +12,7 @@
     "--privileged",
     "-e",
     "GIT_EDITOR=code --wait"
-    // uncomment and edit the path in order to pass though local USB serial to the conatiner
+    // uncomment and edit the path in order to pass through local USB serial to the container
     // , "--device=/dev/ttyACM0"
   ],
   "appPort": 6052,

.dockerignore

@@ -115,4 +115,4 @@ examples/
 Dockerfile
 .git/
 tests/
-.*
+.?*

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,8 +6,9 @@
 
 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Developer breaking change (an API change that could break external components)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — [policy](https://developers.esphome.io/contributing/code/#what-constitutes-a-c-breaking-change)
+- [ ] Developer breaking change (an API change that could break external components) — [policy](https://developers.esphome.io/contributing/code/#what-is-considered-public-c-api)
+- [ ] Undocumented C++ API change (removal or change of undocumented public methods that lambda users may depend on) — [policy](https://developers.esphome.io/contributing/code/#c-user-expectations)
 - [ ] Code quality improvements to existing code or addition of tests
 - [ ] Other
 
@@ -24,7 +25,7 @@
 - [ ] ESP32
 - [ ] ESP32 IDF
 - [ ] ESP8266
-- [ ] RP2040
+- [ ] RP2040/RP2350
 - [ ] BK72xx
 - [ ] RTL87xx
 - [ ] LN882x

.github/actions/build-image/action.yaml

@@ -47,7 +47,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -73,7 +73,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+      uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

.github/actions/restore-python/action.yml

@@ -17,16 +17,28 @@ runs:
   steps:
     - name: Set up Python ${{ inputs.python-version }}
       id: python
-      uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: venv
         # yamllint disable-line rule:line-length
         key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ inputs.cache-key }}
+    - name: Set up uv
+      # Only needed on cache miss to populate the venv. ``uv pip install``
+      # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
+      # downstream jobs rely on is preserved.
+      if: steps.cache-venv.outputs.cache-hit != 'true'
+      uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+      with:
+        enable-cache: true
+        # Pin uv version so the action does not have to fetch the
+        # manifest from raw.githubusercontent.com on every cache
+        # miss; that fetch flakes on Windows runners.
+        version: "0.11.15"
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os != 'Windows'
       shell: bash
@@ -34,8 +46,8 @@ runs:
         python -m venv venv
         source venv/bin/activate
         python --version
-        pip install -r requirements.txt -r requirements_test.txt
-        pip install -e .
+        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -e .
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
       shell: bash
@@ -43,5 +55,5 @@ runs:
         python -m venv venv
         source ./venv/Scripts/activate
         python --version
-        pip install -r requirements.txt -r requirements_test.txt
-        pip install -e .
+        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -e .

.github/copilot-instructions.md

@@ -1 +1 @@
-../.ai/instructions.md
+../AGENTS.md

.github/scripts/auto-label-pr/constants.js

@@ -0,0 +1,41 @@
+// Constants and markers for PR auto-labeling
+module.exports = {
+  BOT_COMMENT_MARKER: '<!-- auto-label-pr-bot -->',
+  CODEOWNERS_MARKER: '<!-- codeowners-request -->',
+  TOO_BIG_MARKER: '<!-- too-big-request -->',
+  DEPRECATED_COMPONENT_MARKER: '<!-- deprecated-component-request -->',
+  ORG_FORK_MARKER: '<!-- maintainer-access-warning -->',
+
+  MANAGED_LABELS: [
+    'new-component',
+    'new-platform',
+    'new-target-platform',
+    'merging-to-release',
+    'merging-to-beta',
+    'chained-pr',
+    'core',
+    'small-pr',
+    'medium-pr',
+    'dashboard',
+    'github-actions',
+    'by-code-owner',
+    'has-tests',
+    'needs-tests',
+    'needs-docs',
+    'needs-codeowners',
+    'too-big',
+    'labeller-recheck',
+    'bugfix',
+    'new-feature',
+    'breaking-change',
+    'developer-breaking-change',
+    'undocumented-api-change',
+    'code-quality',
+    'deprecated-component'
+  ],
+
+  DOCS_PR_PATTERNS: [
+    /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
+    /esphome\/esphome-docs#\d+/
+  ]
+};

.github/scripts/auto-label-pr/detectors.js

@@ -0,0 +1,395 @@
+const { DOCS_PR_PATTERNS } = require('./constants');
+const {
+  COMPONENT_REGEX,
+  detectComponents,
+  hasCoreChanges,
+  hasDashboardChanges,
+  hasGitHubActionsChanges,
+} = require('../detect-tags');
+const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
+
+// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
+// Ruff/Black enforce exactly one space around `=` and no space before `:`,
+// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
+const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
+
+// Fetch a file's contents from the PR head SHA via the GitHub API.
+// The auto-label workflow runs on `pull_request_target`, which checks out the
+// base branch — files added by the PR don't exist in the workspace, so we have
+// to fetch them from the head SHA. Returns null if the file can't be fetched.
+async function fetchPrFileContent(github, context, path) {
+  try {
+    const { owner, repo } = context.repo;
+    const { data } = await github.rest.repos.getContent({
+      owner,
+      repo,
+      path,
+      ref: context.payload.pull_request.head.sha,
+    });
+    return Buffer.from(data.content, 'base64').toString('utf8');
+  } catch (error) {
+    console.log(`Failed to fetch ${path} from PR head:`, error.message);
+    return null;
+  }
+}
+
+// Strategy: Merge branch detection
+async function detectMergeBranch(context) {
+  const labels = new Set();
+  const baseRef = context.payload.pull_request.base.ref;
+
+  if (baseRef === 'release') {
+    labels.add('merging-to-release');
+  } else if (baseRef === 'beta') {
+    labels.add('merging-to-beta');
+  } else if (baseRef !== 'dev') {
+    labels.add('chained-pr');
+  }
+
+  return labels;
+}
+
+// Strategy: Component and platform labeling
+async function detectComponentPlatforms(changedFiles, apiData) {
+  const labels = new Set();
+  const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
+
+  for (const comp of detectComponents(changedFiles)) {
+    labels.add(`component: ${comp}`);
+  }
+
+  for (const file of changedFiles) {
+    const platformMatch = file.match(targetPlatformRegex);
+    if (platformMatch) {
+      labels.add(`platform: ${platformMatch[1]}`);
+    }
+  }
+
+  return labels;
+}
+
+// Strategy: New component detection
+async function detectNewComponents(github, context, prFiles) {
+  const labels = new Set();
+  let hasYamlLoadable = false;
+  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+  for (const file of addedFiles) {
+    const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
+    if (!componentMatch) continue;
+
+    labels.add('new-component');
+    const content = await fetchPrFileContent(github, context, file);
+    if (content === null) {
+      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+      hasYamlLoadable = true;
+      continue;
+    }
+    if (content.includes('IS_TARGET_PLATFORM = True')) {
+      labels.add('new-target-platform');
+    }
+    if (CONFIG_SCHEMA_REGEX.test(content)) {
+      hasYamlLoadable = true;
+    }
+  }
+
+  return { labels, hasYamlLoadable };
+}
+
+// Strategy: New platform detection
+async function detectNewPlatforms(github, context, prFiles, apiData) {
+  const labels = new Set();
+  let hasYamlLoadable = false;
+  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+  const platformPathPatterns = [
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
+  ];
+
+  for (const file of addedFiles) {
+    for (const re of platformPathPatterns) {
+      const match = file.match(re);
+      if (!match) continue;
+      const platform = match[2];
+      if (!apiData.platformComponents.includes(platform)) break;
+
+      labels.add('new-platform');
+      const content = await fetchPrFileContent(github, context, file);
+      if (content === null) {
+        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+        hasYamlLoadable = true;
+      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
+        hasYamlLoadable = true;
+      }
+      break;
+    }
+  }
+
+  return { labels, hasYamlLoadable };
+}
+
+// Strategy: Core files detection
+async function detectCoreChanges(changedFiles) {
+  const labels = new Set();
+  if (hasCoreChanges(changedFiles)) {
+    labels.add('core');
+  }
+  return labels;
+}
+
+// Strategy: PR size detection
+async function detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD) {
+  const labels = new Set();
+
+  if (totalChanges <= SMALL_PR_THRESHOLD) {
+    labels.add('small-pr');
+    return labels;
+  }
+
+  if (totalChanges <= MEDIUM_PR_THRESHOLD) {
+    labels.add('medium-pr');
+    return labels;
+  }
+
+  const testAdditions = prFiles
+    .filter(file => file.filename.startsWith('tests/'))
+    .reduce((sum, file) => sum + (file.additions || 0), 0);
+  const testDeletions = prFiles
+    .filter(file => file.filename.startsWith('tests/'))
+    .reduce((sum, file) => sum + (file.deletions || 0), 0);
+
+  const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
+
+  // Don't add too-big if mega-pr label is already present
+  if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
+    labels.add('too-big');
+  }
+
+  return labels;
+}
+
+// Strategy: Dashboard changes
+async function detectDashboardChanges(changedFiles) {
+  const labels = new Set();
+  if (hasDashboardChanges(changedFiles)) {
+    labels.add('dashboard');
+  }
+  return labels;
+}
+
+// Strategy: GitHub Actions changes
+async function detectGitHubActionsChanges(changedFiles) {
+  const labels = new Set();
+  if (hasGitHubActionsChanges(changedFiles)) {
+    labels.add('github-actions');
+  }
+  return labels;
+}
+
+// Strategy: Code owner detection
+async function detectCodeOwner(github, context, changedFiles) {
+  const labels = new Set();
+
+  try {
+    const codeownersPatterns = loadCodeowners();
+    const prAuthor = context.payload.pull_request.user.login;
+
+    // Check if PR author is a codeowner of any changed file
+    const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+    if (effective.users.has(prAuthor)) {
+      labels.add('by-code-owner');
+    }
+  } catch (error) {
+    console.log('Failed to read or parse CODEOWNERS file:', error.message);
+  }
+
+  return labels;
+}
+
+// Strategy: Test detection
+async function detectTests(changedFiles) {
+  const labels = new Set();
+  const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
+
+  if (testFiles.length > 0) {
+    labels.add('has-tests');
+  }
+
+  return labels;
+}
+
+// Strategy: PR Template Checkbox detection
+async function detectPRTemplateCheckboxes(context) {
+  const labels = new Set();
+  const prBody = context.payload.pull_request.body || '';
+
+  console.log('Checking PR template checkboxes...');
+
+  // Check for checked checkboxes in the "Types of changes" section
+  const checkboxPatterns = [
+    { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
+    { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
+    { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
+    { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
+    { pattern: /- \[x\] Undocumented C\+\+ API change \(removal or change of undocumented public methods that lambda users may depend on\)/i, label: 'undocumented-api-change' },
+    { pattern: /- \[x\] Code quality improvements to existing code or addition of tests/i, label: 'code-quality' }
+  ];
+
+  for (const { pattern, label } of checkboxPatterns) {
+    if (pattern.test(prBody)) {
+      console.log(`Found checked checkbox for: ${label}`);
+      labels.add(label);
+    }
+  }
+
+  return labels;
+}
+
+// Strategy: Deprecated component detection
+async function detectDeprecatedComponents(github, context, changedFiles) {
+  const labels = new Set();
+  const deprecatedInfo = [];
+  const { owner, repo } = context.repo;
+
+  // Compile regex once for better performance
+  const componentFileRegex = COMPONENT_REGEX;
+
+  // Get files that are modified or added in components directory
+  const componentFiles = changedFiles.filter(file => componentFileRegex.test(file));
+
+  if (componentFiles.length === 0) {
+    return { labels, deprecatedInfo };
+  }
+
+  // Extract unique component names using the same regex
+  const components = new Set();
+  for (const file of componentFiles) {
+    const match = file.match(componentFileRegex);
+    if (match) {
+      components.add(match[1]);
+    }
+  }
+
+  // Get base branch ref to check if deprecation already exists for the component
+  // This prevents flagging a PR that simply adds deprecation
+  const baseRef = context.payload.pull_request.base.ref;
+
+  // Check each component's __init__.py for DEPRECATED_COMPONENT constant
+  for (const component of components) {
+    const initFile = `esphome/components/${component}/__init__.py`;
+    try {
+      // Fetch file content from base branch using GitHub API
+      const { data: fileData } = await github.rest.repos.getContent({
+        owner,
+        repo,
+        path: initFile,
+        ref: baseRef
+      });
+
+      // Decode base64 content
+      const content = Buffer.from(fileData.content, 'base64').toString('utf8');
+
+      // Look for DEPRECATED_COMPONENT = "message" or DEPRECATED_COMPONENT = 'message'
+      // Support single quotes, double quotes, and triple quotes (for multiline)
+      const doubleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*"""([\s\S]*?)"""/s) ||
+                              content.match(/DEPRECATED_COMPONENT\s*=\s*"((?:[^"\\]|\\.)*)"/);
+      const singleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*'''([\s\S]*?)'''/s) ||
+                              content.match(/DEPRECATED_COMPONENT\s*=\s*'((?:[^'\\]|\\.)*)'/);
+      const deprecatedMatch = doubleQuoteMatch || singleQuoteMatch;
+
+      if (deprecatedMatch) {
+        labels.add('deprecated-component');
+        deprecatedInfo.push({
+          component: component,
+          message: deprecatedMatch[1].trim()
+        });
+        console.log(`Found deprecated component: ${component}`);
+      }
+    } catch (error) {
+      // Only log if it's not a simple "file not found" error (404)
+      if (error.status !== 404) {
+        console.log(`Error reading ${initFile}:`, error.message);
+      }
+    }
+  }
+
+  return { labels, deprecatedInfo };
+}
+
+// Strategy: Detect when maintainers cannot modify the PR branch
+function detectMaintainerAccess(context) {
+  const pr = context.payload.pull_request;
+
+  // Only relevant for cross-repo PRs (forks)
+  if (!pr.head.repo || pr.head.repo.full_name === pr.base.repo.full_name) {
+    return null;
+  }
+
+  if (pr.maintainer_can_modify) {
+    return null;
+  }
+
+  const isOrgFork = pr.head.repo.owner.type === 'Organization';
+  console.log(`Maintainer cannot modify PR branch (${isOrgFork ? 'org fork: ' + pr.head.repo.owner.login : 'user disabled'})`);
+  return { isOrgFork, orgName: pr.head.repo.owner.login };
+}
+
+// Strategy: Requirements detection
+async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
+  const labels = new Set();
+
+  // Check for missing tests
+  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) && !allLabels.has('has-tests')) {
+    labels.add('needs-tests');
+  }
+
+  // Check for missing docs.
+  // `new-feature` (PR-body checkbox) always counts. `new-component` / `new-platform`
+  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
+  // i.e. the new component/platform is actually loadable from YAML.
+  const docsEligible =
+    allLabels.has('new-feature') ||
+    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
+
+  if (docsEligible) {
+    const prBody = context.payload.pull_request.body || '';
+    const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
+
+    if (!hasDocsLink) {
+      labels.add('needs-docs');
+    }
+  }
+
+  // Check for missing CODEOWNERS
+  if (allLabels.has('new-component')) {
+    const codeownersModified = prFiles.some(file =>
+      file.filename === 'CODEOWNERS' &&
+      (file.status === 'modified' || file.status === 'added') &&
+      (file.additions || 0) > 0
+    );
+
+    if (!codeownersModified) {
+      labels.add('needs-codeowners');
+    }
+  }
+
+  return labels;
+}
+
+module.exports = {
+  detectMergeBranch,
+  detectComponentPlatforms,
+  detectNewComponents,
+  detectNewPlatforms,
+  detectCoreChanges,
+  detectPRSize,
+  detectDashboardChanges,
+  detectGitHubActionsChanges,
+  detectCodeOwner,
+  detectTests,
+  detectPRTemplateCheckboxes,
+  detectDeprecatedComponents,
+  detectMaintainerAccess,
+  detectRequirements
+};

.github/scripts/auto-label-pr/index.js

@@ -0,0 +1,201 @@
+const { MANAGED_LABELS } = require('./constants');
+const {
+  detectMergeBranch,
+  detectComponentPlatforms,
+  detectNewComponents,
+  detectNewPlatforms,
+  detectCoreChanges,
+  detectPRSize,
+  detectDashboardChanges,
+  detectGitHubActionsChanges,
+  detectCodeOwner,
+  detectTests,
+  detectPRTemplateCheckboxes,
+  detectDeprecatedComponents,
+  detectMaintainerAccess,
+  detectRequirements
+} = require('./detectors');
+const { handleReviews, handleMaintainerAccessComment } = require('./reviews');
+const { applyLabels, removeOldLabels } = require('./labels');
+
+// Fetch API data
+async function fetchApiData() {
+  try {
+    const response = await fetch('https://data.esphome.io/components.json');
+    const componentsData = await response.json();
+    return {
+      targetPlatforms: componentsData.target_platforms || [],
+      platformComponents: componentsData.platform_components || []
+    };
+  } catch (error) {
+    console.log('Failed to fetch components data from API:', error.message);
+    return { targetPlatforms: [], platformComponents: [] };
+  }
+}
+
+module.exports = async ({ github, context }) => {
+  // Environment variables
+  const SMALL_PR_THRESHOLD = parseInt(process.env.SMALL_PR_THRESHOLD);
+  const MEDIUM_PR_THRESHOLD = parseInt(process.env.MEDIUM_PR_THRESHOLD);
+  const MAX_LABELS = parseInt(process.env.MAX_LABELS);
+  const TOO_BIG_THRESHOLD = parseInt(process.env.TOO_BIG_THRESHOLD);
+  const COMPONENT_LABEL_THRESHOLD = parseInt(process.env.COMPONENT_LABEL_THRESHOLD);
+
+  // Global state
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  // Get current labels and PR data
+  const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
+    owner,
+    repo,
+    issue_number: pr_number
+  });
+  const currentLabels = currentLabelsData.map(label => label.name);
+  const managedLabels = currentLabels.filter(label =>
+    label.startsWith('component: ') || MANAGED_LABELS.includes(label)
+  );
+
+  // Check for mega-PR early - if present, skip most automatic labeling
+  const isMegaPR = currentLabels.includes('mega-pr');
+
+  // Get all PR files with automatic pagination
+  const prFiles = await github.paginate(
+    github.rest.pulls.listFiles,
+    {
+      owner,
+      repo,
+      pull_number: pr_number
+    }
+  );
+
+  // Calculate data from PR files
+  const changedFiles = prFiles.map(file => file.filename);
+  const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
+  const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
+  const totalChanges = totalAdditions + totalDeletions;
+
+  console.log('Current labels:', currentLabels.join(', '));
+  console.log('Changed files:', changedFiles.length);
+  console.log('Total changes:', totalChanges);
+  if (isMegaPR) {
+    console.log('Mega-PR detected - applying limited labeling logic');
+  }
+
+  // Fetch API data
+  const apiData = await fetchApiData();
+  const baseRef = context.payload.pull_request.base.ref;
+
+  // Early exit for release and beta branches only
+  if (baseRef === 'release' || baseRef === 'beta') {
+    const branchLabels = await detectMergeBranch(context);
+    const finalLabels = Array.from(branchLabels);
+
+    console.log('Computed labels (merge branch only):', finalLabels.join(', '));
+
+    // Apply labels
+    await applyLabels(github, context, finalLabels);
+
+    // Remove old managed labels
+    await removeOldLabels(github, context, managedLabels, finalLabels);
+
+    return;
+  }
+
+  // Run all strategies
+  const [
+    branchLabels,
+    componentLabels,
+    newComponentResult,
+    newPlatformResult,
+    coreLabels,
+    sizeLabels,
+    dashboardLabels,
+    actionsLabels,
+    codeOwnerLabels,
+    testLabels,
+    checkboxLabels,
+    deprecatedResult,
+    maintainerAccess
+  ] = await Promise.all([
+    detectMergeBranch(context),
+    detectComponentPlatforms(changedFiles, apiData),
+    detectNewComponents(github, context, prFiles),
+    detectNewPlatforms(github, context, prFiles, apiData),
+    detectCoreChanges(changedFiles),
+    detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
+    detectDashboardChanges(changedFiles),
+    detectGitHubActionsChanges(changedFiles),
+    detectCodeOwner(github, context, changedFiles),
+    detectTests(changedFiles),
+    detectPRTemplateCheckboxes(context),
+    detectDeprecatedComponents(github, context, changedFiles),
+    detectMaintainerAccess(context)
+  ]);
+
+  // Extract new-component / new-platform results
+  const newComponentLabels = newComponentResult.labels;
+  const newPlatformLabels = newPlatformResult.labels;
+  // Eligible for needs-docs only if any newly added component or platform file
+  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
+  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
+
+  // Extract deprecated component info
+  const deprecatedLabels = deprecatedResult.labels;
+  const deprecatedInfo = deprecatedResult.deprecatedInfo;
+
+  // Combine all labels
+  const allLabels = new Set([
+    ...branchLabels,
+    ...componentLabels,
+    ...newComponentLabels,
+    ...newPlatformLabels,
+    ...coreLabels,
+    ...sizeLabels,
+    ...dashboardLabels,
+    ...actionsLabels,
+    ...codeOwnerLabels,
+    ...testLabels,
+    ...checkboxLabels,
+    ...deprecatedLabels
+  ]);
+
+  // Detect requirements based on all other labels
+  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
+  for (const label of requirementLabels) {
+    allLabels.add(label);
+  }
+
+  let finalLabels = Array.from(allLabels);
+
+  // For mega-PRs, exclude component labels if there are too many
+  if (isMegaPR) {
+    const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
+    if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
+      finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
+      console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
+    }
+  }
+
+  // Handle too many labels (only for non-mega PRs)
+  const tooManyLabels = finalLabels.length > MAX_LABELS;
+  const originalLabelCount = finalLabels.length;
+
+  if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
+    finalLabels = ['too-big'];
+  }
+
+  console.log('Computed labels:', finalLabels.join(', '));
+
+  // Handle reviews and org fork comment
+  await Promise.all([
+    handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD),
+    handleMaintainerAccessComment(github, context, maintainerAccess)
+  ]);
+
+  // Apply labels
+  await applyLabels(github, context, finalLabels);
+
+  // Remove old managed labels
+  await removeOldLabels(github, context, managedLabels, finalLabels);
+};

.github/scripts/auto-label-pr/labels.js

@@ -0,0 +1,41 @@
+// Apply labels to PR
+async function applyLabels(github, context, finalLabels) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  if (finalLabels.length > 0) {
+    console.log(`Adding labels: ${finalLabels.join(', ')}`);
+    await github.rest.issues.addLabels({
+      owner,
+      repo,
+      issue_number: pr_number,
+      labels: finalLabels
+    });
+  }
+}
+
+// Remove old managed labels
+async function removeOldLabels(github, context, managedLabels, finalLabels) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+
+  const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
+  for (const label of labelsToRemove) {
+    console.log(`Removing label: ${label}`);
+    try {
+      await github.rest.issues.removeLabel({
+        owner,
+        repo,
+        issue_number: pr_number,
+        name: label
+      });
+    } catch (error) {
+      console.log(`Failed to remove label ${label}:`, error.message);
+    }
+  }
+}
+
+module.exports = {
+  applyLabels,
+  removeOldLabels
+};

.github/scripts/auto-label-pr/reviews.js

@@ -0,0 +1,219 @@
+const {
+  BOT_COMMENT_MARKER,
+  CODEOWNERS_MARKER,
+  TOO_BIG_MARKER,
+  DEPRECATED_COMPONENT_MARKER,
+  ORG_FORK_MARKER
+} = require('./constants');
+
+// Generate review messages
+function generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD) {
+  const messages = [];
+
+  // Deprecated component message
+  if (finalLabels.includes('deprecated-component') && deprecatedInfo && deprecatedInfo.length > 0) {
+    let message = `${DEPRECATED_COMPONENT_MARKER}\n### ⚠️ Deprecated Component\n\n`;
+    message += `Hey there @${prAuthor},\n`;
+    message += `This PR modifies one or more deprecated components. Please be aware:\n\n`;
+
+    for (const info of deprecatedInfo) {
+      message += `#### Component: \`${info.component}\`\n`;
+      message += `${info.message}\n\n`;
+    }
+
+    message += `Consider migrating to the recommended alternative if applicable.`;
+
+    messages.push(message);
+  }
+
+  // Too big message
+  if (finalLabels.includes('too-big')) {
+    const testAdditions = prFiles
+      .filter(file => file.filename.startsWith('tests/'))
+      .reduce((sum, file) => sum + (file.additions || 0), 0);
+    const testDeletions = prFiles
+      .filter(file => file.filename.startsWith('tests/'))
+      .reduce((sum, file) => sum + (file.deletions || 0), 0);
+    const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
+
+    const tooManyLabels = originalLabelCount > MAX_LABELS;
+    const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
+
+    let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
+
+    message +=
+      `Hey @${prAuthor}, thanks for the contribution! Just a heads up, ` +
+      `this PR is on the large side `;
+
+    if (tooManyLabels && tooManyChanges) {
+      message +=
+        `(${nonTestChanges} line changes excluding tests, across ` +
+        `${originalLabelCount} different components/areas)`;
+    } else if (tooManyLabels) {
+      message +=
+        `(it touches ${originalLabelCount} different components/areas)`;
+    } else {
+      message += `(${nonTestChanges} line changes excluding tests)`;
+    }
+
+    message += `, which makes it harder for maintainers to review.\n\n`;
+    message +=
+      `Smaller, focused PRs tend to be reviewed much faster since they ` +
+      `fit into the short gaps between other maintainer work; large ones ` +
+      `often have to wait for a rare long uninterrupted block of time. ` +
+      `If you can break this up into smaller pieces that can be reviewed ` +
+      `independently, it will almost certainly land faster overall.\n\n`;
+    message +=
+      `Before putting more time in, it's also worth popping into ` +
+      `\`#devs\` on [Discord](https://esphome.io/chat) so we can help ` +
+      `you scope things and flag anything already in flight.\n\n`;
+    message +=
+      `For more details (including how to split the work up), see: ` +
+      `https://developers.esphome.io/contributing/submitting-your-work/` +
+      `#how-to-approach-large-submissions`;
+
+    messages.push(message);
+  }
+
+  // CODEOWNERS message
+  if (finalLabels.includes('needs-codeowners')) {
+    const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
+      `This way we can notify you if a bug report for this integration is reported.\n\n` +
+      `In \`__init__.py\` of the integration, please add:\n\n` +
+      `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
+      `And run \`script/build_codeowners.py\``;
+
+    messages.push(message);
+  }
+
+  return messages;
+}
+
+// Handle reviews
+async function handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD) {
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+  const prAuthor = context.payload.pull_request.user.login;
+
+  const reviewMessages = generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD);
+  const hasReviewableLabels = finalLabels.some(label =>
+    ['too-big', 'needs-codeowners', 'deprecated-component'].includes(label)
+  );
+
+  const { data: reviews } = await github.rest.pulls.listReviews({
+    owner,
+    repo,
+    pull_number: pr_number
+  });
+
+  const botReviews = reviews.filter(review =>
+    review.user.type === 'Bot' &&
+    review.state === 'CHANGES_REQUESTED' &&
+    review.body && review.body.includes(BOT_COMMENT_MARKER)
+  );
+
+  if (hasReviewableLabels) {
+    const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
+
+    if (botReviews.length > 0) {
+      // Update existing review
+      await github.rest.pulls.updateReview({
+        owner,
+        repo,
+        pull_number: pr_number,
+        review_id: botReviews[0].id,
+        body: reviewBody
+      });
+      console.log('Updated existing bot review');
+    } else {
+      // Create new review
+      await github.rest.pulls.createReview({
+        owner,
+        repo,
+        pull_number: pr_number,
+        body: reviewBody,
+        event: 'REQUEST_CHANGES'
+      });
+      console.log('Created new bot review');
+    }
+  } else if (botReviews.length > 0) {
+    // Dismiss existing reviews
+    for (const review of botReviews) {
+      try {
+        await github.rest.pulls.dismissReview({
+          owner,
+          repo,
+          pull_number: pr_number,
+          review_id: review.id,
+          message: 'Review dismissed: All requirements have been met'
+        });
+        console.log(`Dismissed bot review ${review.id}`);
+      } catch (error) {
+        console.log(`Failed to dismiss review ${review.id}:`, error.message);
+      }
+    }
+  }
+}
+
+// Handle maintainer access warning comment
+async function handleMaintainerAccessComment(github, context, maintainerAccess) {
+  if (!maintainerAccess) {
+    return;
+  }
+
+  const { owner, repo } = context.repo;
+  const pr_number = context.issue.number;
+  const prAuthor = context.payload.pull_request.user.login;
+
+  // Check if we already posted the warning (iterate pages to exit early)
+  let existingComment;
+  for await (const { data: comments } of github.paginate.iterator(
+    github.rest.issues.listComments,
+    { owner, repo, issue_number: pr_number }
+  )) {
+    existingComment = comments.find(comment =>
+      comment.user.type === 'Bot' &&
+      comment.body && comment.body.includes(ORG_FORK_MARKER)
+    );
+    if (existingComment) {
+      break;
+    }
+  }
+
+  if (existingComment) {
+    console.log('Maintainer access warning comment already exists, skipping');
+    return;
+  }
+
+  let body;
+  if (maintainerAccess.isOrgFork) {
+    body = `${ORG_FORK_MARKER}\n### ⚠️ Organization Fork Detected\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `It looks like this PR was submitted from a fork owned by the **${maintainerAccess.orgName}** organization. ` +
+      `GitHub does not allow maintainers to push changes to pull request branches when the fork is owned by an organization. ` +
+      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
+      `To allow maintainer collaboration, please re-submit this PR from a personal fork instead.\n\n` +
+      `See: [Setting up the local repository](https://developers.esphome.io/contributing/development-environment/?h=org#set-up-the-local-repository) for more details.`;
+  } else {
+    body = `${ORG_FORK_MARKER}\n### ⚠️ Maintainer Access Disabled\n\n` +
+      `Hey there @${prAuthor},\n` +
+      `It looks like this PR does not have the "Allow edits from maintainers" option enabled. ` +
+      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
+      `Please enable this option in the PR sidebar to allow maintainer collaboration.`;
+  }
+
+  await github.rest.issues.createComment({
+    owner,
+    repo,
+    issue_number: pr_number,
+    body
+  });
+  console.log('Created maintainer access warning comment');
+}
+
+module.exports = {
+  handleReviews,
+  handleMaintainerAccessComment
+};

.github/scripts/codeowners.js

@@ -0,0 +1,227 @@
+// Shared CODEOWNERS parsing and matching utilities.
+//
+// Used by:
+//   - codeowner-review-request.yml
+//   - codeowner-approved-label-update.yml
+//   - auto-label-pr/detectors.js (detectCodeOwner)
+
+/**
+ * Convert a CODEOWNERS glob pattern to a RegExp.
+ *
+ * Handles **, *, and ? wildcards after escaping regex-special characters.
+ */
+function globToRegex(pattern) {
+  let regexStr = pattern
+    .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
+    .replace(/\*\*/g, '\x00GLOBSTAR\x00')  // protect ** from next replace
+    .replace(/\*/g, '[^/]*')               // single star
+    .replace(/\x00GLOBSTAR\x00/g, '.*')    // restore globstar
+    .replace(/\?/g, '.');
+  return new RegExp('^' + regexStr + '$');
+}
+
+/**
+ * Parse raw CODEOWNERS file content into an array of
+ * { pattern, regex, owners } objects.
+ *
+ * Each `owners` entry is the raw string from the file (e.g. "@user" or
+ * "@esphome/core").
+ */
+function parseCodeowners(content) {
+  const lines = content
+    .split('\n')
+    .map(line => line.trim())
+    .filter(line => line && !line.startsWith('#'));
+
+  const patterns = [];
+  for (const line of lines) {
+    const parts = line.split(/\s+/);
+    if (parts.length < 2) continue;
+
+    const pattern = parts[0];
+    const owners = parts.slice(1);
+    const regex = globToRegex(pattern);
+    patterns.push({ pattern, regex, owners });
+  }
+  return patterns;
+}
+
+/**
+ * Fetch and parse the CODEOWNERS file via the GitHub API.
+ *
+ * @param {object} github  - octokit instance from actions/github-script
+ * @param {string} owner   - repo owner
+ * @param {string} repo    - repo name
+ * @param {string} [ref]   - git ref (SHA / branch) to read from
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+async function fetchCodeowners(github, owner, repo, ref) {
+  const params = { owner, repo, path: 'CODEOWNERS' };
+  if (ref) params.ref = ref;
+
+  const { data: file } = await github.rest.repos.getContent(params);
+  const content = Buffer.from(file.content, 'base64').toString('utf8');
+  return parseCodeowners(content);
+}
+
+/**
+ * Classify raw owner strings into individual users and teams.
+ *
+ * @param {string[]} rawOwners - e.g. ["@user1", "@esphome/core"]
+ * @returns {{ users: string[], teams: string[] }}
+ *   users  – login names without "@"
+ *   teams  – team slugs without the "org/" prefix
+ */
+function classifyOwners(rawOwners) {
+  const users = [];
+  const teams = [];
+  for (const o of rawOwners) {
+    const clean = o.startsWith('@') ? o.slice(1) : o;
+    if (clean.includes('/')) {
+      teams.push(clean.split('/')[1]);
+    } else {
+      users.push(clean);
+    }
+  }
+  return { users, teams };
+}
+
+/**
+ * For each file, find its effective codeowners using GitHub's
+ * "last match wins" semantics, then union across all files.
+ *
+ * @param {string[]} files              - list of file paths
+ * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
+ * @returns {{ users: Set<string>, teams: Set<string>, matchedFileCount: number }}
+ */
+function getEffectiveOwners(files, codeownersPatterns) {
+  const users = new Set();
+  const teams = new Set();
+  let matchedFileCount = 0;
+
+  for (const file of files) {
+    // Last matching pattern wins for each file
+    let effectiveOwners = null;
+    for (const { regex, owners } of codeownersPatterns) {
+      if (regex.test(file)) {
+        effectiveOwners = owners;
+      }
+    }
+    if (effectiveOwners) {
+      matchedFileCount++;
+      const classified = classifyOwners(effectiveOwners);
+      for (const u of classified.users) users.add(u);
+      for (const t of classified.teams) teams.add(t);
+    }
+  }
+
+  return { users, teams, matchedFileCount };
+}
+
+/**
+ * Read and parse the CODEOWNERS file from disk.
+ *
+ * Use this when the repo is already checked out (avoids an API call).
+ *
+ * @param {string} [repoRoot='.'] - path to the repo root
+ * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
+ */
+function loadCodeowners(repoRoot = '.') {
+  const fs = require('fs');
+  const path = require('path');
+  const content = fs.readFileSync(path.join(repoRoot, 'CODEOWNERS'), 'utf8');
+  return parseCodeowners(content);
+}
+
+/** Possible label actions returned by determineLabelAction. */
+const LabelAction = Object.freeze({
+  ADD: 'add',
+  REMOVE: 'remove',
+  NONE: 'none',
+});
+
+/**
+ * Determine what label action is needed for a PR based on codeowner approvals.
+ *
+ * Checks changed files against CODEOWNERS patterns, reviews, and current labels
+ * to decide if the label should be added, removed, or left unchanged.
+ *
+ * @param {object} github              - octokit instance from actions/github-script
+ * @param {string} owner               - repo owner
+ * @param {string} repo                - repo name
+ * @param {number} pr_number           - pull request number
+ * @param {Array}  codeownersPatterns   - from loadCodeowners / fetchCodeowners
+ * @param {string} labelName           - label to manage
+ * @returns {Promise<LabelAction>}
+ */
+async function determineLabelAction(github, owner, repo, pr_number, codeownersPatterns, labelName) {
+  // Get the list of changed files in this PR
+  const prFiles = await github.paginate(
+    github.rest.pulls.listFiles,
+    { owner, repo, pull_number: pr_number }
+  );
+
+  const changedFiles = prFiles.map(file => file.filename);
+  console.log(`Found ${changedFiles.length} changed files`);
+
+  if (changedFiles.length === 0) {
+    console.log('No changed files found');
+    return LabelAction.NONE;
+  }
+
+  // Get effective owners using last-match-wins semantics
+  const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+  const componentCodeowners = effective.users;
+
+  console.log(`Component-specific codeowners: ${Array.from(componentCodeowners).join(', ') || '(none)'}`);
+
+  // Get current labels
+  const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
+    owner, repo, issue_number: pr_number
+  });
+  const hasLabel = currentLabels.some(label => label.name === labelName);
+
+  if (componentCodeowners.size === 0) {
+    console.log('No component-specific codeowners found');
+    return hasLabel ? LabelAction.REMOVE : LabelAction.NONE;
+  }
+
+  // Get all reviews and find latest per user
+  const reviews = await github.paginate(
+    github.rest.pulls.listReviews,
+    { owner, repo, pull_number: pr_number }
+  );
+
+  const latestReviewByUser = new Map();
+  for (const review of reviews) {
+    if (!review.user || review.user.type === 'Bot' || review.state === 'COMMENTED') continue;
+    latestReviewByUser.set(review.user.login, review);
+  }
+
+  // Check if any component-specific codeowner has an active approval
+  let hasCodeownerApproval = false;
+  for (const [login, review] of latestReviewByUser) {
+    if (review.state === 'APPROVED' && componentCodeowners.has(login)) {
+      console.log(`Codeowner '${login}' has approved`);
+      hasCodeownerApproval = true;
+      break;
+    }
+  }
+
+  if (hasCodeownerApproval && !hasLabel) return LabelAction.ADD;
+  if (!hasCodeownerApproval && hasLabel) return LabelAction.REMOVE;
+
+  console.log(`Label already ${hasLabel ? 'present' : 'absent'}, no change needed`);
+  return LabelAction.NONE;
+}
+
+module.exports = {
+  globToRegex,
+  parseCodeowners,
+  fetchCodeowners,
+  loadCodeowners,
+  classifyOwners,
+  getEffectiveOwners,
+  LabelAction,
+  determineLabelAction
+};

.github/scripts/detect-tags.js

@@ -0,0 +1,66 @@
+/**
+ * Shared tag detection from changed file paths.
+ * Used by pr-title-check and auto-label-pr workflows.
+ */
+
+const COMPONENT_REGEX = /^esphome\/components\/([^\/]+)\//;
+
+/**
+ * Detect component names from changed files.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {Set<string>} Set of component names
+ */
+function detectComponents(changedFiles) {
+  const components = new Set();
+  for (const file of changedFiles) {
+    const match = file.match(COMPONENT_REGEX);
+    if (match) {
+      components.add(match[1]);
+    }
+  }
+  return components;
+}
+
+/**
+ * Detect if core files were changed.
+ * Core files are in esphome/core/ or top-level esphome/ directory.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasCoreChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('esphome/core/') ||
+    (file.startsWith('esphome/') && file.split('/').length === 2)
+  );
+}
+
+/**
+ * Detect if dashboard files were changed.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasDashboardChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('esphome/dashboard/') ||
+    file.startsWith('esphome/components/dashboard_import/')
+  );
+}
+
+/**
+ * Detect if GitHub Actions files were changed.
+ * @param {string[]} changedFiles - List of changed file paths
+ * @returns {boolean}
+ */
+function hasGitHubActionsChanges(changedFiles) {
+  return changedFiles.some(file =>
+    file.startsWith('.github/workflows/')
+  );
+}
+
+module.exports = {
+  COMPONENT_REGEX,
+  detectComponents,
+  hasCoreChanges,
+  hasDashboardChanges,
+  hasGitHubActionsChanges,
+};

.github/workflows/auto-label-pr.yml

@@ -6,12 +6,14 @@ on:
   pull_request_target:
     types: [labeled, opened, reopened, synchronize, edited]
 
+# All PR/label/review writes are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  pull-requests: write
-  contents: read
+  contents: read  # actions/checkout reads the workflow source
 
 env:
   SMALL_PR_THRESHOLD: 30
+  MEDIUM_PR_THRESHOLD: 100
   MAX_LABELS: 15
   TOO_BIG_THRESHOLD: 1000
   COMPONENT_LABEL_THRESHOLD: 10
@@ -19,650 +21,26 @@ env:
 jobs:
   label:
     runs-on: ubuntu-latest
-    if: github.event.action != 'labeled' || github.event.sender.type != 'Bot'
+    if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
+          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
+          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
+          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
 
       - name: Auto Label PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            const fs = require('fs');
-
-            // Constants
-            const SMALL_PR_THRESHOLD = parseInt('${{ env.SMALL_PR_THRESHOLD }}');
-            const MAX_LABELS = parseInt('${{ env.MAX_LABELS }}');
-            const TOO_BIG_THRESHOLD = parseInt('${{ env.TOO_BIG_THRESHOLD }}');
-            const COMPONENT_LABEL_THRESHOLD = parseInt('${{ env.COMPONENT_LABEL_THRESHOLD }}');
-            const BOT_COMMENT_MARKER = '<!-- auto-label-pr-bot -->';
-            const CODEOWNERS_MARKER = '<!-- codeowners-request -->';
-            const TOO_BIG_MARKER = '<!-- too-big-request -->';
-
-            const MANAGED_LABELS = [
-              'new-component',
-              'new-platform',
-              'new-target-platform',
-              'merging-to-release',
-              'merging-to-beta',
-              'chained-pr',
-              'core',
-              'small-pr',
-              'dashboard',
-              'github-actions',
-              'by-code-owner',
-              'has-tests',
-              'needs-tests',
-              'needs-docs',
-              'needs-codeowners',
-              'too-big',
-              'labeller-recheck',
-              'bugfix',
-              'new-feature',
-              'breaking-change',
-              'developer-breaking-change',
-              'code-quality'
-            ];
-
-            const DOCS_PR_PATTERNS = [
-              /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
-              /esphome\/esphome-docs#\d+/
-            ];
-
-            // Global state
-            const { owner, repo } = context.repo;
-            const pr_number = context.issue.number;
-
-            // Get current labels and PR data
-            const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
-              owner,
-              repo,
-              issue_number: pr_number
-            });
-            const currentLabels = currentLabelsData.map(label => label.name);
-            const managedLabels = currentLabels.filter(label =>
-              label.startsWith('component: ') || MANAGED_LABELS.includes(label)
-            );
-
-            // Check for mega-PR early - if present, skip most automatic labeling
-            const isMegaPR = currentLabels.includes('mega-pr');
-
-            // Get all PR files with automatic pagination
-            const prFiles = await github.paginate(
-              github.rest.pulls.listFiles,
-              {
-                owner,
-                repo,
-                pull_number: pr_number
-              }
-            );
-
-            // Calculate data from PR files
-            const changedFiles = prFiles.map(file => file.filename);
-            const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
-            const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
-            const totalChanges = totalAdditions + totalDeletions;
-
-            console.log('Current labels:', currentLabels.join(', '));
-            console.log('Changed files:', changedFiles.length);
-            console.log('Total changes:', totalChanges);
-            if (isMegaPR) {
-              console.log('Mega-PR detected - applying limited labeling logic');
-            }
-
-            // Fetch API data
-            async function fetchApiData() {
-              try {
-                const response = await fetch('https://data.esphome.io/components.json');
-                const componentsData = await response.json();
-                return {
-                  targetPlatforms: componentsData.target_platforms || [],
-                  platformComponents: componentsData.platform_components || []
-                };
-              } catch (error) {
-                console.log('Failed to fetch components data from API:', error.message);
-                return { targetPlatforms: [], platformComponents: [] };
-              }
-            }
-
-            // Strategy: Merge branch detection
-            async function detectMergeBranch() {
-              const labels = new Set();
-              const baseRef = context.payload.pull_request.base.ref;
-
-              if (baseRef === 'release') {
-                labels.add('merging-to-release');
-              } else if (baseRef === 'beta') {
-                labels.add('merging-to-beta');
-              } else if (baseRef !== 'dev') {
-                labels.add('chained-pr');
-              }
-
-              return labels;
-            }
-
-            // Strategy: Component and platform labeling
-            async function detectComponentPlatforms(apiData) {
-              const labels = new Set();
-              const componentRegex = /^esphome\/components\/([^\/]+)\//;
-              const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
-
-              for (const file of changedFiles) {
-                const componentMatch = file.match(componentRegex);
-                if (componentMatch) {
-                  labels.add(`component: ${componentMatch[1]}`);
-                }
-
-                const platformMatch = file.match(targetPlatformRegex);
-                if (platformMatch) {
-                  labels.add(`platform: ${platformMatch[1]}`);
-                }
-              }
-
-              return labels;
-            }
-
-            // Strategy: New component detection
-            async function detectNewComponents() {
-              const labels = new Set();
-              const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-              for (const file of addedFiles) {
-                const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
-                if (componentMatch) {
-                  try {
-                    const content = fs.readFileSync(file, 'utf8');
-                    if (content.includes('IS_TARGET_PLATFORM = True')) {
-                      labels.add('new-target-platform');
-                    }
-                  } catch (error) {
-                    console.log(`Failed to read content of ${file}:`, error.message);
-                  }
-                  labels.add('new-component');
-                }
-              }
-
-              return labels;
-            }
-
-            // Strategy: New platform detection
-            async function detectNewPlatforms(apiData) {
-              const labels = new Set();
-              const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-              for (const file of addedFiles) {
-                const platformFileMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/);
-                if (platformFileMatch) {
-                  const [, component, platform] = platformFileMatch;
-                  if (apiData.platformComponents.includes(platform)) {
-                    labels.add('new-platform');
-                  }
-                }
-
-                const platformDirMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/);
-                if (platformDirMatch) {
-                  const [, component, platform] = platformDirMatch;
-                  if (apiData.platformComponents.includes(platform)) {
-                    labels.add('new-platform');
-                  }
-                }
-              }
-
-              return labels;
-            }
-
-            // Strategy: Core files detection
-            async function detectCoreChanges() {
-              const labels = new Set();
-              const coreFiles = changedFiles.filter(file =>
-                file.startsWith('esphome/core/') ||
-                (file.startsWith('esphome/') && file.split('/').length === 2)
-              );
-
-              if (coreFiles.length > 0) {
-                labels.add('core');
-              }
-
-              return labels;
-            }
-
-            // Strategy: PR size detection
-            async function detectPRSize() {
-              const labels = new Set();
-
-              if (totalChanges <= SMALL_PR_THRESHOLD) {
-                labels.add('small-pr');
-                return labels;
-              }
-
-              const testAdditions = prFiles
-                .filter(file => file.filename.startsWith('tests/'))
-                .reduce((sum, file) => sum + (file.additions || 0), 0);
-              const testDeletions = prFiles
-                .filter(file => file.filename.startsWith('tests/'))
-                .reduce((sum, file) => sum + (file.deletions || 0), 0);
-
-              const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
-
-              // Don't add too-big if mega-pr label is already present
-              if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
-                labels.add('too-big');
-              }
-
-              return labels;
-            }
-
-            // Strategy: Dashboard changes
-            async function detectDashboardChanges() {
-              const labels = new Set();
-              const dashboardFiles = changedFiles.filter(file =>
-                file.startsWith('esphome/dashboard/') ||
-                file.startsWith('esphome/components/dashboard_import/')
-              );
-
-              if (dashboardFiles.length > 0) {
-                labels.add('dashboard');
-              }
-
-              return labels;
-            }
-
-            // Strategy: GitHub Actions changes
-            async function detectGitHubActionsChanges() {
-              const labels = new Set();
-              const githubActionsFiles = changedFiles.filter(file =>
-                file.startsWith('.github/workflows/')
-              );
-
-              if (githubActionsFiles.length > 0) {
-                labels.add('github-actions');
-              }
-
-              return labels;
-            }
-
-            // Strategy: Code owner detection
-            async function detectCodeOwner() {
-              const labels = new Set();
-
-              try {
-                const { data: codeownersFile } = await github.rest.repos.getContent({
-                  owner,
-                  repo,
-                  path: 'CODEOWNERS',
-                });
-
-                const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
-                const prAuthor = context.payload.pull_request.user.login;
-
-                const codeownersLines = codeownersContent.split('\n')
-                  .map(line => line.trim())
-                  .filter(line => line && !line.startsWith('#'));
-
-                const codeownersRegexes = codeownersLines.map(line => {
-                  const parts = line.split(/\s+/);
-                  const pattern = parts[0];
-                  const owners = parts.slice(1);
-
-                  let regex;
-                  if (pattern.endsWith('*')) {
-                    const dir = pattern.slice(0, -1);
-                    regex = new RegExp(`^${dir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`);
-                  } else if (pattern.includes('*')) {
-                    // First escape all regex special chars except *, then replace * with .*
-                    const regexPattern = pattern
-                      .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
-                      .replace(/\*/g, '.*');
-                    regex = new RegExp(`^${regexPattern}$`);
-                  } else {
-                    regex = new RegExp(`^${pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
-                  }
-
-                  return { regex, owners };
-                });
-
-                for (const file of changedFiles) {
-                  for (const { regex, owners } of codeownersRegexes) {
-                    if (regex.test(file) && owners.some(owner => owner === `@${prAuthor}`)) {
-                      labels.add('by-code-owner');
-                      return labels;
-                    }
-                  }
-                }
-              } catch (error) {
-                console.log('Failed to read or parse CODEOWNERS file:', error.message);
-              }
-
-              return labels;
-            }
-
-            // Strategy: Test detection
-            async function detectTests() {
-              const labels = new Set();
-              const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
-
-              if (testFiles.length > 0) {
-                labels.add('has-tests');
-              }
-
-              return labels;
-            }
-
-            // Strategy: PR Template Checkbox detection
-            async function detectPRTemplateCheckboxes() {
-              const labels = new Set();
-              const prBody = context.payload.pull_request.body || '';
-
-              console.log('Checking PR template checkboxes...');
-
-              // Check for checked checkboxes in the "Types of changes" section
-              const checkboxPatterns = [
-                { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
-                { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
-                { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
-                { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
-                { pattern: /- \[x\] Code quality improvements to existing code or addition of tests/i, label: 'code-quality' }
-              ];
-
-              for (const { pattern, label } of checkboxPatterns) {
-                if (pattern.test(prBody)) {
-                  console.log(`Found checked checkbox for: ${label}`);
-                  labels.add(label);
-                }
-              }
-
-              return labels;
-            }
-
-            // Strategy: Requirements detection
-            async function detectRequirements(allLabels) {
-              const labels = new Set();
-
-              // Check for missing tests
-              if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) && !allLabels.has('has-tests')) {
-                labels.add('needs-tests');
-              }
-
-              // Check for missing docs
-              if (allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) {
-                const prBody = context.payload.pull_request.body || '';
-                const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-                if (!hasDocsLink) {
-                  labels.add('needs-docs');
-                }
-              }
-
-              // Check for missing CODEOWNERS
-              if (allLabels.has('new-component')) {
-                const codeownersModified = prFiles.some(file =>
-                  file.filename === 'CODEOWNERS' &&
-                  (file.status === 'modified' || file.status === 'added') &&
-                  (file.additions || 0) > 0
-                );
-
-                if (!codeownersModified) {
-                  labels.add('needs-codeowners');
-                }
-              }
-
-              return labels;
-            }
-
-            // Generate review messages
-            function generateReviewMessages(finalLabels, originalLabelCount) {
-              const messages = [];
-              const prAuthor = context.payload.pull_request.user.login;
-
-              // Too big message
-              if (finalLabels.includes('too-big')) {
-                const testAdditions = prFiles
-                  .filter(file => file.filename.startsWith('tests/'))
-                  .reduce((sum, file) => sum + (file.additions || 0), 0);
-                const testDeletions = prFiles
-                  .filter(file => file.filename.startsWith('tests/'))
-                  .reduce((sum, file) => sum + (file.deletions || 0), 0);
-                const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
-
-                const tooManyLabels = originalLabelCount > MAX_LABELS;
-                const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
-
-                let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
-
-                if (tooManyLabels && tooManyChanges) {
-                  message += `This PR is too large with ${nonTestChanges} line changes (excluding tests) and affects ${originalLabelCount} different components/areas.`;
-                } else if (tooManyLabels) {
-                  message += `This PR affects ${originalLabelCount} different components/areas.`;
-                } else {
-                  message += `This PR is too large with ${nonTestChanges} line changes (excluding tests).`;
-                }
-
-                message += ` Please consider breaking it down into smaller, focused PRs to make review easier and reduce the risk of conflicts.\n\n`;
-                message += `For guidance on breaking down large PRs, see: https://developers.esphome.io/contributing/submitting-your-work/#how-to-approach-large-submissions`;
-
-                messages.push(message);
-              }
-
-              // CODEOWNERS message
-              if (finalLabels.includes('needs-codeowners')) {
-                const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
-                  `Hey there @${prAuthor},\n` +
-                  `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
-                  `This way we can notify you if a bug report for this integration is reported.\n\n` +
-                  `In \`__init__.py\` of the integration, please add:\n\n` +
-                  `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
-                  `And run \`script/build_codeowners.py\``;
-
-                messages.push(message);
-              }
-
-              return messages;
-            }
-
-            // Handle reviews
-            async function handleReviews(finalLabels, originalLabelCount) {
-              const reviewMessages = generateReviewMessages(finalLabels, originalLabelCount);
-              const hasReviewableLabels = finalLabels.some(label =>
-                ['too-big', 'needs-codeowners'].includes(label)
-              );
-
-              const { data: reviews } = await github.rest.pulls.listReviews({
-                owner,
-                repo,
-                pull_number: pr_number
-              });
-
-              const botReviews = reviews.filter(review =>
-                review.user.type === 'Bot' &&
-                review.state === 'CHANGES_REQUESTED' &&
-                review.body && review.body.includes(BOT_COMMENT_MARKER)
-              );
-
-              if (hasReviewableLabels) {
-                const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
-
-                if (botReviews.length > 0) {
-                  // Update existing review
-                  await github.rest.pulls.updateReview({
-                    owner,
-                    repo,
-                    pull_number: pr_number,
-                    review_id: botReviews[0].id,
-                    body: reviewBody
-                  });
-                  console.log('Updated existing bot review');
-                } else {
-                  // Create new review
-                  await github.rest.pulls.createReview({
-                    owner,
-                    repo,
-                    pull_number: pr_number,
-                    body: reviewBody,
-                    event: 'REQUEST_CHANGES'
-                  });
-                  console.log('Created new bot review');
-                }
-              } else if (botReviews.length > 0) {
-                // Dismiss existing reviews
-                for (const review of botReviews) {
-                  try {
-                    await github.rest.pulls.dismissReview({
-                      owner,
-                      repo,
-                      pull_number: pr_number,
-                      review_id: review.id,
-                      message: 'Review dismissed: All requirements have been met'
-                    });
-                    console.log(`Dismissed bot review ${review.id}`);
-                  } catch (error) {
-                    console.log(`Failed to dismiss review ${review.id}:`, error.message);
-                  }
-                }
-              }
-            }
-
-            // Main execution
-            const apiData = await fetchApiData();
-            const baseRef = context.payload.pull_request.base.ref;
-
-            // Early exit for release and beta branches only
-            if (baseRef === 'release' || baseRef === 'beta') {
-              const branchLabels = await detectMergeBranch();
-              const finalLabels = Array.from(branchLabels);
-
-              console.log('Computed labels (merge branch only):', finalLabels.join(', '));
-
-              // Apply labels
-              if (finalLabels.length > 0) {
-                await github.rest.issues.addLabels({
-                  owner,
-                  repo,
-                  issue_number: pr_number,
-                  labels: finalLabels
-                });
-              }
-
-              // Remove old managed labels
-              const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
-              for (const label of labelsToRemove) {
-                try {
-                  await github.rest.issues.removeLabel({
-                    owner,
-                    repo,
-                    issue_number: pr_number,
-                    name: label
-                  });
-                } catch (error) {
-                  console.log(`Failed to remove label ${label}:`, error.message);
-                }
-              }
-
-              return;
-            }
-
-            // Run all strategies
-            const [
-              branchLabels,
-              componentLabels,
-              newComponentLabels,
-              newPlatformLabels,
-              coreLabels,
-              sizeLabels,
-              dashboardLabels,
-              actionsLabels,
-              codeOwnerLabels,
-              testLabels,
-              checkboxLabels
-            ] = await Promise.all([
-              detectMergeBranch(),
-              detectComponentPlatforms(apiData),
-              detectNewComponents(),
-              detectNewPlatforms(apiData),
-              detectCoreChanges(),
-              detectPRSize(),
-              detectDashboardChanges(),
-              detectGitHubActionsChanges(),
-              detectCodeOwner(),
-              detectTests(),
-              detectPRTemplateCheckboxes()
-            ]);
-
-            // Combine all labels
-            const allLabels = new Set([
-              ...branchLabels,
-              ...componentLabels,
-              ...newComponentLabels,
-              ...newPlatformLabels,
-              ...coreLabels,
-              ...sizeLabels,
-              ...dashboardLabels,
-              ...actionsLabels,
-              ...codeOwnerLabels,
-              ...testLabels,
-              ...checkboxLabels
-            ]);
-
-            // Detect requirements based on all other labels
-            const requirementLabels = await detectRequirements(allLabels);
-            for (const label of requirementLabels) {
-              allLabels.add(label);
-            }
-
-            let finalLabels = Array.from(allLabels);
-
-            // For mega-PRs, exclude component labels if there are too many
-            if (isMegaPR) {
-              const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
-              if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
-                finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
-                console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
-              }
-            }
-
-            // Handle too many labels (only for non-mega PRs)
-            const tooManyLabels = finalLabels.length > MAX_LABELS;
-            const originalLabelCount = finalLabels.length;
-
-            if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
-              finalLabels = ['too-big'];
-            }
-
-            console.log('Computed labels:', finalLabels.join(', '));
-
-            // Handle reviews
-            await handleReviews(finalLabels, originalLabelCount);
-
-            // Apply labels
-            if (finalLabels.length > 0) {
-              console.log(`Adding labels: ${finalLabels.join(', ')}`);
-              await github.rest.issues.addLabels({
-                owner,
-                repo,
-                issue_number: pr_number,
-                labels: finalLabels
-              });
-            }
-
-            // Remove old managed labels
-            const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
-            for (const label of labelsToRemove) {
-              console.log(`Removing label: ${label}`);
-              try {
-                await github.rest.issues.removeLabel({
-                  owner,
-                  repo,
-                  issue_number: pr_number,
-                  name: label
-                });
-              } catch (error) {
-                console.log(`Failed to remove label ${label}:`, error.message);
-              }
-            }
+            const script = require('./.github/scripts/auto-label-pr/index.js');
+            await script({ github, context });

.github/workflows/ci-api-proto.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-api-proto.yml"
 
 permissions:
-  contents: read
-  pull-requests: write
+  contents: read        # actions/checkout for the PR head
+  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale
 
 jobs:
   check:
@@ -21,11 +21,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
+      - name: Set up uv
+        # ``--system`` (below) installs into the setup-python interpreter;
+        # no venv is created or restored by this workflow.
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
 
       - name: Install apt dependencies
         run: |
@@ -34,7 +44,7 @@ jobs:
           sudo apt install -y protobuf-compiler
           protoc --version
       - name: Install python dependencies
-        run: pip install aioesphomeapi -c requirements.txt -r requirements_dev.txt
+        run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt
       - name: Generate files
         run: script/api_protobuf/api_protobuf.py
       - name: Check for changes
@@ -47,7 +57,7 @@ jobs:
           fi
       - if: failure()
         name: Review PR
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -62,7 +72,7 @@ jobs:
         run: git diff
       - if: failure()
         name: Archive artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: generated-proto-files
           path: |
@@ -70,7 +80,7 @@ jobs:
             esphome/components/api/api_pb2_service.*
       - if: success()
         name: Dismiss review
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({

.github/workflows/ci-clang-tidy-hash.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-clang-tidy-hash.yml"
 
 permissions:
-  contents: read
-  pull-requests: write
+  contents: read        # actions/checkout for the PR head
+  pull-requests: write  # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date
 
 jobs:
   verify-hash:
@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
 
@@ -40,9 +40,9 @@ jobs:
           echo "You have modified clang-tidy configuration but have not updated the hash." | tee -a $GITHUB_STEP_SUMMARY
           echo "Please run 'script/clang_tidy_hash.py --update' and commit the changes." | tee -a $GITHUB_STEP_SUMMARY
 
-      - if: failure()
+      - if: failure() && github.event.pull_request.head.repo.full_name == github.repository
         name: Request changes
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -53,9 +53,9 @@ jobs:
               body: 'You have modified clang-tidy configuration but have not updated the hash.\nPlease run `script/clang_tidy_hash.py --update` and commit the changes.'
             })
 
-      - if: success()
+      - if: success() && github.event.pull_request.head.repo.full_name == github.repository
         name: Dismiss review
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({

.github/workflows/ci-docker.yml

@@ -22,8 +22,7 @@ on:
       - "script/platformio_install_deps.py"
 
 permissions:
-  contents: read
-  packages: read
+  contents: read  # actions/checkout only; the build does not push images
 
 concurrency:
   # yamllint disable-line rule:line-length
@@ -43,13 +42,13 @@ jobs:
           - "docker"
           # - "lint"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Set TAG
         run: |

.github/workflows/ci-memory-impact-comment.yml

@@ -7,9 +7,9 @@ on:
     types: [completed]
 
 permissions:
-  contents: read
-  pull-requests: write
-  actions: read
+  contents: read        # actions/checkout of the base repo at the PR's target branch
+  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
+  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
 
 jobs:
   memory-impact-comment:
@@ -49,7 +49,7 @@ jobs:
 
       - name: Check out code from base repository
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Always check out from the base repository (esphome/esphome), never from forks
           # Use the PR's target branch to ensure we run trusted code from the main repo

.github/workflows/ci.yml

@@ -6,18 +6,10 @@ on:
     branches: [dev, beta, release]
 
   pull_request:
-    paths:
-      - "**"
-      - "!.github/workflows/*.yml"
-      - "!.github/actions/build-image/*"
-      - ".github/workflows/ci.yml"
-      - "!.yamllint"
-      - "!.github/dependabot.yml"
-      - "!docker/**"
   merge_group:
 
 permissions:
-  contents: read
+  contents: read  # actions/checkout for all jobs; individual jobs add their own scopes when they need to write
 
 env:
   DEFAULT_PYTHON: "3.11"
@@ -36,30 +28,42 @@ jobs:
       cache-key: ${{ steps.cache-key.outputs.key }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Generate cache-key
         id: cache-key
-        run: echo key="${{ hashFiles('requirements.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
+        run: echo key="${{ hashFiles('requirements.txt', 'requirements_dev.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
         id: python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
       - name: Restore Python virtual environment
         id: cache-venv
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: venv
           # yamllint disable-line rule:line-length
           key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ steps.cache-key.outputs.key }}
+      - name: Set up uv
+        # Only needed on cache miss to populate the venv. ``uv pip install``
+        # detects the activated venv via ``VIRTUAL_ENV`` so downstream jobs
+        # that ``. venv/bin/activate`` see an identical layout.
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
       - name: Create Python virtual environment
         if: steps.cache-venv.outputs.cache-hit != 'true'
         run: |
           python -m venv venv
           . venv/bin/activate
           python --version
-          pip install -r requirements.txt -r requirements_test.txt pre-commit
-          pip install -e .
+          uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt pre-commit
+          uv pip install -e .
 
   pylint:
     name: Check pylint
@@ -70,7 +74,7 @@ jobs:
     if: needs.determine-jobs.outputs.python-linters == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -89,9 +93,11 @@ jobs:
     runs-on: ubuntu-24.04
     needs:
       - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -106,6 +112,86 @@ jobs:
           script/build_codeowners.py --check
           script/build_language_schema.py --check
           script/generate-esp32-boards.py --check
+          script/generate-rp2040-boards.py --check
+
+  import-time:
+    name: Check import esphome.__main__ time
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.import-time == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Check import time against budget and write waterfall HAR
+        run: |
+          . venv/bin/activate
+          script/check_import_time.py --check --har importtime.har
+      - name: Upload waterfall HAR
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: import-time-waterfall
+          path: importtime.har
+          if-no-files-found: ignore
+          retention-days: 14
+
+  device-builder:
+    name: Test downstream esphome/device-builder
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.device-builder == 'true'
+    steps:
+      - name: Check out esphome (this PR)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: esphome
+      - name: Check out esphome/device-builder
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: esphome/device-builder
+          ref: main
+          path: device-builder
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.13"
+      - name: Set up uv
+        # Mirrors the install shape device-builder's own CI uses
+        # (esphome/device-builder#192): uv replaces pip for the
+        # install step (order-of-magnitude faster on cold boots,
+        # with its own wheel cache). actions/setup-python still
+        # provides the interpreter.
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
+      - name: Install device-builder + esphome from PR
+        # Install device-builder with its esphome + test extras
+        # first so its pinned versions of pytest/etc. land, then
+        # overlay the PR's esphome so the downstream tests run
+        # against this PR's Python code. ``--system`` installs into
+        # the runner's Python instead of a venv.
+        run: |
+          uv pip install --system -e './device-builder[esphome,test]'
+          uv pip install --system -e ./esphome
+      - name: Run device-builder pytest
+        # ``-n auto`` runs under pytest-xdist (matches device-builder's
+        # own CI). No ``--cov`` here -- this is purely a downstream
+        # smoke check against this PR's esphome code.
+        working-directory: device-builder
+        run: pytest -q -n auto --maxfail=5 --durations=30 --no-cov --ignore=tests/benchmarks
 
   pytest:
     name: Run pytest
@@ -115,6 +201,7 @@ jobs:
         python-version:
           - "3.11"
           - "3.13"
+          - "3.14"
         os:
           - ubuntu-latest
           - macOS-latest
@@ -130,9 +217,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     needs:
       - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         id: restore-python
         uses: ./.github/actions/restore-python
@@ -145,19 +234,19 @@ jobs:
         if: matrix.os == 'windows-latest'
         run: |
           . ./venv/Scripts/activate.ps1
-          pytest -vv --cov-report=xml --tb=native -n auto tests --ignore=tests/integration/
+          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
       - name: Run pytest
         if: matrix.os == 'ubuntu-latest' || matrix.os == 'macOS-latest'
         run: |
           . venv/bin/activate
-          pytest -vv --cov-report=xml --tb=native -n auto tests --ignore=tests/integration/
+          pytest -vv --cov-report=xml --tb=native --durations=30 -n auto tests --ignore=tests/integration/
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Save Python virtual environment cache
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: venv
           key: ${{ runner.os }}-${{ steps.restore-python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
@@ -168,10 +257,17 @@ jobs:
     needs:
       - common
     outputs:
+      core-ci: ${{ steps.determine.outputs.core-ci }}
       integration-tests: ${{ steps.determine.outputs.integration-tests }}
+      integration-test-buckets: ${{ steps.determine.outputs.integration-test-buckets }}
       clang-tidy: ${{ steps.determine.outputs.clang-tidy }}
       clang-tidy-mode: ${{ steps.determine.outputs.clang-tidy-mode }}
+      clang-tidy-full-scan: ${{ steps.determine.outputs.clang-tidy-full-scan }}
       python-linters: ${{ steps.determine.outputs.python-linters }}
+      import-time: ${{ steps.determine.outputs.import-time }}
+      device-builder: ${{ steps.determine.outputs.device-builder }}
+      native-idf: ${{ steps.determine.outputs.native-idf }}
+      native-idf-components: ${{ steps.determine.outputs.native-idf-components }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -181,9 +277,11 @@ jobs:
       cpp-unit-tests-run-all: ${{ steps.determine.outputs.cpp-unit-tests-run-all }}
       cpp-unit-tests-components: ${{ steps.determine.outputs.cpp-unit-tests-components }}
       component-test-batches: ${{ steps.determine.outputs.component-test-batches }}
+      validate-only-components: ${{ steps.determine.outputs.validate-only-components }}
+      benchmarks: ${{ steps.determine.outputs.benchmarks }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Fetch enough history to find the merge base
           fetch-depth: 2
@@ -193,7 +291,7 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
       - name: Restore components graph cache
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
@@ -203,15 +301,27 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           . venv/bin/activate
-          output=$(python script/determine-jobs.py)
+          EXTRA_ARGS=""
+          if [[ "${{ contains(github.event.pull_request.labels.*.name, 'ci-run-all') }}" == "true" ]]; then
+            EXTRA_ARGS="--force-all"
+            echo "::notice::ci-run-all label detected -- forcing every CI job to run"
+          fi
+          output=$(python script/determine-jobs.py $EXTRA_ARGS)
           echo "Test determination output:"
           echo "$output" | jq
 
           # Extract individual fields
+          echo "core-ci=$(echo "$output" | jq -r '.core_ci')" >> $GITHUB_OUTPUT
           echo "integration-tests=$(echo "$output" | jq -r '.integration_tests')" >> $GITHUB_OUTPUT
+          echo "integration-test-buckets=$(echo "$output" | jq -c '.integration_test_buckets')" >> $GITHUB_OUTPUT
           echo "clang-tidy=$(echo "$output" | jq -r '.clang_tidy')" >> $GITHUB_OUTPUT
           echo "clang-tidy-mode=$(echo "$output" | jq -r '.clang_tidy_mode')" >> $GITHUB_OUTPUT
+          echo "clang-tidy-full-scan=$(echo "$output" | jq -r '.clang_tidy_full_scan')" >> $GITHUB_OUTPUT
           echo "python-linters=$(echo "$output" | jq -r '.python_linters')" >> $GITHUB_OUTPUT
+          echo "import-time=$(echo "$output" | jq -r '.import_time')" >> $GITHUB_OUTPUT
+          echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
+          echo "native-idf=$(echo "$output" | jq -r '.native_idf')" >> $GITHUB_OUTPUT
+          echo "native-idf-components=$(echo "$output" | jq -r '.native_idf_components')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -221,48 +331,70 @@ jobs:
           echo "cpp-unit-tests-run-all=$(echo "$output" | jq -r '.cpp_unit_tests_run_all')" >> $GITHUB_OUTPUT
           echo "cpp-unit-tests-components=$(echo "$output" | jq -c '.cpp_unit_tests_components')" >> $GITHUB_OUTPUT
           echo "component-test-batches=$(echo "$output" | jq -c '.component_test_batches')" >> $GITHUB_OUTPUT
+          echo "validate-only-components=$(echo "$output" | jq -c '.validate_only_components')" >> $GITHUB_OUTPUT
+          echo "benchmarks=$(echo "$output" | jq -r '.benchmarks')" >> $GITHUB_OUTPUT
       - name: Save components graph cache
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
   integration-tests:
-    name: Run integration tests
+    name: Run integration tests (${{ matrix.bucket.name }})
     runs-on: ubuntu-latest
     needs:
       - common
       - determine-jobs
     if: needs.determine-jobs.outputs.integration-tests == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python 3.13
         id: python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
       - name: Restore Python virtual environment
         id: cache-venv
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: venv
           key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
+      - name: Set up uv
+        # Only needed on cache miss to populate the venv.
+        if: steps.cache-venv.outputs.cache-hit != 'true'
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
       - name: Create Python virtual environment
         if: steps.cache-venv.outputs.cache-hit != 'true'
         run: |
           python -m venv venv
           . venv/bin/activate
           python --version
-          pip install -r requirements.txt -r requirements_test.txt
-          pip install -e .
+          uv pip install -r requirements.txt -r requirements_test.txt
+          uv pip install -e .
       - name: Register matcher
         run: echo "::add-matcher::.github/workflows/matchers/pytest.json"
       - name: Run integration tests
+        env:
+          # JSON array of test paths; parsed into a bash array below to avoid
+          # shell word-splitting / glob hazards.
+          BUCKET_TESTS: ${{ toJson(matrix.bucket.tests) }}
         run: |
           . venv/bin/activate
-          pytest -vv --no-cov --tb=native -n auto tests/integration/
+          mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
+          echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
+          pytest -vv --no-cov --tb=native --durations=30 -n auto "${test_files[@]}"
 
   cpp-unit-tests:
     name: Run C++ unit tests
@@ -273,7 +405,7 @@ jobs:
     if: github.event_name == 'pull_request' && (needs.determine-jobs.outputs.cpp-unit-tests-run-all == 'true' || needs.determine-jobs.outputs.cpp-unit-tests-components != '[]')
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Restore Python
         uses: ./.github/actions/restore-python
@@ -291,6 +423,43 @@ jobs:
             script/cpp_unit_test.py $ARGS
           fi
 
+  benchmarks:
+    name: Run CodSpeed benchmarks
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: >-
+      (github.event_name == 'push' && github.ref_name == 'dev') ||
+      (github.event_name == 'pull_request' && needs.determine-jobs.outputs.benchmarks == 'true')
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+
+      - name: Build benchmarks
+        id: build
+        run: |
+          . venv/bin/activate
+          export BENCHMARK_LIB_CONFIG=$(python script/setup_codspeed_lib.py)
+          # --build-only prints BUILD_BINARY=<path> to stdout
+          BINARY=$(script/cpp_benchmark.py --all --build-only | grep '^BUILD_BINARY=' | tail -1 | cut -d= -f2-)
+          echo "binary=$BINARY" >> $GITHUB_OUTPUT
+
+      - name: Run CodSpeed benchmarks
+        uses: CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd # v4.15.1
+        with:
+          run: |
+            . venv/bin/activate
+            ${{ steps.build.outputs.binary }}
+            pytest tests/benchmarks/python/ --codspeed --no-cov
+          mode: simulation
+
   clang-tidy-single:
     name: ${{ matrix.name }}
     runs-on: ubuntu-24.04
@@ -321,7 +490,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -334,14 +503,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
@@ -362,7 +531,13 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          if python script/clang_tidy_hash.py --check; then
+          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
+          # OR the ci-run-all label forced --force-all. Independent of the
+          # hash check, both must produce a full scan in the job itself.
+          if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
+            echo "full_scan=true" >> $GITHUB_OUTPUT
+            echo "reason=determine_jobs" >> $GITHUB_OUTPUT
+          elif python script/clang_tidy_hash.py --check; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
@@ -374,7 +549,7 @@ jobs:
         run: |
           . venv/bin/activate
           if [ "${{ steps.check_full_scan.outputs.full_scan }}" = "true" ]; then
-            echo "Running FULL clang-tidy scan (hash changed)"
+            echo "Running FULL clang-tidy scan (reason: ${{ steps.check_full_scan.outputs.reason }})"
             script/clang-tidy --all-headers --fix ${{ matrix.options }} ${{ matrix.ignore_errors && '|| true' || '' }}
           else
             echo "Running clang-tidy on changed files only"
@@ -400,7 +575,7 @@ jobs:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -413,14 +588,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
@@ -434,7 +609,13 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          if python script/clang_tidy_hash.py --check; then
+          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
+          # OR the ci-run-all label forced --force-all. Independent of the
+          # hash check, both must produce a full scan in the job itself.
+          if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
+            echo "full_scan=true" >> $GITHUB_OUTPUT
+            echo "reason=determine_jobs" >> $GITHUB_OUTPUT
+          elif python script/clang_tidy_hash.py --check; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
@@ -446,7 +627,7 @@ jobs:
         run: |
           . venv/bin/activate
           if [ "${{ steps.check_full_scan.outputs.full_scan }}" = "true" ]; then
-            echo "Running FULL clang-tidy scan (hash changed)"
+            echo "Running FULL clang-tidy scan (reason: ${{ steps.check_full_scan.outputs.reason }})"
             script/clang-tidy --all-headers --fix --environment esp32-arduino-tidy
           else
             echo "Running clang-tidy on changed files only"
@@ -489,7 +670,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Need history for HEAD~1 to work for checking changed files
           fetch-depth: 2
@@ -502,14 +683,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
@@ -523,7 +704,13 @@ jobs:
         id: check_full_scan
         run: |
           . venv/bin/activate
-          if python script/clang_tidy_hash.py --check; then
+          # determine-jobs.clang-tidy-full-scan is true when core C++ changed
+          # OR the ci-run-all label forced --force-all. Independent of the
+          # hash check, both must produce a full scan in the job itself.
+          if [ "${{ needs.determine-jobs.outputs.clang-tidy-full-scan }}" = "true" ]; then
+            echo "full_scan=true" >> $GITHUB_OUTPUT
+            echo "reason=determine_jobs" >> $GITHUB_OUTPUT
+          elif python script/clang_tidy_hash.py --check; then
             echo "full_scan=true" >> $GITHUB_OUTPUT
             echo "reason=hash_changed" >> $GITHUB_OUTPUT
           else
@@ -535,7 +722,7 @@ jobs:
         run: |
           . venv/bin/activate
           if [ "${{ steps.check_full_scan.outputs.full_scan }}" = "true" ]; then
-            echo "Running FULL clang-tidy scan (hash changed)"
+            echo "Running FULL clang-tidy scan (reason: ${{ steps.check_full_scan.outputs.reason }})"
             script/clang-tidy --all-headers --fix ${{ matrix.options }}
           else
             echo "Running clang-tidy on changed files only"
@@ -577,7 +764,7 @@ jobs:
           version: 1.0
 
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -646,23 +833,145 @@ jobs:
           echo "Config validation passed! Starting compilation..."
           echo ""
 
+          # Compute the compile-stage component list. Components whose only
+          # changes are validate.*.yaml files are config-only -- their source
+          # and test fixtures didn't move, so rebuilding firmware adds no
+          # signal. Subtract them from this batch before invoking compile.
+          validate_only_json='${{ needs.determine-jobs.outputs.validate-only-components }}'
+          if [ -z "$validate_only_json" ]; then
+            validate_only_json='[]'
+          fi
+          if ! validate_only_csv=$(echo "$validate_only_json" | jq -r 'join(",")'); then
+            echo "::error::Failed to render validate-only-components as CSV from: $validate_only_json"
+            exit 1
+          fi
+          if [ -z "$validate_only_csv" ]; then
+            compile_csv="$components_csv"
+          else
+            components_sorted=$(echo "$components_csv" | tr ',' '\n' | sort -u)
+            validate_sorted=$(echo "$validate_only_csv" | tr ',' '\n' | sort -u)
+            if ! diff_out=$(comm -23 <(echo "$components_sorted") <(echo "$validate_sorted")); then
+              echo "::error::Failed to compute compile component subset."
+              exit 1
+            fi
+            compile_csv=$(echo "$diff_out" | paste -sd ',' -)
+            skipped=$(comm -12 <(echo "$components_sorted") <(echo "$validate_sorted") | paste -sd ',' -)
+            if [ -n "$skipped" ]; then
+              echo "Validate-only components in this batch (skipping compile): $skipped"
+            fi
+          fi
+
           # Show disk space before compilation
           echo "Disk space before compilation:"
           df -h
           echo ""
 
-          # Run compilation with grouping and isolation
-          python3 script/test_build_components.py -e compile -c "$components_csv" -f --isolate "$directly_changed_csv"
+          if [ -n "$compile_csv" ]; then
+            # Run compilation with grouping and isolation
+            python3 script/test_build_components.py -e compile -c "$compile_csv" -f --isolate "$directly_changed_csv"
+          else
+            echo "All components in this batch are validate-only -- skipping compile stage."
+          fi
+
+  test-native-idf:
+    name: Test components with native ESP-IDF
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: github.event_name == 'pull_request' && needs.determine-jobs.outputs.native-idf == 'true'
+    env:
+      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
+      # Comma-joined subset of the native-IDF representative component list,
+      # computed by script/determine-jobs.py (native_idf_components_to_test).
+      # Single source of truth -- the full list lives in
+      # script/determine-jobs.py::NATIVE_IDF_TEST_COMPONENTS.
+      TEST_COMPONENTS: ${{ needs.determine-jobs.outputs.native-idf-components }}
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+
+      - name: Cache ESPHome
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.esphome-idf
+          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
+
+      - name: Run native ESP-IDF compile test
+        run: |
+          . venv/bin/activate
+
+          # Check if /mnt has more free space than / before bind mounting
+          # Extract available space in KB for comparison
+          root_avail=$(df -k / | awk 'NR==2 {print $4}')
+          mnt_avail=$(df -k /mnt 2>/dev/null | awk 'NR==2 {print $4}')
+
+          echo "Available space: / has ${root_avail}KB, /mnt has ${mnt_avail}KB"
+
+          # Only use /mnt if it has more space than /
+          if [ -n "$mnt_avail" ] && [ "$mnt_avail" -gt "$root_avail" ]; then
+            echo "Using /mnt for build files (more space available)"
+            # Bind mount PlatformIO directory to /mnt (tools, packages, build cache all go there)
+            sudo mkdir -p /mnt/esphome-idf
+            sudo chown $USER:$USER /mnt/esphome-idf
+            mkdir -p ~/.esphome-idf
+            sudo mount --bind /mnt/esphome-idf ~/.esphome-idf
+
+            # Bind mount test build directory to /mnt
+            sudo mkdir -p /mnt/test_build_components_build
+            sudo chown $USER:$USER /mnt/test_build_components_build
+            mkdir -p tests/test_build_components/build
+            sudo mount --bind /mnt/test_build_components_build tests/test_build_components/build
+          else
+            echo "Using / for build files (more space available than /mnt or /mnt unavailable)"
+          fi
+
+          echo "Testing components: $TEST_COMPONENTS"
+          echo ""
+
+          # Show disk space before validation (after bind mounts setup)
+          echo "Disk space before config validation:"
+          df -h
+          echo ""
+
+          # Run config validation (auto-grouped by test_build_components.py)
+          python3 script/test_build_components.py -e config -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
+
+          echo ""
+          echo "Config validation passed! Starting compilation..."
+          echo ""
+
+          # Show disk space before compilation
+          echo "Disk space before compilation:"
+          df -h
+          echo ""
+
+          # Run compilation (auto-grouped by test_build_components.py)
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
+
+      - name: Save ESPHome cache
+        if: github.ref == 'refs/heads/dev'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.esphome-idf
+          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
 
   pre-commit-ci-lite:
     name: pre-commit.ci lite
     runs-on: ubuntu-latest
     needs:
       - common
-    if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release')
+      - determine-jobs
+    if: github.event_name == 'pull_request' && !startsWith(github.base_ref, 'beta') && !startsWith(github.base_ref, 'release') && needs.determine-jobs.outputs.core-ci == 'true'
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
@@ -670,7 +979,7 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
       - uses: esphome/pre-commit-action@43cd1109c09c544d97196f7730ee5b2e0cc6d81e # v3.0.1 fork with pinned actions/cache
         env:
-          SKIP: pylint,clang-tidy-hash
+          SKIP: pylint,clang-tidy-hash,ci-custom
       - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
         if: always()
 
@@ -685,10 +994,10 @@ jobs:
       ram_usage: ${{ steps.extract.outputs.ram_usage }}
       flash_usage: ${{ steps.extract.outputs.flash_usage }}
       cache_hit: ${{ steps.cache-memory-analysis.outputs.cache-hit }}
-      skip: ${{ steps.check-script.outputs.skip }}
+      skip: ${{ steps.check-script.outputs.skip || steps.check-tests.outputs.skip }}
     steps:
       - name: Check out target branch
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.base_ref }}
 
@@ -704,10 +1013,39 @@ jobs:
             echo "::warning::ci_memory_impact_extract.py not found on target branch, skipping memory impact analysis"
           fi
 
-      # All remaining steps only run if script exists
+      # Check if test files exist on the target branch for the requested
+      # components and platform. When a PR adds new test files for a platform,
+      # the target branch won't have them yet, so skip instead of failing.
+      # This check must be done here (not in determine-jobs.py) because
+      # determine-jobs runs on the PR branch and cannot see what the target
+      # branch has.
+      - name: Check for test files on target branch
+        id: check-tests
+        if: steps.check-script.outputs.skip != 'true'
+        run: |
+          components='${{ toJSON(fromJSON(needs.determine-jobs.outputs.memory_impact).components) }}'
+          platform="${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}"
+          found=false
+          for component in $(echo "$components" | jq -r '.[]'); do
+            # Check for test files matching the platform (test.platform.yaml or test-*.platform.yaml)
+            for f in tests/components/${component}/test*.${platform}.yaml; do
+              if [ -f "$f" ]; then
+                found=true
+                break 2
+              fi
+            done
+          done
+          if [ "$found" = false ]; then
+            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "::warning::No test files found on target branch for platform ${platform}, skipping memory impact analysis"
+          else
+            echo "skip=false" >> $GITHUB_OUTPUT
+          fi
+
+      # All remaining steps only run if script and tests exist
       - name: Generate cache key
         id: cache-key
-        if: steps.check-script.outputs.skip != 'true'
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true'
         run: |
           # Get the commit SHA of the target branch
           target_sha=$(git rev-parse HEAD)
@@ -734,14 +1072,14 @@ jobs:
 
       - name: Restore cached memory analysis
         id: cache-memory-analysis
-        if: steps.check-script.outputs.skip != 'true'
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true'
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: memory-analysis-target.json
           key: ${{ steps.cache-key.outputs.cache-key }}
 
       - name: Cache status
-        if: steps.check-script.outputs.skip != 'true'
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true'
         run: |
           if [ "${{ steps.cache-memory-analysis.outputs.cache-hit }}" == "true" ]; then
             echo "✓ Cache hit! Using cached memory analysis results."
@@ -751,21 +1089,21 @@ jobs:
           fi
 
       - name: Restore Python
-        if: steps.check-script.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
         uses: ./.github/actions/restore-python
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
 
       - name: Cache platformio
-        if: steps.check-script.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
 
       - name: Build, compile, and analyze memory
-        if: steps.check-script.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
         id: build
         run: |
           . venv/bin/activate
@@ -786,7 +1124,8 @@ jobs:
           python script/test_build_components.py \
             -e compile \
             -c "$component_list" \
-            -t "$platform" 2>&1 | \
+            -t "$platform" \
+            --base-only 2>&1 | \
             tee /dev/stderr | \
             python script/ci_memory_impact_extract.py \
               --output-env \
@@ -799,15 +1138,15 @@ jobs:
             --platform "$platform"
 
       - name: Save memory analysis to cache
-        if: steps.check-script.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true' && steps.build.outcome == 'success'
-        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true' && steps.build.outcome == 'success'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: memory-analysis-target.json
           key: ${{ steps.cache-key.outputs.cache-key }}
 
       - name: Extract memory usage for outputs
         id: extract
-        if: steps.check-script.outputs.skip != 'true'
+        if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true'
         run: |
           if [ -f memory-analysis-target.json ]; then
             ram=$(jq -r '.ram_bytes' memory-analysis-target.json)
@@ -821,7 +1160,7 @@ jobs:
           fi
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: memory-analysis-target
           path: memory-analysis-target.json
@@ -840,14 +1179,14 @@ jobs:
       flash_usage: ${{ steps.extract.outputs.flash_usage }}
     steps:
       - name: Check out PR branch
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
       - name: Cache platformio
-        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.platformio
           key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
@@ -872,7 +1211,8 @@ jobs:
           python script/test_build_components.py \
             -e compile \
             -c "$component_list" \
-            -t "$platform" 2>&1 | \
+            -t "$platform" \
+            --base-only 2>&1 | \
             tee /dev/stderr | \
             python script/ci_memory_impact_extract.py \
               --output-env \
@@ -885,7 +1225,7 @@ jobs:
             --platform "$platform"
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: memory-analysis-pr
           path: memory-analysis-pr.json
@@ -902,26 +1242,26 @@ jobs:
       - memory-impact-pr-branch
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && fromJSON(needs.determine-jobs.outputs.memory_impact).should_run == 'true' && needs.memory-impact-target-branch.outputs.skip != 'true'
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read        # actions/checkout to load the comment-posting script
+      pull-requests: write  # ci_memory_impact_comment.py posts/updates the memory-impact comment on the PR
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Restore Python
         uses: ./.github/actions/restore-python
         with:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
       - name: Download target analysis JSON
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: memory-analysis-target
           path: ./memory-analysis
         continue-on-error: true
       - name: Download PR analysis JSON
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: memory-analysis-pr
           path: ./memory-analysis
@@ -952,7 +1292,9 @@ jobs:
       - clang-tidy-nosplit
       - clang-tidy-split
       - determine-jobs
+      - device-builder
       - test-build-components-split
+      - test-native-idf
       - pre-commit-ci-lite
       - memory-impact-target-branch
       - memory-impact-pr-branch

.github/workflows/close-pr-from-fork-default-branch.yml

@@ -0,0 +1,72 @@
+name: Close PR From Fork Default Branch
+
+on:
+  # pull_request_target is required so we have permission to comment and close PRs from forks.
+  pull_request_target:
+    types: [opened, reopened]
+
+permissions:
+  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
+  issues: write         # issues.createComment to explain to the contributor why the PR was closed
+
+jobs:
+  close:
+    name: Close PR opened from fork's default branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
+      && github.event.pull_request.head.ref == github.event.repository.default_branch
+    steps:
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const prNumber = context.payload.pull_request.number;
+            const author = context.payload.pull_request.user.login;
+            const defaultBranch = context.payload.repository.default_branch;
+            const headRepo = context.payload.pull_request.head.repo.full_name;
+
+            const body = [
+              `Hi @${author}, thanks for opening a pull request! :tada:`,
+              ``,
+              `It looks like this PR was opened from the \`${defaultBranch}\` branch of your fork (\`${headRepo}\`), which is the same name as this repository's default branch. Working directly on \`${defaultBranch}\` in your fork causes a few problems:`,
+              ``,
+              `- Your fork's \`${defaultBranch}\` branch will permanently diverge from \`esphome/esphome:${defaultBranch}\`, making it hard to keep your fork up to date.`,
+              `- Any additional commits you push to \`${defaultBranch}\` will be added to this PR, so you can't easily work on multiple changes at once.`,
+              `- Pushing maintainer fixes to your branch is awkward, since it means committing directly to your fork's default branch.`,
+              `- It makes local collaboration painful — \`${defaultBranch}\` in a checkout becomes ambiguous between upstream and your fork, and maintainers end up with naming collisions when fetching your branch.`,
+              ``,
+              `Please re-open this as a new PR from a dedicated feature branch. The usual flow looks like:`,
+              ``,
+              `\`\`\`bash`,
+              `# Make sure your fork's ${defaultBranch} is up to date with upstream`,
+              `git remote add upstream https://github.com/${owner}/${repo}.git  # if you haven't already`,
+              `git fetch upstream`,
+              `git checkout ${defaultBranch}`,
+              `git reset --hard upstream/${defaultBranch}`,
+              `git push --force-with-lease origin ${defaultBranch}`,
+              ``,
+              `# Create a new branch for your change and cherry-pick / re-apply your commits there`,
+              `git checkout -b my-feature-branch upstream/${defaultBranch}`,
+              `# ...re-apply your changes, then:`,
+              `git push origin my-feature-branch`,
+              `\`\`\``,
+              ``,
+              `Then open a new pull request from \`my-feature-branch\` into \`${owner}/${repo}:${defaultBranch}\`.`,
+              ``,
+              `Closing this PR for now — sorry for the friction, and thanks again for contributing! :heart:`,
+            ].join('\n');
+
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body,
+            });
+
+            await github.rest.pulls.update({
+              owner,
+              repo,
+              pull_number: prNumber,
+              state: 'closed',
+            });

.github/workflows/codeowner-approved-label-update.yml

@@ -0,0 +1,81 @@
+# Adds/removes a 'code-owner-approved' label when a component-specific
+# codeowner approves (or dismisses) a PR.
+#
+# Uses pull_request_target so that fork PRs do not require workflow approval.
+# The label is reconciled on every PR update; for review events specifically,
+# this means the label is applied on the next push after a codeowner review.
+
+name: Codeowner Approved Label
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches-ignore:
+      - release
+      - beta
+
+permissions:
+  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
+  pull-requests: read  # listReviews to determine whether a codeowner has approved
+  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+
+jobs:
+  codeowner-approved:
+    name: Run
+    if: ${{ github.repository == 'esphome/esphome' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout base branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
+          sparse-checkout: |
+            .github/scripts/codeowners.js
+            CODEOWNERS
+
+      - name: Check codeowner approval and update label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        with:
+          script: |
+            const { loadCodeowners, determineLabelAction, LabelAction } = require('./.github/scripts/codeowners.js');
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const pr_number = parseInt(process.env.PR_NUMBER, 10);
+            const LABEL_NAME = 'code-owner-approved';
+
+            console.log(`Processing PR #${pr_number} for codeowner approval label`);
+
+            const codeownersPatterns = loadCodeowners();
+            const action = await determineLabelAction(
+              github, owner, repo, pr_number, codeownersPatterns, LABEL_NAME
+            );
+
+            if (action === LabelAction.NONE) {
+              console.log('No label change needed');
+              return;
+            }
+
+            try {
+              if (action === LabelAction.ADD) {
+                await github.rest.issues.addLabels({
+                  owner, repo, issue_number: pr_number, labels: [LABEL_NAME]
+                });
+                console.log(`Added '${LABEL_NAME}' label`);
+              } else if (action === LabelAction.REMOVE) {
+                await github.rest.issues.removeLabel({
+                  owner, repo, issue_number: pr_number, name: LABEL_NAME
+                });
+                console.log(`Removed '${LABEL_NAME}' label`);
+              }
+            } catch (error) {
+              if (error.status === 403) {
+                console.log(`Warning: insufficient permissions to update label (expected for fork PRs)`);
+              } else if (error.status === 404) {
+                console.log(`Label '${LABEL_NAME}' not present, nothing to remove`);
+              } else {
+                throw error;
+              }
+            }

.github/workflows/codeowner-review-request.yml

@@ -13,10 +13,14 @@ on:
   # Needs to be pull_request_target to get write permissions
   pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review]
+    branches-ignore:
+      - release
+      - beta
 
+# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  pull-requests: write
-  contents: read
+  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
 
 jobs:
   request-codeowner-reviews:
@@ -24,10 +28,28 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     steps:
-      - name: Request reviews from component codeowners
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - name: Checkout base branch
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ github.event.pull_request.base.sha }}
+
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by the github-script step below.
+          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
+          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
+
+      - name: Request reviews from component codeowners
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
+            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
+
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const pr_number = context.payload.pull_request.number;
@@ -38,12 +60,15 @@ jobs:
             const BOT_COMMENT_MARKER = '<!-- codeowner-review-request-bot -->';
 
             try {
-              // Get the list of changed files in this PR
-              const { data: files } = await github.rest.pulls.listFiles({
-                owner,
-                repo,
-                pull_number: pr_number
-              });
+              // Get the list of changed files in this PR (with pagination)
+              const files = await github.paginate(
+                github.rest.pulls.listFiles,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
 
               const changedFiles = files.map(file => file.filename);
               console.log(`Found ${changedFiles.length} changed files`);
@@ -53,32 +78,10 @@ jobs:
                 return;
               }
 
-              // Fetch CODEOWNERS file from root
-              const { data: codeownersFile } = await github.rest.repos.getContent({
-                owner,
-                repo,
-                path: 'CODEOWNERS',
-                ref: context.payload.pull_request.base.sha
-              });
-              const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
+              // Parse CODEOWNERS from the checked-out base branch
+              const codeownersPatterns = loadCodeowners();
 
-              // Parse CODEOWNERS file to extract all patterns and their owners
-              const codeownersLines = codeownersContent.split('\n')
-                .map(line => line.trim())
-                .filter(line => line && !line.startsWith('#'));
-
-              const codeownersPatterns = [];
-
-              // Convert CODEOWNERS pattern to regex (robust glob handling)
-              function globToRegex(pattern) {
-                // Escape regex special characters except for glob wildcards
-                let regexStr = pattern
-                  .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1') // escape regex chars
-                  .replace(/\*\*/g, '.*') // globstar
-                  .replace(/\*/g, '[^/]*') // single star
-                  .replace(/\?/g, '.'); // question mark
-                return new RegExp('^' + regexStr + '$');
-              }
+              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
 
               // Helper function to create comment body
               function createCommentBody(reviewersList, teamsList, matchedFileCount, isSuccessful = true) {
@@ -93,50 +96,11 @@ jobs:
                 }
               }
 
-              for (const line of codeownersLines) {
-                const parts = line.split(/\s+/);
-                if (parts.length < 2) continue;
-
-                const pattern = parts[0];
-                const owners = parts.slice(1);
-
-                // Use robust glob-to-regex conversion
-                const regex = globToRegex(pattern);
-                codeownersPatterns.push({ pattern, regex, owners });
-              }
-
-              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
-
-              // Match changed files against CODEOWNERS patterns
-              const matchedOwners = new Set();
-              const matchedTeams = new Set();
-              const fileMatches = new Map(); // Track which files matched which patterns
-
-              for (const file of changedFiles) {
-                for (const { pattern, regex, owners } of codeownersPatterns) {
-                  if (regex.test(file)) {
-                    console.log(`File '${file}' matches pattern '${pattern}' with owners: ${owners.join(', ')}`);
-
-                    if (!fileMatches.has(file)) {
-                      fileMatches.set(file, []);
-                    }
-                    fileMatches.get(file).push({ pattern, owners });
-
-                    // Add owners to the appropriate set (remove @ prefix)
-                    for (const owner of owners) {
-                      const cleanOwner = owner.startsWith('@') ? owner.slice(1) : owner;
-                      if (cleanOwner.includes('/')) {
-                        // Team mention (org/team-name)
-                        const teamName = cleanOwner.split('/')[1];
-                        matchedTeams.add(teamName);
-                      } else {
-                        // Individual user
-                        matchedOwners.add(cleanOwner);
-                      }
-                    }
-                  }
-                }
-              }
+              // Match changed files against CODEOWNERS patterns using last-match-wins semantics
+              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
+              const matchedOwners = effective.users;
+              const matchedTeams = effective.teams;
+              const matchedFileCount = effective.matchedFileCount;
 
               if (matchedOwners.size === 0 && matchedTeams.size === 0) {
                 console.log('No codeowners found for any changed files');
@@ -170,11 +134,14 @@ jobs:
               }
 
               // Check for completed reviews to avoid re-requesting users who have already reviewed
-              const { data: reviews } = await github.rest.pulls.listReviews({
-                owner,
-                repo,
-                pull_number: pr_number
-              });
+              const reviews = await github.paginate(
+                github.rest.pulls.listReviews,
+                {
+                  owner,
+                  repo,
+                  pull_number: pr_number
+                }
+              );
 
               const reviewedUsers = new Set();
               reviews.forEach(review => {
@@ -247,7 +214,7 @@ jobs:
               }
 
               const totalReviewers = reviewersList.length + teamsList.length;
-              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${fileMatches.size} matched files`);
+              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${matchedFileCount} matched files`);
 
               // Request reviews
               try {
@@ -279,7 +246,7 @@ jobs:
 
                 // Only add a comment if there are new codeowners to mention (not previously pinged)
                 if (reviewersList.length > 0 || teamsList.length > 0) {
-                  const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, true);
+                  const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, true);
 
                   await github.rest.issues.createComment({
                     owner,
@@ -297,7 +264,7 @@ jobs:
 
                   // Only try to add a comment if there are new codeowners to mention
                   if (reviewersList.length > 0 || teamsList.length > 0) {
-                    const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, false);
+                    const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, false);
 
                     try {
                       await github.rest.issues.createComment({

.github/workflows/codeql.yml

@@ -16,6 +16,9 @@ on:
   schedule:
     - cron: "30 18 * * 4"
 
+# Deny by default; the analyze job opts in to exactly what it needs.
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -26,15 +29,10 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
+      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
+      packages: read          # fetch internal or private CodeQL query packs
+      actions: read           # required by codeql-action when run from a private repo
+      contents: read          # actions/checkout to scan the repository
 
     strategy:
       fail-fast: false
@@ -54,11 +52,11 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4.31.10
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dashboard-deprecation-comment.yml

@@ -0,0 +1,119 @@
+name: Add Dashboard Deprecation Comment
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
+
+jobs:
+  dashboard-deprecation-comment:
+    name: Dashboard deprecation comment
+    runs-on: ubuntu-latest
+    # Release-bump PRs (bump-X.Y.Z -> beta, beta -> release) inevitably
+    # roll up everything merged into dev since the last cut, which can
+    # include dashboard changes that have already been reviewed once.
+    # The bot's purpose is to warn new contributors before they invest
+    # time -- that only applies to PRs entering dev.
+    if: github.event.pull_request.base.ref == 'dev'
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
+      - name: Add dashboard deprecation comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const commentMarker = "<!-- This comment was generated automatically by the dashboard-deprecation-comment workflow. -->";
+
+            const commentBody = `Thanks for opening this PR!
+
+            Heads up: the legacy ESPHome dashboard (\`esphome/dashboard/\` and \`tests/dashboard/\`) is **deprecated** and is being replaced by [ESPHome Device Builder](https://github.com/esphome/device-builder). We are not adding new features to the legacy dashboard and it will eventually be removed from this repository.
+
+            What this means for your PR:
+
+            - **New features / enhancements**: please port the change to [esphome/device-builder](https://github.com/esphome/device-builder) instead. We are unlikely to review or merge new dashboard features here.
+            - **Bug fixes**: small fixes may still be considered, but please check first whether the same issue exists in Device Builder, where the fix will have a longer life.
+            - **Security issues**: please do not file a public PR. Report privately via [GitHub security advisories](https://github.com/esphome/esphome/security/advisories/new) so we can coordinate a fix.
+
+            We appreciate the contribution and apologize for the friction; flagging this early so your time isn't spent on a change that may not land.
+
+            ---
+            (Added by the PR bot)
+
+            ${commentMarker}`;
+
+            async function getDashboardChanges(github, owner, repo, prNumber) {
+                const changedFiles = await github.paginate(
+                    github.rest.pulls.listFiles,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        pull_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return changedFiles.filter(file =>
+                    file.filename.startsWith('esphome/dashboard/') ||
+                    file.filename.startsWith('tests/dashboard/')
+                );
+            }
+
+            async function findBotComment(github, owner, repo, prNumber) {
+                const comments = await github.paginate(
+                    github.rest.issues.listComments,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        issue_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return comments.find(comment =>
+                    comment.body.includes(commentMarker) && comment.user.type === "Bot"
+                );
+            }
+
+            const prNumber = context.payload.pull_request.number;
+            const { owner, repo } = context.repo;
+
+            const dashboardChanges = await getDashboardChanges(github, owner, repo, prNumber);
+            const existingComment = await findBotComment(github, owner, repo, prNumber);
+
+            if (dashboardChanges.length === 0) {
+                // PR doesn't (or no longer) touches the legacy dashboard. If we previously
+                // commented (e.g. files were removed in a later push), leave the comment in
+                // place for history rather than thrash on edit/delete.
+                return;
+            }
+
+            if (existingComment) {
+                if (existingComment.body === commentBody) {
+                    return;
+                }
+                await github.rest.issues.updateComment({
+                    owner: owner,
+                    repo: repo,
+                    comment_id: existingComment.id,
+                    body: commentBody,
+                });
+            } else {
+                await github.rest.issues.createComment({
+                    owner: owner,
+                    repo: repo,
+                    issue_number: prNumber,
+                    body: commentBody,
+                });
+            }

.github/workflows/external-component-bot.yml

@@ -4,20 +4,29 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
-permissions:
-  contents: read       #  Needed to fetch PR details
-  issues: write        #  Needed to create and update comments (PR comments are managed via the issues REST API)
-  pull-requests: write  # also needed?
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
 
 jobs:
   external-comment:
     name: External component comment
     runs-on: ubuntu-latest
     steps:
-      - name: Add external component comment
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
+      - name: Add external component comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             // Generate external component usage instructions
             function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {

.github/workflows/issue-codeowner-notify.yml

@@ -9,8 +9,8 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write
-  contents: read
+  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
+  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
 
 jobs:
   notify-codeowners:
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify codeowners for component issues
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const owner = context.repo.owner;

.github/workflows/lock.yml

@@ -6,6 +6,12 @@ on:
     - cron: "30 0 * * *"  # Run daily at 00:30 UTC
   workflow_dispatch:
 
+# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
+permissions: {}
+
 jobs:
   lock:
-    uses: esphome/workflows/.github/workflows/lock.yml@main
+    permissions:
+      issues: write         # issues.lock on closed issues
+      pull-requests: write  # issues.lock on closed pull requests
+    uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df  # 2026.4.1

.github/workflows/pr-title-check.yml

@@ -0,0 +1,98 @@
+name: PR Title Check
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    branches-ignore:
+      - release
+      - beta
+
+permissions:
+  contents: read       # actions/checkout to load detect-tags.js
+  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
+
+jobs:
+  check:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const {
+              detectComponents,
+              hasCoreChanges,
+              hasDashboardChanges,
+              hasGitHubActionsChanges,
+            } = require('./.github/scripts/detect-tags.js');
+
+            const title = context.payload.pull_request.title;
+            const user = context.payload.pull_request.user;
+
+            // Skip bot PRs (e.g. dependabot, esphome[bot] device-class sync) -
+            // they have their own title formats.
+            if (user.type === 'Bot') {
+              return;
+            }
+
+            // Block titles starting with "word:" or "word(scope):" patterns
+            const commitStylePattern = /^\w+(\(.*?\))?[!]?\s*:/;
+            if (commitStylePattern.test(title)) {
+              core.setFailed(
+                `PR title should not start with a "prefix:" style format.\n` +
+                `Please use the format: [component] Brief description\n`
+              );
+              return;
+            }
+
+            // Get changed files to detect tags
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.issue.number,
+            });
+            const filenames = files.map(f => f.filename);
+
+            // Detect tags from changed files using shared logic
+            const tags = new Set();
+
+            for (const comp of detectComponents(filenames)) {
+              tags.add(comp);
+            }
+            if (hasCoreChanges(filenames)) tags.add('core');
+            if (hasDashboardChanges(filenames)) tags.add('dashboard');
+            if (hasGitHubActionsChanges(filenames)) tags.add('ci');
+
+            if (tags.size === 0) {
+              return;
+            }
+
+            // Check for MDX syntax characters not wrapped in backticks.
+            // Astro docs MDX treats bare `<` as JSX component opening tags and
+            // bare `{` as JS expressions, so both must be escaped in changelog entries.
+            const stripped = title.replace(/`[^`]*`/g, '');
+            if (/[<>{}]/.test(stripped)) {
+              core.setFailed(
+                'PR title contains `<`, `>`, `{`, or `}` not wrapped in backticks.\n' +
+                'Astro docs MDX interprets bare `<` as JSX components and bare `{` as JS expressions.\n' +
+                'Please wrap these characters with backticks, e.g.: [component] Add `<feature>` support'
+              );
+              return;
+            }
+
+            // Check title starts with [tag] prefix
+            const bracketPattern = /^\[\w+\]/;
+            if (!bracketPattern.test(title)) {
+              const suggestion = [...tags].map(c => `[${c}]`).join('');
+              // Skip if the suggested prefix would be too long for a readable title
+              if (suggestion.length > 40) {
+                return;
+              }
+              core.setFailed(
+                `PR modifies: ${[...tags].join(', ')}\n` +
+                `Title must start with a [tag] prefix.\n` +
+                `Suggested: ${suggestion} <description>`
+              );
+            }

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
     - cron: "0 2 * * *"
 
 permissions:
-  contents: read
+  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
 
 jobs:
   init:
@@ -20,7 +20,7 @@ jobs:
       branch_build: ${{ steps.tag.outputs.branch_build }}
       deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Get tag
         id: tag
         # yamllint disable rule:line-length
@@ -57,12 +57,12 @@ jobs:
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write
+      contents: read   # actions/checkout to build the sdist/wheel
+      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Build
@@ -70,7 +70,7 @@ jobs:
           pip3 install build
           python3 -m build
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           skip-existing: true
 
@@ -78,8 +78,8 @@ jobs:
     name: Build ESPHome ${{ matrix.platform.arch }}
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
     runs-on: ${{ matrix.platform.os }}
     needs: [init]
     strategy:
@@ -92,22 +92,22 @@ jobs:
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to docker hub
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -138,7 +138,7 @@ jobs:
       #     version: ${{ needs.init.outputs.tag }}
 
       - name: Upload digests
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: digests-${{ matrix.platform.arch }}
           path: /tmp/digests
@@ -152,8 +152,8 @@ jobs:
       - deploy-docker
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
     strategy:
       fail-fast: false
       matrix:
@@ -168,27 +168,27 @@ jobs:
           - ghcr
           - dockerhub
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Download digests
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: digests-*
           path: /tmp/digests
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
         if: matrix.registry == 'ghcr'
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -212,72 +212,6 @@ jobs:
           docker buildx imagetools create $(jq -Rcnr 'inputs | . / "," | map("-t " + .) | join(" ")' <<< "${{ steps.tags.outputs.tags}}") \
             $(printf '${{ steps.tags.outputs.image }}@sha256:%s ' *)
 
-  deploy-ha-addon-repo:
-    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
-    runs-on: ubuntu-latest
-    needs:
-      - init
-      - deploy-manifest
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
-        with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          owner: esphome
-          repositories: home-assistant-addon
-
-      - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            let description = "ESPHome";
-            if (context.eventName == "release") {
-              description = ${{ toJSON(github.event.release.body) }};
-            }
-            github.rest.actions.createWorkflowDispatch({
-              owner: "esphome",
-              repo: "home-assistant-addon",
-              workflow_id: "bump-version.yml",
-              ref: "main",
-              inputs: {
-                version: "${{ needs.init.outputs.tag }}",
-                content: description
-              }
-            })
-
-  deploy-esphome-schema:
-    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
-    runs-on: ubuntu-latest
-    needs: [init]
-    environment: ${{ needs.init.outputs.deploy_env }}
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
-        with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          owner: esphome
-          repositories: esphome-schema
-
-      - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            github.rest.actions.createWorkflowDispatch({
-              owner: "esphome",
-              repo: "esphome-schema",
-              workflow_id: "generate-schemas.yml",
-              ref: "main",
-              inputs: {
-                version: "${{ needs.init.outputs.tag }}",
-              }
-            })
-
   version-notifier:
     if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
     runs-on: ubuntu-latest
@@ -287,19 +221,20 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: version-notifier
+          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            github.rest.actions.createWorkflowDispatch({
+            await github.rest.actions.createWorkflowDispatch({
               owner: "esphome",
               repo: "version-notifier",
               workflow_id: "notify.yml",

.github/workflows/stale.yml

@@ -7,8 +7,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write
-  pull-requests: write
+  issues: write         # actions/stale labels, comments on, and closes stale issues
+  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests
 
 concurrency:
   group: lock
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Stale
-        uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10.1.1
+        uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           debug-only: ${{ github.ref != 'refs/heads/dev' }} # Dry-run when not run on dev branch
           remove-stale-when-updated: true

.github/workflows/status-check-labels.yml

@@ -2,30 +2,32 @@ name: Status check labels
 
 on:
   pull_request:
-    types: [labeled, unlabeled]
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr)
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   check:
-    name: Check ${{ matrix.label }}
+    name: Check blocking labels
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        label:
-          - needs-docs
-          - merge-after-release
-          - chained-pr
     steps:
-      - name: Check for ${{ matrix.label }} label
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      - name: Check for blocking labels
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
+            const blockingLabels = ['needs-docs', 'merge-after-release', 'chained-pr'];
             const { data: labels } = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.issue.number
             });
-            const hasLabel = labels.find(label => label.name === '${{ matrix.label }}');
-            if (hasLabel) {
-              core.setFailed('Pull request cannot be merged, it is labeled as ${{ matrix.label }}');
+            const labelNames = labels.map(l => l.name);
+            const found = blockingLabels.filter(bl => labelNames.includes(bl));
+            if (found.length > 0) {
+              core.setFailed(`Pull request cannot be merged, it has blocking label(s): ${found.join(', ')}`);
             }

.github/workflows/sync-device-classes.yml

@@ -6,42 +6,94 @@ on:
   schedule:
     - cron: "45 6 * * *"
 
+# Repo writes (branch push, PR open) happen via the App token minted below,
+# so the workflow's GITHUB_TOKEN does not need any write scopes.
+permissions:
+  contents: read  # actions/checkout for this repo and home-assistant/core
+
 jobs:
   sync:
     name: Sync Device Classes
     runs-on: ubuntu-latest
     if: github.repository == 'esphome/esphome'
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
+          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
+          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
+
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: home-assistant/core
           path: lib/home-assistant
 
       - name: Setup Python
-        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: 3.13
+          python-version: "3.14"
+
+      - name: Set up uv
+        # An order of magnitude faster than pip on cold boots, with its
+        # own wheel cache. ``--system`` (below) installs into the
+        # setup-python interpreter so subsequent ``pre-commit`` /
+        # ``script/run-in-env.py`` steps find the deps without a
+        # ``uv run`` prefix.
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+          # Pin uv version so the action does not have to fetch the
+          # manifest from raw.githubusercontent.com on every cache
+          # miss; that fetch flakes on Windows runners.
+          version: "0.11.15"
 
       - name: Install Home Assistant
         run: |
-          python -m pip install --upgrade pip
-          pip install -e lib/home-assistant
-          pip install -r requirements_test.txt pre-commit
+          uv pip install --system -e lib/home-assistant
+          uv pip install --system -r requirements.txt -r requirements_test.txt pre-commit
 
       - name: Sync
         run: |
           python ./script/sync-device_class.py
 
-      - name: Run pre-commit hooks
-        run: |
-          python script/run-in-env.py pre-commit run --all-files
+      - name: Apply pre-commit auto-fixes
+        # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
+        # files. pre-commit exits non-zero whenever a hook touches anything,
+        # which would otherwise abort the workflow before the auto-fixes
+        # can flow into the sync PR.
+        #
+        # SKIP:
+        #   - no-commit-to-branch is a local guard against committing on
+        #     dev/release/beta; CI runs on dev by definition, and
+        #     peter-evans/create-pull-request creates the branch itself.
+        #   - pylint surfaces import-error / relative-beyond-top-level
+        #     noise here because this workflow installs only a subset of
+        #     the runtime deps (HA + requirements*.txt); main CI already
+        #     gates pylint on real PRs.
+        env:
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files || true
+
+      - name: Verify pre-commit clean
+        # Second pass: re-run all hooks against the now-fixed tree.
+        # Auto-fixers exit 0 (nothing to change); any remaining failure
+        # from a check-only hook (flake8 / yamllint / ci-custom) is a
+        # real issue and fails the workflow loudly. Same SKIP list as
+        # above for the same reasons.
+        env:
+          SKIP: pylint,no-commit-to-branch
+        run: python script/run-in-env.py pre-commit run --all-files
 
       - name: Commit changes
-        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
           committer: esphomebot <esphome@openhomefoundation.org>
@@ -50,4 +102,4 @@ jobs:
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"
           body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}

.gitignore

@@ -146,5 +146,6 @@ sdkconfig.*
 
 /components
 /managed_components
+/dependencies.lock
 
 api-docs/

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.14.11
+    rev: v0.15.14
     hooks:
       # Run the linter.
       - id: ruff
@@ -37,7 +37,7 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.20.0
+    rev: v3.21.2
     hooks:
       - id: pyupgrade
         args: [--py311-plus]
@@ -55,9 +55,10 @@ repos:
     hooks:
       - id: pylint
         name: pylint
-        entry: python3 script/run-in-env.py pylint
+        entry: python script/run-in-env.py pylint
         language: system
         types: [python]
+        files: ^esphome/.+\.py$
       - id: clang-tidy-hash
         name: Update clang-tidy hash
         entry: python script/clang_tidy_hash.py --update-if-changed
@@ -65,3 +66,7 @@ repos:
         files: ^(\.clang-tidy|platformio\.ini|requirements_dev\.txt)$
         pass_filenames: false
         additional_dependencies: []
+      - id: ci-custom
+        name: ci-custom
+        entry: python script/run-in-env.py script/ci-custom.py
+        language: system

AGENTS.md

@@ -124,6 +124,28 @@ This document provides essential context for AI models interacting with this pro
     *   **Indentation:** Use spaces (two per indentation level), not tabs
     *   **Type aliases:** Prefer `using type_t = int;` over `typedef int type_t;`
     *   **Line length:** Wrap lines at no more than 120 characters
+    *   **Constructor parameters vs setters:** Component properties that are both **required** and **invariant**
+        (never change after construction) should be constructor parameters rather than set via setter methods.
+        This makes the dependency explicit and prevents use of the object in an incompletely-initialized state.
+        In code generation, when calling `cg.new_Pvariable()` or the relevant helper function to create the component, pass these as arguments.
+        ```cpp
+        // Good - required invariant dependency as constructor parameter
+        class SourceTextSensor : public text_sensor::TextSensor, public Component {
+         public:
+          explicit SourceTextSensor(text::Text *source) : source_(source) {}
+         protected:
+          text::Text *source_;
+        };
+        ```
+        ```cpp
+        // Bad - required invariant dependency as setter
+        class SourceTextSensor : public text_sensor::TextSensor, public Component {
+         public:
+          void set_source(text::Text *source) { this->source_ = source; }
+         protected:
+          text::Text *source_{nullptr};
+        };
+        ```
 
 *   **Component Structure:**
     *   **Standard Files:**
@@ -217,6 +239,123 @@ This document provides essential context for AI models interacting with this pro
               var = await switch.new_switch(config)
           ```
 
+*   **Automations (Triggers, Actions, Conditions):**
+
+    Automations have three building blocks: **Triggers** (fire when something happens), **Actions** (do something), and **Conditions** (check if something is true).
+
+    *   **Triggers -- Callback method (preferred):**
+
+        Use `build_callback_automation()` for simple triggers. This eliminates the need for a C++ Trigger class by using a lightweight pointer-sized forwarder struct registered directly as a callback. No `CONF_TRIGGER_ID` in the schema.
+
+        **Python:**
+        ```python
+        from esphome import automation
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Optional(CONF_ON_STATE): automation.validate_automation({}),
+        }).extend(cv.COMPONENT_SCHEMA)
+
+        async def to_code(config):
+            var = cg.new_Pvariable(config[CONF_ID])
+            await cg.register_component(var, config)
+            for conf in config.get(CONF_ON_STATE, []):
+                await automation.build_callback_automation(
+                    var, "add_on_state_callback", [(bool, "x")], conf
+                )
+        ```
+
+        `build_callback_automation` arguments: `parent`, `callback_method` (C++ method name), `args` (template args as `[(type, name)]` tuples), `config`, and optional `forwarder` (defaults to `TriggerForwarder<Ts...>`).
+
+        For boolean filtering (e.g. `on_press`/`on_release`), use built-in forwarders with `args=[]`:
+        ```python
+        for conf_key, forwarder in (
+            (CONF_ON_PRESS, automation.TriggerOnTrueForwarder),
+            (CONF_ON_RELEASE, automation.TriggerOnFalseForwarder),
+        ):
+            for conf in config.get(conf_key, []):
+                await automation.build_callback_automation(
+                    var, "add_on_state_callback", [], conf, forwarder=forwarder
+                )
+        ```
+
+        **C++ -- no trigger class needed.** The callback registration method must be templatized to accept both `std::function` and lightweight forwarder structs (which avoid heap allocation):
+        ```cpp
+        class MyComponent : public Component {
+         public:
+          // Must be a template -- accepts both std::function and pointer-sized forwarder structs
+          template<typename F> void add_on_state_callback(F &&callback) {
+            this->state_callback_.add(std::forward<F>(callback));
+          }
+         protected:
+          // Use CallbackManager when callbacks are always registered (e.g. core components)
+          CallbackManager<void(bool)> state_callback_;
+          // Use LazyCallbackManager when callbacks are often not registered -- saves 8 bytes
+          // (nullptr vs empty std::vector) per instance when no callbacks are added
+          // LazyCallbackManager<void(bool)> state_callback_;
+        };
+        ```
+
+    *   **Triggers -- Trigger class method:**
+
+        Use `build_automation()` with a `Trigger<Ts...>` subclass only when the forwarder needs **mutable state beyond a single `Automation*` pointer** (e.g. edge detection tracking previous state, timing logic).
+
+        **Python:**
+        ```python
+        TurnOnTrigger = my_ns.class_("TurnOnTrigger", automation.Trigger.template())
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.Optional(CONF_ON_TURN_ON): automation.validate_automation(
+                {cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(TurnOnTrigger)}
+            ),
+        })
+
+        async def to_code(config):
+            for conf in config.get(CONF_ON_TURN_ON, []):
+                trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], var)
+                await automation.build_automation(trigger, [], conf)
+        ```
+
+        **C++:**
+        ```cpp
+        class TurnOnTrigger : public Trigger<> {
+         public:
+          explicit TurnOnTrigger(MyComponent *parent) : last_on_{false} {
+            parent->add_on_state_callback([this](bool state) {
+              if (state && !this->last_on_)
+                this->trigger();
+              this->last_on_ = state;
+            });
+          }
+         protected:
+          bool last_on_;
+        };
+        ```
+
+    *   **Actions:**
+        ```cpp
+        template<typename... Ts> class MyAction : public Action<Ts...> {
+         public:
+          explicit MyAction(MyComponent *parent) : parent_(parent) {}
+          void play(const Ts &...) override { this->parent_->do_something(); }
+         protected:
+          MyComponent *parent_;
+        };
+        ```
+        Register with `@automation.register_action("my_component.do_something", MyAction, schema, synchronous=True)`. Use `synchronous=True` for actions that run to completion inside `play()` without deferring. Use `synchronous=False` if the action may suspend/defer execution (e.g. `delay`, `wait_until`, `script.wait`) or store trigger arguments for later use.
+
+    *   **Conditions:**
+        ```cpp
+        template<typename... Ts> class MyCondition : public Condition<Ts...> {
+         public:
+          explicit MyCondition(MyComponent *parent) : parent_(parent) {}
+          bool check(const Ts &...) override { return this->parent_->is_active(); }
+         protected:
+          MyComponent *parent_;
+        };
+        ```
+        Register with `@automation.register_condition("my_component.is_active", MyCondition, schema)`.
+
 *   **Configuration Validation:**
     *   **Common Validators:** `cv.int_`, `cv.float_`, `cv.string`, `cv.boolean`, `cv.int_range(min=0, max=100)`, `cv.positive_int`, `cv.percentage`.
     *   **Complex Validation:** `cv.All(cv.string, cv.Length(min=1, max=50))`, `cv.Any(cv.int_, cv.string)`.
@@ -252,10 +391,49 @@ This document provides essential context for AI models interacting with this pro
     *   **Component Tests:** YAML-based compilation tests are located in `tests/`. The structure is as follows:
         ```
         tests/
-        ├── test_build_components/ # Base test configurations
-        └── components/[component]/ # Component-specific tests
+        ├── test_build_components/
+        │   └── common/          # Shared bus packages (uart, i2c, spi, etc.)
+        │       ├── uart/        # UART at default baud rate
+        │       ├── uart_115200/ # UART at 115200 baud
+        │       ├── i2c/         # I2C bus
+        │       └── spi/         # SPI bus
+        └── components/[component]/
+            ├── common.yaml          # Component-only config (no bus definitions)
+            ├── test.esp32-idf.yaml      # config + compile
+            ├── test.esp8266-ard.yaml    # config + compile
+            ├── test-variant.esp32-idf.yaml  # variant test, config + compile
+            ├── validate.esp32-idf.yaml      # config-only (never compiled)
+            └── validate-legacy.esp32-idf.yaml  # config-only variant
         ```
         Run them using `script/test_build_components`. Use `-c <component>` to test specific components and `-t <target>` for specific platforms.
+
+    *   **Config-only test files (`validate.*.yaml`):** Use this prefix when a YAML file only needs to exercise schema/validation paths and does not need to be compiled. CI runs `validate.*.yaml` files with `esphome config` only and skips them during compile. The grammar mirrors `test.*.yaml`:
+        - `validate.<platform>.yaml` — base config-only test
+        - `validate-<variant>.<platform>.yaml` — config-only variant
+
+        Use this for things like deprecated-syntax migration tests, schema edge cases, or platform-specific validation branches where building firmware adds no signal. A component may have any mix of `test.*.yaml` and `validate.*.yaml` files. Validate files never participate in bus-grouping; each one runs as its own `esphome config` invocation.
+
+        When a PR's only edits to a component are `validate.*.yaml` files (no source changes, no `test.*.yaml` changes, and the component isn't pulled in as a dependency of another changed component), CI skips the compile stage for that component entirely and only runs config validation. This is decided in `script/determine-jobs.py` via `_component_change_is_validate_only` and surfaced as the `validate_only_components` output that the `test-build-components-split` job consumes.
+
+    *   **Test Grouping with Packages:** Components that use shared bus packages can be grouped together in CI to reduce build count. **Never define buses (uart, i2c, spi, modbus) directly in test YAML files** — always use packages from `test_build_components/common/`:
+        ```yaml
+        # test.esp32-idf.yaml — use packages for buses
+        packages:
+          uart: !include ../../test_build_components/common/uart_115200/esp32-idf.yaml
+
+        <<: !include common.yaml
+        ```
+        ```yaml
+        # common.yaml — component config only, NO bus definitions
+        my_component:
+          id: my_instance
+
+        sensor:
+          - platform: my_component
+            name: My Sensor
+        ```
+        Components that define buses directly are flagged as "NEEDS MIGRATION" and cannot be grouped, increasing CI build time.
+
     *   **Testing All Components Together:** To verify that all components can be tested together without ID conflicts or configuration issues, use:
         ```bash
         ./script/test_component_grouping.py -e config --all
@@ -286,6 +464,7 @@ This document provides essential context for AI models interacting with this pro
 *   **Documentation Contributions:**
     *   Documentation is hosted in the separate `esphome/esphome-docs` repository.
     *   The contribution workflow is the same as for the codebase.
+    *   When editing a component's documentation page, also update the corresponding component index page to ensure both pages remain in sync.
 
 *   **Best Practices:**
     *   **Component Development:** Keep dependencies minimal, provide clear error messages, and write comprehensive docstrings and tests.
@@ -394,6 +573,30 @@ This document provides essential context for AI models interacting with this pro
 
         Note: Avoiding heap allocation after `setup()` is always required regardless of component type. The prioritization above is about the effort spent on container optimization (e.g., migrating from `std::vector` to `StaticVector`).
 
+        **Callback Managers:**
+
+        ESPHome provides two callback manager types in `esphome/core/helpers.h` for the observer pattern. Both support `std::function`, lambdas, and lightweight forwarder structs via their templatized `add()` method.
+
+        | Type | Idle overhead (32-bit) | When to use |
+        |------|----------------------|-------------|
+        | `CallbackManager<void(Ts...)>` | 12 bytes (empty `std::vector`) | Callbacks are always or almost always registered |
+        | `LazyCallbackManager<void(Ts...)>` | 4 bytes (`nullptr`) | Callbacks are often not registered (common case) |
+
+        `LazyCallbackManager` is a drop-in replacement for `CallbackManager` that defers allocation until the first callback is added. Prefer it for entity-level callbacks where most instances have no subscribers.
+
+        **Important:** Registration methods that add to a callback manager **must always be templatized** to accept both `std::function` and pointer-sized forwarder structs (used by `build_callback_automation`). Never use `std::function` in the method signature:
+        ```cpp
+        // Bad -- forces heap allocation for forwarder structs
+        void add_on_state_callback(std::function<void(bool)> &&callback) {
+          this->state_callback_.add(std::move(callback));
+        }
+
+        // Good -- accepts any callable without forcing std::function wrapping
+        template<typename F> void add_on_state_callback(F &&callback) {
+          this->state_callback_.add(std::forward<F>(callback));
+        }
+        ```
+
     *   **State Management:** Use `CORE.data` for component state that needs to persist during configuration generation. Avoid module-level mutable globals.
 
         **Bad Pattern (Module-Level Globals):**

CLAUDE.md

@@ -1 +1 @@
-.ai/instructions.md
+AGENTS.md

CODEOWNERS

@@ -54,6 +54,9 @@ esphome/components/atm90e32/* @circuitsetup @descipher
 esphome/components/audio/* @kahrendt
 esphome/components/audio_adc/* @kbx81
 esphome/components/audio_dac/* @kbx81
+esphome/components/audio_file/* @kahrendt
+esphome/components/audio_file/media_source/* @kahrendt
+esphome/components/audio_http/* @kahrendt
 esphome/components/axs15231/* @clydebarrow
 esphome/components/b_parasite/* @rbaron
 esphome/components/ballu/* @bazuchan
@@ -88,7 +91,9 @@ esphome/components/bmp3xx/* @latonita
 esphome/components/bmp3xx_base/* @latonita @martgras
 esphome/components/bmp3xx_i2c/* @latonita
 esphome/components/bmp3xx_spi/* @latonita
-esphome/components/bmp581/* @kahrendt
+esphome/components/bmp581_base/* @danielkent-net @kahrendt
+esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
+esphome/components/bmp581_spi/* @danielkent-net @kahrendt
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
 esphome/components/bthome_mithermometer/* @nagyrobi
@@ -103,6 +108,7 @@ esphome/components/cc1101/* @gabest11 @lygris
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
 esphome/components/ch422g/* @clydebarrow @jesterret
+esphome/components/ch423/* @dwmw2
 esphome/components/chsc6x/* @kkosik20
 esphome/components/climate/* @esphome/core
 esphome/components/climate_ir/* @glmnet
@@ -128,19 +134,22 @@ esphome/components/dashboard_import/* @esphome/core
 esphome/components/datetime/* @jesserockz @rfdarter
 esphome/components/debug/* @esphome/core
 esphome/components/delonghi/* @grob6000
+esphome/components/dew_point/* @CFlix
 esphome/components/dfplayer/* @glmnet
 esphome/components/dfrobot_sen0395/* @niklasweber
 esphome/components/dht/* @OttoWinter
 esphome/components/display_menu_base/* @numo68
+esphome/components/dlms_meter/* @SimonFischer04
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
 esphome/components/ds2484/* @mrk-its
-esphome/components/dsmr/* @glmnet @PolarGoose @zuidwijk
+esphome/components/dsmr/* @glmnet @PolarGoose
 esphome/components/duty_time/* @dudanov
 esphome/components/ee895/* @Stock-M
 esphome/components/ektf2232/touchscreen/* @jesserockz
 esphome/components/emc2101/* @ellull
 esphome/components/emmeti/* @E440QF
+esphome/components/emontx/* @FredM67 @glynhudson @TrystanLea
 esphome/components/ens160/* @latonita
 esphome/components/ens160_base/* @latonita @vincentscode
 esphome/components/ens160_i2c/* @latonita
@@ -210,6 +219,8 @@ esphome/components/hbridge/light/* @DotNetDann
 esphome/components/hbridge/switch/* @dwmw2
 esphome/components/hc8/* @omartijn
 esphome/components/hdc2010/* @optimusprimespace @ssieb
+esphome/components/hdc2080/* @G-Pereira @jesserockz
+esphome/components/hdc302x/* @joshuasing
 esphome/components/he60r/* @clydebarrow
 esphome/components/heatpumpir/* @rob-deutsch
 esphome/components/hitachi_ac424/* @sourabhjaiswal
@@ -237,7 +248,6 @@ esphome/components/hyt271/* @Philippe12
 esphome/components/i2c/* @esphome/core
 esphome/components/i2c_device/* @gabest11
 esphome/components/i2s_audio/* @jesserockz
-esphome/components/i2s_audio/media_player/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
 esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
 esphome/components/iaqcore/* @yozik04
@@ -312,6 +322,7 @@ esphome/components/mcp9808/* @k7hpn
 esphome/components/md5/* @esphome/core
 esphome/components/mdns/* @esphome/core
 esphome/components/media_player/* @jesserockz
+esphome/components/media_source/* @kahrendt
 esphome/components/micro_wake_word/* @jesserockz @kahrendt
 esphome/components/micronova/* @edenhaus @jorre05
 esphome/components/microphone/* @jesserockz @kahrendt
@@ -322,6 +333,7 @@ esphome/components/mipi_dsi/* @clydebarrow
 esphome/components/mipi_rgb/* @clydebarrow
 esphome/components/mipi_spi/* @clydebarrow
 esphome/components/mitsubishi/* @RubyBailey
+esphome/components/mitsubishi_cn105/* @crnjan
 esphome/components/mixer/speaker/* @kahrendt
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
@@ -335,6 +347,7 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
+esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
@@ -392,6 +405,7 @@ esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
 esphome/components/qspi_dbi/* @clydebarrow
 esphome/components/qwiic_pir/* @kahrendt
+esphome/components/radio_frequency/* @kbx81
 esphome/components/radon_eye_ble/* @jeffeb3
 esphome/components/radon_eye_rd200/* @jeffeb3
 esphome/components/rc522/* @glmnet
@@ -402,12 +416,15 @@ esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
+esphome/components/ring_buffer/* @kahrendt
 esphome/components/rp2040/* @jesserockz
+esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
 esphome/components/rpi_dpi_rgb/* @clydebarrow
 esphome/components/rtl87xx/* @kuba2k2
-esphome/components/rtttl/* @glmnet
+esphome/components/rtttl/* @glmnet @ximex
+esphome/components/runtime_image/* @clydebarrow @guillempages @kahrendt
 esphome/components/runtime_stats/* @bdraco
 esphome/components/rx8130/* @beormund
 esphome/components/safe_mode/* @jsuanet @kbx81 @paulmonigatti
@@ -424,8 +441,15 @@ esphome/components/select/* @esphome/core
 esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
+esphome/components/sen6x/* @martgras @mebner86 @mikelawrence @tuct
+esphome/components/sendspin/* @kahrendt
+esphome/components/sendspin/media_player/* @kahrendt
+esphome/components/sendspin/media_source/* @kahrendt
+esphome/components/sendspin/sensor/* @kahrendt
+esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
+esphome/components/serial_proxy/* @kbx81
 esphome/components/sfa30/* @ghsensdev
 esphome/components/sgp40/* @SenexCrenshaw
 esphome/components/sgp4x/* @martgras @SenexCrenshaw
@@ -446,8 +470,12 @@ esphome/components/sn74hc165/* @jesserockz
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
 esphome/components/sound_level/* @kahrendt
+esphome/components/spa06_base/* @danielkent-net
+esphome/components/spa06_i2c/* @danielkent-net
+esphome/components/spa06_spi/* @danielkent-net
 esphome/components/speaker/* @jesserockz @kahrendt
 esphome/components/speaker/media_player/* @kahrendt @synesthesiam
+esphome/components/speaker_source/* @kahrendt
 esphome/components/spi/* @clydebarrow @esphome/core
 esphome/components/spi_device/* @clydebarrow
 esphome/components/spi_led_strip/* @clydebarrow
@@ -481,6 +509,7 @@ esphome/components/switch/* @esphome/core
 esphome/components/switch/binary_sensor/* @ssieb
 esphome/components/sx126x/* @swoboda1337
 esphome/components/sx127x/* @swoboda1337
+esphome/components/sy6970/* @linkedupbits
 esphome/components/syslog/* @clydebarrow
 esphome/components/t6615/* @tylermenezes
 esphome/components/tc74/* @sethgirvan
@@ -528,7 +557,7 @@ esphome/components/uart/packet_transport/* @clydebarrow
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
-esphome/components/ultrasonic/* @OttoWinter
+esphome/components/ultrasonic/* @ssieb @swoboda1337
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
 esphome/components/usb_cdc_acm/* @kbx81
@@ -577,7 +606,8 @@ esphome/components/xl9535/* @mreditor97
 esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
 esphome/components/xxtea/* @clydebarrow
 esphome/components/zephyr/* @tomaszduda23
+esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
 esphome/components/zhlt01/* @cfeenstra1024
-esphome/components/zigbee/* @tomaszduda23
+esphome/components/zigbee/* @luar123 @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt
 esphome/components/zwave_proxy/* @kbx81

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.1.3
+PROJECT_NUMBER         = 2026.6.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

GEMINI.md

@@ -1 +1 @@
-.ai/instructions.md
+AGENTS.md

MANIFEST.in

@@ -4,4 +4,5 @@ include requirements.txt
 recursive-include esphome *.yaml
 recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
+recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt

README.md

@@ -1,4 +1,4 @@
-# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/)
+# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/) [![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://codspeed.io/esphome/esphome)
 
 <a href="https://esphome.io/">
   <picture>

docker/Dockerfile

@@ -9,21 +9,26 @@ FROM ghcr.io/esphome/docker-base:${BUILD_OS}-ha-addon-${BUILD_BASE_VERSION} AS b
 ARG BUILD_TYPE
 FROM base-source-${BUILD_TYPE} AS base
 
-RUN git config --system --add safe.directory "*"
+RUN git config --system --add safe.directory "*" \
+    && git config --system advice.detachedHead false
 
 # Install build tools for Python packages that require compilation
-# (e.g., ruamel.yaml.clibz used by ESP-IDF's idf-component-manager)
+# (e.g., ruamel.yaml.clib used by ESP-IDF's idf-component-manager).
+# Also install libusb-1.0 at runtime so the ESP-IDF tools installer can
+# validate openocd-esp32 (it dynamically links libusb-1.0.so.0); without
+# it idf_tools.py rejects the openocd install with exit 127 and aborts
+# the whole framework setup.
 RUN if command -v apk > /dev/null; then \
-        apk add --no-cache build-base; \
+        apk add --no-cache build-base libusb; \
     else \
         apt-get update \
-        && apt-get install -y --no-install-recommends build-essential \
+        && apt-get install -y --no-install-recommends build-essential libusb-1.0-0 \
         && rm -rf /var/lib/apt/lists/*; \
     fi
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1
 
-RUN pip install --no-cache-dir -U pip uv==0.6.14
+RUN pip install --no-cache-dir -U pip uv==0.10.1
 
 COPY requirements.txt /
 

docker/ha-addon-rootfs/etc/cont-init.d/40-device-builder.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/with-contenv bashio
+# ==============================================================================
+# Installs the latest prerelease of esphome-device-builder when the
+# `use_new_device_builder` config option is enabled.
+# This is a temporary install-on-boot step until esphome-device-builder
+# becomes a direct dependency of esphome.
+# ==============================================================================
+
+if ! bashio::config.true 'use_new_device_builder'; then
+  exit 0
+fi
+
+bashio::log.info "Installing latest prerelease of esphome-device-builder..."
+if command -v uv > /dev/null; then
+  uv pip install --system --no-cache-dir --prerelease=allow --upgrade \
+    esphome-device-builder ||
+    bashio::exit.nok "Failed installing esphome-device-builder."
+else
+  pip install --no-cache-dir --pre --upgrade esphome-device-builder ||
+    bashio::exit.nok "Failed installing esphome-device-builder."
+fi
+bashio::log.info "Installed esphome-device-builder."

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -49,5 +49,12 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "Starting ESPHome Device Builder..."
+    exec esphome-device-builder /config/esphome \
+        --ha-addon \
+        --ingress-port "$(bashio::addon.ingress_port)"
+fi
+
 bashio::log.info "Starting ESPHome dashboard..."
 exec esphome dashboard /config/esphome --socket /var/run/esphome.sock --ha-addon

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -4,6 +4,14 @@
 # Community Hass.io Add-ons: ESPHome
 # Configures NGINX for use with ESPHome
 # ==============================================================================
+
+# When the new device builder is enabled it serves HA ingress directly,
+# so nginx is not used at all -- skip configuration.
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "Skipping NGINX setup: new device builder serves ingress directly."
+    bashio::exit.ok
+fi
+
 mkdir -p /var/log/nginx
 
 # Generate Ingress configuration

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -5,6 +5,14 @@
 # Runs the NGINX proxy
 # ==============================================================================
 
+# The new device builder handles HA ingress itself, so nginx is bypassed.
+# Block the longrun forever so s6 keeps the dependency satisfied and does
+# not respawn it.
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "NGINX bypassed: new device builder serves ingress directly."
+    exec sleep infinity
+fi
+
 bashio::log.info "Waiting for ESPHome dashboard to come up..."
 
 while [[ ! -S /var/run/esphome.sock ]]; do

esphome/address_cache.py

@@ -101,6 +101,17 @@ class AddressCache:
         """Check if any cache entries exist."""
         return bool(self.mdns_cache or self.dns_cache)
 
+    def add_mdns_addresses(self, hostname: str, addresses: list[str]) -> None:
+        """Store resolved mDNS addresses for ``hostname`` in the cache.
+
+        Callers that discover ``.local`` hosts (e.g. via mDNS browse) can use
+        this to avoid a second resolution round-trip during the upload path.
+        No-op when ``addresses`` is empty.
+        """
+        if not addresses:
+            return
+        self.mdns_cache[normalize_hostname(hostname)] = addresses
+
     @classmethod
     def from_cli_args(
         cls, mdns_args: Iterable[str], dns_args: Iterable[str]

esphome/analyze_memory/__init__.py

@@ -1,6 +1,6 @@
 """Memory usage analyzer for ESPHome compiled binaries."""
 
-from collections import defaultdict
+from collections import Counter, defaultdict
 from dataclasses import dataclass, field
 import logging
 from pathlib import Path
@@ -12,7 +12,6 @@ from .const import (
     CORE_SUBCATEGORY_PATTERNS,
     DEMANGLED_PATTERNS,
     ESPHOME_COMPONENT_PATTERN,
-    SECTION_TO_ATTR,
     SYMBOL_PATTERNS,
 )
 from .demangle import batch_demangle
@@ -22,10 +21,10 @@ from .helpers import (
     map_section_name,
     parse_symbol_line,
 )
-from .toolchain import find_tool, run_tool
+from .toolchain import find_tool, resolve_tool_path, run_tool
 
 if TYPE_CHECKING:
-    from esphome.platformio_api import IDEData
+    from esphome.platformio.toolchain import IDEData
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -41,12 +40,26 @@ _READELF_SECTION_PATTERN = re.compile(
     r"\s*\[\s*\d+\]\s+([\.\w]+)\s+\w+\s+[\da-fA-F]+\s+[\da-fA-F]+\s+([\da-fA-F]+)"
 )
 
+# Regex for extracting call targets from objdump disassembly
+# Matches direct call instructions across architectures:
+#   Xtensa: call0/call4/call8/call12/callx0/callx4/callx8/callx12 <addr> <symbol>
+#   ARM:    bl/blx <addr> <symbol>
+# Captures the mangled symbol name inside angle brackets.
+_CALL_TARGET_PATTERN = re.compile(
+    r"\t(?:call(?:0|4|8|12)|callx(?:0|4|8|12)|blx?)\s+[\da-fA-F]+ <([^>]+)>"
+)
+
 # Component category prefixes
 _COMPONENT_PREFIX_ESPHOME = "[esphome]"
 _COMPONENT_PREFIX_EXTERNAL = "[external]"
+_COMPONENT_PREFIX_LIB = "[lib]"
 _COMPONENT_CORE = f"{_COMPONENT_PREFIX_ESPHOME}core"
 _COMPONENT_API = f"{_COMPONENT_PREFIX_ESPHOME}api"
 
+# Placement new storage suffix (generated by codegen Pvariable)
+_PSTORAGE_SUFFIX = "__pstorage"
+
+
 # C++ namespace prefixes
 _NAMESPACE_ESPHOME = "esphome::"
 _NAMESPACE_STD = "std::"
@@ -57,6 +70,16 @@ SymbolInfoType = tuple[str, int, str]
 # RAM sections - symbols in these sections consume RAM
 RAM_SECTIONS = frozenset([".data", ".bss"])
 
+# nm symbol types for global/weak defined symbols (used for library symbol mapping)
+# Only global (uppercase) and weak symbols are safe to use - local symbols (lowercase)
+# can have name collisions across compilation units
+_NM_DEFINED_GLOBAL_TYPES = frozenset({"T", "D", "B", "R", "W", "V"})
+
+# Pattern matching compiler-generated local names that can collide across compilation
+# units (e.g., packet$19, buf$20, flag$5261). These are unsafe for name-based lookup.
+# Does NOT match mangled C++ names with optimization suffixes (e.g., func$isra$0).
+_COMPILER_LOCAL_PATTERN = re.compile(r"^[a-zA-Z_]\w*\$\d+$")
+
 
 @dataclass
 class MemorySection:
@@ -91,6 +114,17 @@ class ComponentMemory:
     bss_size: int = 0  # Uninitialized data (ram only)
     symbol_count: int = 0
 
+    def add_section_size(self, section_name: str, size: int) -> None:
+        """Add size to the appropriate attribute for a section."""
+        if section_name == ".text":
+            self.text_size += size
+        elif section_name == ".rodata":
+            self.rodata_size += size
+        elif section_name == ".data":
+            self.data_size += size
+        elif section_name == ".bss":
+            self.bss_size += size
+
     @property
     def flash_total(self) -> int:
         """Total flash usage (text + rodata + data)."""
@@ -132,6 +166,12 @@ class MemoryAnalyzer:
             readelf_path = readelf_path or idedata.readelf_path
             _LOGGER.debug("Using toolchain paths from PlatformIO idedata")
 
+        # Validate paths exist, fall back to find_tool if they don't
+        # This handles cases like Zephyr where cc_path doesn't include full path
+        # and the toolchain prefix may differ (e.g., arm-zephyr-eabi- vs arm-none-eabi-)
+        objdump_path = resolve_tool_path("objdump", objdump_path, objdump_path)
+        readelf_path = resolve_tool_path("readelf", readelf_path, objdump_path)
+
         self.objdump_path = objdump_path or "objdump"
         self.readelf_path = readelf_path or "readelf"
         self.external_components = external_components or set()
@@ -161,13 +201,31 @@ class MemoryAnalyzer:
         self._elf_symbol_names: set[str] = set()
         # SDK symbols not in ELF (static/local symbols from closed-source libs)
         self._sdk_symbols: list[SDKSymbol] = []
+        # CSWTCH symbols: list of (name, size, source_file, component)
+        self._cswtch_symbols: list[tuple[str, int, str, str]] = []
+        # Library symbol mapping: symbol_name -> library_name
+        self._lib_symbol_map: dict[str, str] = {}
+        # Source file symbol mapping: symbol_name -> component_name
+        # Used for extern "C" and other symbols without C++ namespace
+        self._source_symbol_map: dict[str, str] = {}
+        # Library dir to name mapping: "lib641" -> "espsoftwareserial",
+        # "espressif__mdns" -> "mdns"
+        self._lib_hash_to_name: dict[str, str] = {}
+        # Heuristic category to library redirect: "mdns_lib" -> "[lib]mdns"
+        self._heuristic_to_lib: dict[str, str] = {}
+        # Function call counts: mangled_name -> call_count
+        self._function_call_counts: Counter[str] = Counter()
 
     def analyze(self) -> dict[str, ComponentMemory]:
         """Analyze the ELF file and return component memory usage."""
         self._parse_sections()
         self._parse_symbols()
+        self._scan_libraries()
+        self._scan_source_symbols()
         self._categorize_symbols()
+        self._analyze_cswtch_symbols()
         self._analyze_sdk_libraries()
+        self._analyze_function_calls()
         return dict(self.components)
 
     def _parse_sections(self) -> None:
@@ -249,8 +307,7 @@ class MemoryAnalyzer:
                 comp_mem.symbol_count += 1
 
                 # Update the appropriate size attribute based on section
-                if attr_name := SECTION_TO_ATTR.get(section_name):
-                    setattr(comp_mem, attr_name, getattr(comp_mem, attr_name) + size)
+                comp_mem.add_section_size(section_name, size)
 
                 # Track uncategorized symbols
                 if component == "other" and size > 0:
@@ -279,6 +336,13 @@ class MemoryAnalyzer:
         # Demangle C++ names if needed
         demangled = self._demangle_symbol(symbol_name)
 
+        # Check for placement new storage symbols (generated by codegen)
+        # Format: {component}__{id}__pstorage
+        if demangled.endswith(_PSTORAGE_SUFFIX) and (
+            component := self._match_pstorage_component(demangled)
+        ):
+            return component
+
         # Check for special component classes first (before namespace pattern)
         # This handles cases like esphome::ESPHomeOTAComponent which should map to ota
         if _NAMESPACE_ESPHOME in demangled:
@@ -310,15 +374,24 @@ class MemoryAnalyzer:
             # If no component match found, it's core
             return _COMPONENT_CORE
 
+        # Check library symbol map (more accurate than heuristic patterns)
+        if lib_name := self._lib_symbol_map.get(symbol_name):
+            return f"{_COMPONENT_PREFIX_LIB}{lib_name}"
+
+        # Check source file mapping (catches extern "C" functions in ESPHome sources)
+        # Must be before heuristic patterns since source attribution is authoritative
+        if component := self._source_symbol_map.get(symbol_name):
+            return component
+
         # Check against symbol patterns
         for component, patterns in SYMBOL_PATTERNS.items():
             if any(pattern in symbol_name for pattern in patterns):
-                return component
+                return self._heuristic_to_lib.get(component, component)
 
         # Check against demangled patterns
         for component, patterns in DEMANGLED_PATTERNS.items():
             if any(pattern in demangled for pattern in patterns):
-                return component
+                return self._heuristic_to_lib.get(component, component)
 
         # Special cases that need more complex logic
 
@@ -337,14 +410,33 @@ class MemoryAnalyzer:
         # Track uncategorized symbols for analysis
         return "other"
 
+    def _match_pstorage_component(self, symbol_name: str) -> str | None:
+        """Match a __pstorage symbol to its ESPHome component.
+
+        Symbol format: {component}__{id}__pstorage
+        The component namespace is embedded by codegen before the double underscore.
+        """
+        prefix = symbol_name[: -len(_PSTORAGE_SUFFIX)]
+        # Extract component namespace before the first double underscore
+        dunder_pos = prefix.find("__")
+        if dunder_pos == -1:
+            return None
+        component_name = prefix[:dunder_pos]
+        if component_name in get_esphome_components():
+            return f"{_COMPONENT_PREFIX_ESPHOME}{component_name}"
+        if component_name in self.external_components:
+            return f"{_COMPONENT_PREFIX_EXTERNAL}{component_name}"
+        return None
+
     def _batch_demangle_symbols(self, symbols: list[str]) -> None:
         """Batch demangle C++ symbol names for efficiency."""
         if not symbols:
             return
 
         _LOGGER.info("Demangling %d symbols", len(symbols))
-        self._demangle_cache = batch_demangle(symbols, objdump_path=self.objdump_path)
-        _LOGGER.info("Successfully demangled %d symbols", len(self._demangle_cache))
+        demangled = batch_demangle(symbols, objdump_path=self.objdump_path)
+        self._demangle_cache.update(demangled)
+        _LOGGER.info("Successfully demangled %d symbols", len(demangled))
 
     def _demangle_symbol(self, symbol: str) -> str:
         """Get demangled C++ symbol name from cache."""
@@ -366,6 +458,770 @@ class MemoryAnalyzer:
 
         return "Other Core"
 
+    def _discover_pio_libraries(
+        self,
+        libraries: dict[str, list[Path]],
+        hash_to_name: dict[str, str],
+    ) -> None:
+        """Discover PlatformIO third-party libraries from the build directory.
+
+        Scans ``lib<hex>/`` directories under ``.pioenvs/<env>/`` to find
+        library names and their ``.a`` archive or ``.o`` file paths.
+
+        Args:
+            libraries: Dict to populate with library name -> file path list mappings.
+                Prefers ``.a`` archives when available, falls back to ``.o`` files
+                (e.g., pioarduino ESP32 Arduino builds only produce ``.o`` files).
+            hash_to_name: Dict to populate with dir name -> library name mappings
+                for CSWTCH attribution (e.g., ``lib641`` -> ``espsoftwareserial``).
+        """
+        build_dir = self.elf_path.parent
+
+        for entry in build_dir.iterdir():
+            if not entry.is_dir() or not entry.name.startswith("lib"):
+                continue
+            # Validate that the suffix after "lib" is a hex hash
+            hex_part = entry.name[3:]
+            if not hex_part:
+                continue
+            try:
+                int(hex_part, 16)
+            except ValueError:
+                continue
+
+            # Each lib<hex>/ directory contains a subdirectory named after the library
+            for lib_subdir in entry.iterdir():
+                if not lib_subdir.is_dir():
+                    continue
+                lib_name = lib_subdir.name.lower()
+
+                # Prefer .a archive (lib<LibraryName>.a), fall back to .o files
+                # e.g., lib72a/ESPAsyncTCP/... has lib72a/libESPAsyncTCP.a
+                archive = entry / f"lib{lib_subdir.name}.a"
+                if archive.exists():
+                    file_paths = [archive]
+                elif archives := list(entry.glob("*.a")):
+                    # Case-insensitive fallback
+                    file_paths = [archives[0]]
+                else:
+                    # No .a archive (e.g., pioarduino CMake builds) - use .o files
+                    file_paths = sorted(lib_subdir.rglob("*.o"))
+
+                if file_paths:
+                    libraries[lib_name] = file_paths
+                    hash_to_name[entry.name] = lib_name
+                    _LOGGER.debug(
+                        "Discovered PlatformIO library: %s -> %s",
+                        lib_subdir.name,
+                        file_paths[0],
+                    )
+
+    def _discover_idf_managed_components(
+        self,
+        libraries: dict[str, list[Path]],
+        hash_to_name: dict[str, str],
+    ) -> None:
+        """Discover ESP-IDF managed component libraries from the build directory.
+
+        ESP-IDF managed components (from the IDF component registry) use a
+        ``<vendor>__<name>`` naming convention. Source files live under
+        ``managed_components/<vendor>__<name>/`` and the compiled archives are at
+        ``esp-idf/<vendor>__<name>/lib<vendor>__<name>.a``.
+
+        Args:
+            libraries: Dict to populate with library name -> file path list mappings.
+            hash_to_name: Dict to populate with dir name -> library name mappings
+                for CSWTCH attribution (e.g., ``espressif__mdns`` -> ``mdns``).
+        """
+        build_dir = self.elf_path.parent
+
+        managed_dir = build_dir / "managed_components"
+        if not managed_dir.is_dir():
+            return
+
+        espidf_dir = build_dir / "esp-idf"
+
+        for entry in managed_dir.iterdir():
+            if not entry.is_dir() or "__" not in entry.name:
+                continue
+
+            # Extract the short name: espressif__mdns -> mdns
+            full_name = entry.name  # e.g., espressif__mdns
+            short_name = full_name.split("__", 1)[1].lower()
+
+            # Find the .a archive under esp-idf/<vendor>__<name>/
+            archive = espidf_dir / full_name / f"lib{full_name}.a"
+            if archive.exists():
+                libraries[short_name] = [archive]
+                hash_to_name[full_name] = short_name
+                _LOGGER.debug(
+                    "Discovered IDF managed component: %s -> %s",
+                    short_name,
+                    archive,
+                )
+
+    def _build_library_symbol_map(
+        self, libraries: dict[str, list[Path]]
+    ) -> dict[str, str]:
+        """Build a symbol-to-library mapping from library archives or object files.
+
+        Runs ``nm --defined-only`` on each ``.a`` or ``.o`` file to collect
+        global and weak defined symbols.
+
+        Args:
+            libraries: Dictionary mapping library name to list of file paths
+                (``.a`` archives or ``.o`` object files).
+
+        Returns:
+            Dictionary mapping symbol name to library name.
+        """
+        symbol_map: dict[str, str] = {}
+
+        if not self.nm_path:
+            return symbol_map
+
+        for lib_name, file_paths in libraries.items():
+            result = run_tool(
+                [self.nm_path, "--defined-only", *(str(p) for p in file_paths)],
+                timeout=10,
+            )
+            if result is None or result.returncode != 0:
+                continue
+
+            for line in result.stdout.splitlines():
+                parts = line.split()
+                if len(parts) < 3:
+                    continue
+
+                sym_type = parts[-2]
+                sym_name = parts[-1]
+
+                # Include global defined symbols (uppercase) and weak symbols (W/V)
+                if sym_type in _NM_DEFINED_GLOBAL_TYPES:
+                    symbol_map[sym_name] = lib_name
+
+        return symbol_map
+
+    @staticmethod
+    def _build_heuristic_to_lib_mapping(
+        library_names: set[str],
+    ) -> dict[str, str]:
+        """Build mapping from heuristic pattern categories to discovered libraries.
+
+        Heuristic categories like ``mdns_lib``, ``web_server_lib``, ``async_tcp``
+        exist as approximations for library attribution.  When we discover the
+        actual library, symbols matching those heuristics should be redirected
+        to the ``[lib]`` category instead.
+
+        The mapping is built by checking if the normalized category name
+        (stripped of ``_lib`` suffix and underscores) appears as a substring
+        of any discovered library name.
+
+        Examples::
+
+            mdns_lib -> mdns -> in "mdns" or "esp8266mdns" -> [lib]mdns
+            web_server_lib -> webserver -> in "espasyncwebserver" -> [lib]espasyncwebserver
+            async_tcp -> asynctcp -> in "espasynctcp" -> [lib]espasynctcp
+
+        Args:
+            library_names: Set of discovered library names (lowercase).
+
+        Returns:
+            Dictionary mapping heuristic category to ``[lib]<name>`` string.
+        """
+        mapping: dict[str, str] = {}
+        all_categories = set(SYMBOL_PATTERNS) | set(DEMANGLED_PATTERNS)
+
+        for category in all_categories:
+            base = category.removesuffix("_lib").replace("_", "")
+            # Collect all libraries whose name contains the base string
+            candidates = [lib_name for lib_name in library_names if base in lib_name]
+            if not candidates:
+                continue
+
+            # Choose a deterministic "best" match:
+            #   1. Prefer exact name matches over substring matches.
+            #   2. Among non-exact matches, prefer the shortest library name.
+            #   3. Break remaining ties lexicographically.
+            best_lib = min(
+                candidates,
+                key=lambda lib_name, _base=base: (
+                    lib_name != _base,
+                    len(lib_name),
+                    lib_name,
+                ),
+            )
+            mapping[category] = f"{_COMPONENT_PREFIX_LIB}{best_lib}"
+
+        if mapping:
+            _LOGGER.debug(
+                "Heuristic-to-library redirects: %s",
+                ", ".join(f"{k} -> {v}" for k, v in sorted(mapping.items())),
+            )
+
+        return mapping
+
+    def _parse_map_file(self) -> dict[str, str] | None:
+        """Parse linker map file to build authoritative symbol-to-library mapping.
+
+        The linker map file contains the definitive source attribution for every
+        symbol, including local/static ones that ``nm`` cannot safely export.
+
+        Map file format (GNU ld)::
+
+            .text._mdns_service_task
+                        0x400e9fdc      0x65c  .pioenvs/env/esp-idf/espressif__mdns/libespressif__mdns.a(mdns.c.o)
+
+        Each section entry has a ``.section.symbol_name`` line followed by an
+        indented line with address, size, and source path.
+
+        Returns:
+            Symbol-to-library dict, or ``None`` if no usable map file exists.
+        """
+        map_path = self.elf_path.with_suffix(".map")
+        if not map_path.exists() or map_path.stat().st_size < 10000:
+            return None
+
+        _LOGGER.info("Parsing linker map file: %s", map_path.name)
+
+        try:
+            map_text = map_path.read_text(encoding="utf-8", errors="replace")
+        except OSError as err:
+            _LOGGER.warning("Failed to read map file: %s", err)
+            return None
+
+        symbol_map: dict[str, str] = {}
+        source_symbol_map: dict[str, str] = {}
+        current_symbol: str | None = None
+        section_prefixes = (".text.", ".rodata.", ".data.", ".bss.", ".literal.")
+
+        for line in map_text.splitlines():
+            # Match section.symbol line: " .text.symbol_name"
+            # Single space indent, starts with dot
+            if len(line) > 2 and line[0] == " " and line[1] == ".":
+                stripped = line.strip()
+                for prefix in section_prefixes:
+                    if stripped.startswith(prefix):
+                        current_symbol = stripped[len(prefix) :]
+                        break
+                else:
+                    current_symbol = None
+                continue
+
+            # Match source attribution line: "        0xADDR  0xSIZE  source_path"
+            if current_symbol is None:
+                continue
+
+            fields = line.split()
+            # Skip compiler-generated local names (e.g., packet$19, buf$20)
+            # that can collide across compilation units
+            if (
+                len(fields) >= 3
+                and fields[0].startswith("0x")
+                and fields[1].startswith("0x")
+                and not _COMPILER_LOCAL_PATTERN.match(current_symbol)
+            ):
+                source_path = fields[2]
+                # Check if source path contains a known library directory
+                for dir_key, lib_name in self._lib_hash_to_name.items():
+                    if dir_key in source_path:
+                        symbol_map[current_symbol] = lib_name
+                        break
+                else:
+                    # Map ESPHome source files to components for extern "C"
+                    # and other symbols without C++ namespace
+                    component = self._source_file_to_component(source_path)
+                    if component.startswith(
+                        (_COMPONENT_PREFIX_ESPHOME, _COMPONENT_PREFIX_EXTERNAL)
+                    ):
+                        source_symbol_map[current_symbol] = component
+
+            current_symbol = None
+
+        self._source_symbol_map = source_symbol_map
+        return symbol_map or None
+
+    def _scan_libraries(self) -> None:
+        """Discover third-party libraries and build symbol mapping.
+
+        Scans both PlatformIO ``lib<hex>/`` directories (Arduino builds) and
+        ESP-IDF ``managed_components/`` (IDF builds) to find library archives.
+
+        Uses the linker map file for authoritative symbol attribution when
+        available, falling back to ``nm`` scanning with heuristic redirects.
+        """
+        libraries: dict[str, list[Path]] = {}
+        self._discover_pio_libraries(libraries, self._lib_hash_to_name)
+        self._discover_idf_managed_components(libraries, self._lib_hash_to_name)
+
+        if not libraries:
+            _LOGGER.debug("No third-party libraries found")
+            return
+
+        _LOGGER.info(
+            "Scanning %d libraries: %s",
+            len(libraries),
+            ", ".join(sorted(libraries)),
+        )
+
+        # Heuristic redirect catches local symbols (e.g., mdns_task_buffer$14)
+        # that can't be safely added to the symbol map due to name collisions
+        self._heuristic_to_lib = self._build_heuristic_to_lib_mapping(
+            set(libraries.keys())
+        )
+
+        # Try linker map file first (authoritative, includes local symbols)
+        map_symbols = self._parse_map_file()
+        if map_symbols is not None:
+            self._lib_symbol_map = map_symbols
+            _LOGGER.info(
+                "Built library symbol map from linker map: %d symbols",
+                len(self._lib_symbol_map),
+            )
+            return
+
+        # Fall back to nm scanning (global symbols only)
+        self._lib_symbol_map = self._build_library_symbol_map(libraries)
+
+        _LOGGER.info(
+            "Built library symbol map from nm: %d symbols from %d libraries",
+            len(self._lib_symbol_map),
+            len(libraries),
+        )
+
+    def _scan_source_symbols(self) -> None:
+        """Scan ESPHome source object files to map extern "C" symbols to components.
+
+        When no linker map file is available, this uses ``nm`` to scan ``.o`` files
+        under ``src/`` (including ``src/main.cpp.o`` and everything beneath
+        ``src/esphome/``) and build a symbol-to-component mapping. This catches
+        ``extern "C"`` functions, the ESPHome-generated ``setup()``/``loop()``
+        entry points in ``main.cpp``, and other symbols that lack C++ namespace
+        prefixes.
+
+        Skips scanning if ``_source_symbol_map`` was already populated by
+        ``_parse_map_file()``.
+        """
+        if self._source_symbol_map or not self.nm_path:
+            return
+
+        obj_dir = self._find_object_files_dir()
+        if obj_dir is None:
+            return
+
+        # Scan all ESPHome-owned source object files: src/main.cpp.o and src/esphome/...
+        src_dir = obj_dir / "src"
+        if not src_dir.is_dir():
+            return
+
+        obj_files = sorted(src_dir.rglob("*.o"))
+        if not obj_files:
+            return
+
+        # Run nm with --print-file-name to get file:symbol mapping
+        result = run_tool(
+            [self.nm_path, "--print-file-name", "-g", "--defined-only"]
+            + [str(f) for f in obj_files],
+        )
+        if result is None or result.returncode != 0:
+            _LOGGER.debug("nm scan of source objects failed")
+            return
+
+        self._source_symbol_map = self._parse_nm_source_output(result.stdout, obj_dir)
+        if self._source_symbol_map:
+            _LOGGER.info(
+                "Built source symbol map from nm: %d symbols",
+                len(self._source_symbol_map),
+            )
+
+    def _parse_nm_source_output(self, output: str, base_dir: Path) -> dict[str, str]:
+        """Parse nm output to map non-namespaced symbols to ESPHome components.
+
+        Extracts global defined symbols from ESPHome source object files that
+        don't use C++ namespacing (e.g. ``extern "C"`` functions).
+
+        Args:
+            output: Raw stdout from ``nm --print-file-name -g --defined-only``
+                or ``nm --print-file-name -S``.
+            base_dir: Build directory for computing relative paths.
+
+        Returns:
+            Dict mapping symbol names to component names.
+        """
+        source_map: dict[str, str] = {}
+        for line in output.splitlines():
+            # Format: /path/to/file.o: addr type name
+            #     or: /path/to/file.o: addr size type name (with -S)
+            colon_idx = line.rfind(".o:")
+            if colon_idx == -1:
+                continue
+
+            file_path = line[: colon_idx + 2]
+            fields = line[colon_idx + 3 :].split()
+            if len(fields) < 3:
+                continue
+
+            # With -S flag, format is: addr size type name
+            # Without -S flag: addr type name
+            # type is a single char; size is hex digits
+            # Detect by checking if fields[1] is a single uppercase letter (type)
+            if len(fields[1]) == 1 and fields[1].isalpha():
+                # addr type name
+                sym_type = fields[1]
+                symbol_name = fields[2]
+            elif len(fields) >= 4:
+                # addr size type name
+                sym_type = fields[2]
+                symbol_name = fields[3]
+            else:
+                continue
+
+            # Only global defined symbols (uppercase type)
+            if not sym_type.isupper() or sym_type == "U":
+                continue
+
+            # Skip symbols already in esphome:: namespace
+            if symbol_name.startswith("_ZN7esphome"):
+                continue
+
+            # Make path relative to base_dir for _source_file_to_component
+            try:
+                rel_path = str(Path(file_path).relative_to(base_dir))
+            except ValueError:
+                continue
+
+            component = self._source_file_to_component(rel_path)
+            if component.startswith(
+                (_COMPONENT_PREFIX_ESPHOME, _COMPONENT_PREFIX_EXTERNAL)
+            ):
+                source_map[symbol_name] = component
+
+        return source_map
+
+    def _find_object_files_dir(self) -> Path | None:
+        """Find the directory containing object files for this build.
+
+        Returns:
+            Path to the directory containing .o files, or None if not found.
+        """
+        # The ELF is typically at .pioenvs/<env>/firmware.elf
+        # Object files are in .pioenvs/<env>/src/ and .pioenvs/<env>/lib*/
+        pioenvs_dir = self.elf_path.parent
+        if pioenvs_dir.exists() and any(pioenvs_dir.glob("src/*.o")):
+            return pioenvs_dir
+        return None
+
+    @staticmethod
+    def _parse_nm_cswtch_output(
+        output: str,
+        base_dir: Path | None,
+        cswtch_map: dict[str, list[tuple[str, int]]],
+    ) -> None:
+        """Parse nm output for CSWTCH symbols and add to cswtch_map.
+
+        Handles both ``.o`` files and ``.a`` archives.
+
+        nm output formats::
+
+            .o files:  /path/file.o:hex_addr hex_size type name
+            .a files:  /path/lib.a:member.o:hex_addr hex_size type name
+
+        For ``.o`` files, paths are made relative to *base_dir* when possible.
+        For ``.a`` archives (detected by ``:`` in the file portion), paths are
+        formatted as ``archive_stem/member.o`` (e.g. ``liblwip2-536-feat/lwip-esp.o``).
+
+        Args:
+            output: Raw stdout from ``nm --print-file-name -S``.
+            base_dir: Base directory for computing relative paths of ``.o`` files.
+                      Pass ``None`` when scanning archives outside the build tree.
+            cswtch_map: Dict to populate, mapping ``"CSWTCH$N:size"`` to source list.
+        """
+        for line in output.splitlines():
+            if "CSWTCH$" not in line:
+                continue
+
+            # Split on last ":" that precedes a hex address.
+            # For .o:  "filepath.o" : "hex_addr hex_size type name"
+            # For .a:  "filepath.a:member.o" : "hex_addr hex_size type name"
+            parts_after_colon = line.rsplit(":", 1)
+            if len(parts_after_colon) != 2:
+                continue
+
+            file_path = parts_after_colon[0]
+            fields = parts_after_colon[1].split()
+            # fields: [address, size, type, name]
+            if len(fields) < 4:
+                continue
+
+            sym_name = fields[3]
+            if not sym_name.startswith("CSWTCH$"):
+                continue
+
+            try:
+                size = int(fields[1], 16)
+            except ValueError:
+                continue
+
+            # Determine readable source path
+            # Use ".a:" to detect archive format (not bare ":" which matches
+            # Windows drive letters like "C:\...\file.o").
+            if ".a:" in file_path:
+                # Archive format: "archive.a:member.o" → "archive_stem/member.o"
+                archive_part, member = file_path.rsplit(":", 1)
+                archive_name = Path(archive_part).stem
+                rel_path = f"{archive_name}/{member}"
+            elif base_dir is not None:
+                try:
+                    rel_path = str(Path(file_path).relative_to(base_dir))
+                except ValueError:
+                    rel_path = file_path
+            else:
+                rel_path = file_path
+
+            key = f"{sym_name}:{size}"
+            cswtch_map[key].append((rel_path, size))
+
+    def _run_nm_cswtch_scan(
+        self,
+        files: list[Path],
+        base_dir: Path | None,
+        cswtch_map: dict[str, list[tuple[str, int]]],
+    ) -> None:
+        """Run nm on *files* and add any CSWTCH symbols to *cswtch_map*.
+
+        Args:
+            files: Object (``.o``) or archive (``.a``) files to scan.
+            base_dir: Base directory for relative path computation (see
+                      :meth:`_parse_nm_cswtch_output`).
+            cswtch_map: Dict to populate with results.
+        """
+        if not self.nm_path or not files:
+            return
+
+        _LOGGER.debug("Scanning %d files for CSWTCH symbols", len(files))
+
+        result = run_tool(
+            [self.nm_path, "--print-file-name", "-S"] + [str(f) for f in files],
+            timeout=30,
+        )
+        if result is None or result.returncode != 0:
+            _LOGGER.debug(
+                "nm failed or timed out scanning %d files for CSWTCH symbols",
+                len(files),
+            )
+            return
+
+        self._parse_nm_cswtch_output(result.stdout, base_dir, cswtch_map)
+
+    def _scan_cswtch_in_sdk_archives(
+        self, cswtch_map: dict[str, list[tuple[str, int]]]
+    ) -> None:
+        """Scan SDK library archives (.a) for CSWTCH symbols.
+
+        Prebuilt SDK libraries (e.g. lwip, bearssl) are not compiled from source,
+        so their CSWTCH symbols only exist inside ``.a`` archives.  Results are
+        merged into *cswtch_map* for keys not already found in ``.o`` files.
+
+        The same source file (e.g. ``lwip-esp.o``) often appears in multiple
+        library variants (``liblwip2-536.a``, ``liblwip2-1460-feat.a``, etc.),
+        so results are deduplicated by member name.
+        """
+        sdk_dirs = self._find_sdk_library_dirs()
+        if not sdk_dirs:
+            return
+
+        sdk_archives = sorted(a for sdk_dir in sdk_dirs for a in sdk_dir.glob("*.a"))
+
+        sdk_map: dict[str, list[tuple[str, int]]] = defaultdict(list)
+        self._run_nm_cswtch_scan(sdk_archives, None, sdk_map)
+
+        # Merge SDK results, deduplicating by member name.
+        for key, sources in sdk_map.items():
+            if key in cswtch_map:
+                continue
+            seen: dict[str, tuple[str, int]] = {}
+            for path, sz in sources:
+                member = Path(path).name
+                if member not in seen:
+                    seen[member] = (path, sz)
+            cswtch_map[key] = list(seen.values())
+
+    def _source_file_to_component(self, source_file: str) -> str:
+        """Map a source object file path to its component name.
+
+        Args:
+            source_file: Relative path like 'src/esphome/components/wifi/wifi_component.cpp.o'
+
+        Returns:
+            Component name like '[esphome]wifi' or the source file if unknown.
+        """
+        parts = Path(source_file).parts
+
+        # ESPHome component: src/esphome/components/<name>/...
+        if "components" in parts:
+            idx = parts.index("components")
+            if idx + 1 < len(parts):
+                component_name = parts[idx + 1]
+                if component_name in get_esphome_components():
+                    return f"{_COMPONENT_PREFIX_ESPHOME}{component_name}"
+                if component_name in self.external_components:
+                    return f"{_COMPONENT_PREFIX_EXTERNAL}{component_name}"
+
+        # ESPHome-generated entry point: src/main.cpp.o (contains setup()/loop())
+        if len(parts) >= 2 and parts[-2:] == ("src", "main.cpp.o"):
+            return _COMPONENT_CORE
+
+        # ESPHome core: src/esphome/core/... or src/esphome/...
+        if "core" in parts and "esphome" in parts:
+            return _COMPONENT_CORE
+        if "esphome" in parts and "components" not in parts:
+            return _COMPONENT_CORE
+
+        # Framework/library files - check for PlatformIO library hash dirs
+        # e.g., lib65b/ESPAsyncTCP/... -> [lib]espasynctcp
+        if parts and parts[0] in self._lib_hash_to_name:
+            return f"{_COMPONENT_PREFIX_LIB}{self._lib_hash_to_name[parts[0]]}"
+
+        # ESP-IDF managed components: managed_components/espressif__mdns/... -> [lib]mdns
+        if (
+            len(parts) >= 2
+            and parts[0] == "managed_components"
+            and parts[1] in self._lib_hash_to_name
+        ):
+            return f"{_COMPONENT_PREFIX_LIB}{self._lib_hash_to_name[parts[1]]}"
+
+        # Other framework/library files - return the first path component
+        # e.g., FrameworkArduino/... -> FrameworkArduino
+        return parts[0] if parts else source_file
+
+    def _analyze_cswtch_symbols(self) -> None:
+        """Analyze CSWTCH (GCC switch table) symbols by tracing to source objects.
+
+        CSWTCH symbols are compiler-generated lookup tables for switch statements.
+        They are local symbols, so the same name can appear in different object files.
+        This method scans .o files and SDK archives to attribute them to their
+        source components.
+        """
+        obj_dir = self._find_object_files_dir()
+        if obj_dir is None:
+            _LOGGER.debug("No object files directory found, skipping CSWTCH analysis")
+            return
+
+        # Scan build-dir object files for CSWTCH symbols
+        cswtch_map: dict[str, list[tuple[str, int]]] = defaultdict(list)
+        self._run_nm_cswtch_scan(sorted(obj_dir.rglob("*.o")), obj_dir, cswtch_map)
+
+        # Also scan SDK library archives (.a) for CSWTCH symbols.
+        # Prebuilt SDK libraries (e.g. lwip, bearssl) are not compiled from source
+        # so their symbols only exist inside .a archives, not as loose .o files.
+        self._scan_cswtch_in_sdk_archives(cswtch_map)
+
+        if not cswtch_map:
+            _LOGGER.debug("No CSWTCH symbols found in object files or SDK archives")
+            return
+
+        # Collect CSWTCH symbols from the ELF (already parsed in sections)
+        # Include section_name for re-attribution of component totals
+        elf_cswtch = [
+            (symbol_name, size, section_name)
+            for section_name, section in self.sections.items()
+            for symbol_name, size, _ in section.symbols
+            if symbol_name.startswith("CSWTCH$")
+        ]
+
+        _LOGGER.debug(
+            "Found %d CSWTCH symbols in ELF, %d unique in object files",
+            len(elf_cswtch),
+            len(cswtch_map),
+        )
+
+        # Match ELF CSWTCH symbols to source files and re-attribute component totals.
+        # _categorize_symbols() already ran and put these into "other" since CSWTCH$
+        # names don't match any component pattern. We move the bytes to the correct
+        # component based on the object file mapping.
+        other_mem = self.components.get("other")
+
+        for sym_name, size, section_name in elf_cswtch:
+            key = f"{sym_name}:{size}"
+            sources = cswtch_map.get(key, [])
+
+            if len(sources) == 1:
+                source_file = sources[0][0]
+                component = self._source_file_to_component(source_file)
+            elif len(sources) > 1:
+                # Ambiguous - multiple object files have same CSWTCH name+size
+                source_file = "ambiguous"
+                component = "ambiguous"
+                _LOGGER.debug(
+                    "Ambiguous CSWTCH %s (%d B) found in %d files: %s",
+                    sym_name,
+                    size,
+                    len(sources),
+                    ", ".join(src for src, _ in sources),
+                )
+            else:
+                source_file = "unknown"
+                component = "unknown"
+
+            self._cswtch_symbols.append((sym_name, size, source_file, component))
+
+            # Re-attribute from "other" to the correct component
+            if (
+                component not in ("other", "unknown", "ambiguous")
+                and other_mem is not None
+            ):
+                other_mem.add_section_size(section_name, -size)
+                if component not in self.components:
+                    self.components[component] = ComponentMemory(component)
+                self.components[component].add_section_size(section_name, size)
+
+        # Sort by size descending
+        self._cswtch_symbols.sort(key=lambda x: x[1], reverse=True)
+
+        total_size = sum(size for _, size, _, _ in self._cswtch_symbols)
+        _LOGGER.debug(
+            "CSWTCH analysis: %d symbols, %d bytes total",
+            len(self._cswtch_symbols),
+            total_size,
+        )
+
+    def _analyze_function_calls(self) -> None:
+        """Count function call sites by parsing disassembly output.
+
+        Parses direct call instructions (call0/call8/bl/blx) from objdump -d
+        to count how many times each function is called. This helps identify
+        inlining candidates — frequently called small functions benefit most
+        from inlining.
+        """
+        result = run_tool(
+            [self.objdump_path, "-d", str(self.elf_path)],
+            timeout=60,
+        )
+        if result is None or result.returncode != 0:
+            _LOGGER.debug("Failed to disassemble ELF for function call analysis")
+            return
+
+        self._function_call_counts = Counter(
+            match.group(1)
+            for line in result.stdout.splitlines()
+            if (match := _CALL_TARGET_PATTERN.search(line))
+        )
+
+        # Demangle any call targets not already in the cache
+        missing = [
+            name
+            for name in self._function_call_counts
+            if name not in self._demangle_cache
+        ]
+        if missing:
+            self._batch_demangle_symbols(missing)
+
+        _LOGGER.debug(
+            "Function call analysis: %d unique targets, %d total calls",
+            len(self._function_call_counts),
+            sum(self._function_call_counts.values()),
+        )
+
     def get_unattributed_ram(self) -> tuple[int, int, int]:
         """Get unattributed RAM sizes (SDK/framework overhead).
 

esphome/analyze_memory/cli.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 
 from collections import defaultdict
 from collections.abc import Callable
+import heapq
+from operator import itemgetter
 import sys
 from typing import TYPE_CHECKING
 
@@ -12,6 +14,8 @@ from . import (
     _COMPONENT_CORE,
     _COMPONENT_PREFIX_ESPHOME,
     _COMPONENT_PREFIX_EXTERNAL,
+    _COMPONENT_PREFIX_LIB,
+    _PSTORAGE_SUFFIX,
     RAM_SECTIONS,
     MemoryAnalyzer,
 )
@@ -20,6 +24,17 @@ if TYPE_CHECKING:
     from . import ComponentMemory
 
 
+def _format_pstorage_name(name: str) -> str:
+    """Format a __pstorage symbol as 'storage for {id}'."""
+    if not name.endswith(_PSTORAGE_SUFFIX):
+        return name
+    prefix = name[: -len(_PSTORAGE_SUFFIX)]
+    # Strip component namespace prefix: {component}__{id} -> {id}
+    dunder_pos = prefix.find("__")
+    var_id = prefix[dunder_pos + 2 :] if dunder_pos != -1 else prefix
+    return f"storage for {var_id}"
+
+
 class MemoryAnalyzerCLI(MemoryAnalyzer):
     """Memory analyzer with CLI-specific report generation."""
 
@@ -29,6 +44,10 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
     )
     # Lower threshold for RAM symbols (RAM is more constrained)
     RAM_SYMBOL_SIZE_THRESHOLD: int = 24
+    # Number of top symbols to show in the largest symbols report
+    TOP_SYMBOLS_LIMIT: int = 30
+    # Width for symbol name display in top symbols report
+    COL_TOP_SYMBOL_NAME: int = 55
 
     # Column width constants
     COL_COMPONENT: int = 29
@@ -141,11 +160,197 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
         If section is one of the RAM sections (.data or .bss), a label like
         " [data]" or " [bss]" is appended. For non-RAM sections or when
         section is None, no section label is added.
+
+        Placement new storage symbols are formatted as "storage for {id}".
         """
+        display_name = _format_pstorage_name(demangled)
         section_label = ""
         if section in RAM_SECTIONS:
             section_label = f" [{section[1:]}]"  # .data -> [data], .bss -> [bss]
-        return f"{demangled} ({size:,} B){section_label}"
+        return f"{display_name} ({size:,} B){section_label}"
+
+    def _add_top_symbols(self, lines: list[str]) -> None:
+        """Add a section showing the top largest symbols in the binary."""
+        # Collect all symbols from all components: (symbol, demangled, size, section, component)
+        all_symbols = [
+            (symbol, demangled, size, section, component)
+            for component, symbols in self._component_symbols.items()
+            for symbol, demangled, size, section in symbols
+        ]
+
+        # Get top N symbols by size using heapq for efficiency
+        top_symbols = heapq.nlargest(
+            self.TOP_SYMBOLS_LIMIT, all_symbols, key=itemgetter(2)
+        )
+
+        lines.append("")
+        lines.append(f"Top {self.TOP_SYMBOLS_LIMIT} Largest Symbols:")
+        # Calculate truncation limit from column width (leaving room for "...")
+        truncate_limit = self.COL_TOP_SYMBOL_NAME - 3
+        for i, (_, demangled, size, section, component) in enumerate(top_symbols):
+            # Format section label
+            section_label = f"[{section[1:]}]" if section else ""
+            # Format storage symbols readably
+            display_name = _format_pstorage_name(demangled)
+            # Truncate if too long
+            demangled_display = (
+                f"{display_name[:truncate_limit]}..."
+                if len(display_name) > self.COL_TOP_SYMBOL_NAME
+                else display_name
+            )
+            lines.append(
+                f"{i + 1:>2}. {size:>7,} B {section_label:<8} {demangled_display:<{self.COL_TOP_SYMBOL_NAME}} {component}"
+            )
+
+    def _add_cswtch_analysis(self, lines: list[str]) -> None:
+        """Add CSWTCH (GCC switch table lookup) analysis section."""
+        self._add_section_header(lines, "CSWTCH Analysis (GCC Switch Table Lookups)")
+
+        total_size = sum(size for _, size, _, _ in self._cswtch_symbols)
+        lines.append(
+            f"Total: {len(self._cswtch_symbols)} switch table(s), {total_size:,} B"
+        )
+        lines.append("")
+
+        # Group by component
+        by_component: dict[str, list[tuple[str, int, str]]] = defaultdict(list)
+        for sym_name, size, source_file, component in self._cswtch_symbols:
+            by_component[component].append((sym_name, size, source_file))
+
+        # Sort components by total size descending
+        sorted_components = sorted(
+            by_component.items(),
+            key=lambda x: sum(s[1] for s in x[1]),
+            reverse=True,
+        )
+
+        for component, symbols in sorted_components:
+            comp_total = sum(s[1] for s in symbols)
+            lines.append(f"{component} ({comp_total:,} B, {len(symbols)} tables):")
+
+            # Group by source file within component
+            by_file: dict[str, list[tuple[str, int]]] = defaultdict(list)
+            for sym_name, size, source_file in symbols:
+                by_file[source_file].append((sym_name, size))
+
+            for source_file, file_symbols in sorted(
+                by_file.items(),
+                key=lambda x: sum(s[1] for s in x[1]),
+                reverse=True,
+            ):
+                file_total = sum(s[1] for s in file_symbols)
+                lines.append(
+                    f"  {source_file} ({file_total:,} B, {len(file_symbols)} tables)"
+                )
+                for sym_name, size in sorted(
+                    file_symbols, key=lambda x: x[1], reverse=True
+                ):
+                    lines.append(f"    {size:>6,} B  {sym_name}")
+            lines.append("")
+
+    # Number of top called functions to show
+    TOP_CALLS_LIMIT: int = 50
+    # Number of inlining candidates to show
+    INLINE_CANDIDATES_LIMIT: int = 25
+    # Maximum function size in bytes to consider for inlining
+    INLINE_SIZE_THRESHOLD: int = 16
+
+    def _build_symbol_sizes(self) -> dict[str, int]:
+        """Build a size lookup from all component symbols: mangled_name -> size."""
+        return {
+            symbol: size
+            for symbols in self._component_symbols.values()
+            for symbol, _, size, _ in symbols
+        }
+
+    def _format_call_row(
+        self, index: int, mangled: str, count: int, symbol_sizes: dict[str, int]
+    ) -> str:
+        """Format a single row for call frequency tables."""
+        demangled = self._demangle_cache.get(mangled, mangled)
+        if len(demangled) > 80:
+            demangled = f"{demangled[:77]}..."
+        size = symbol_sizes.get(mangled)
+        size_str = f"{size:>5,} B" if size is not None else "      ?"
+        return f"{index:>3}  {count:>5}  {size_str}  {demangled}"
+
+    def _add_call_table_header(self, lines: list[str]) -> None:
+        """Add the header row for call frequency tables."""
+        lines.append(f"{'#':>3}  {'Calls':>5}  {'Size':>7}  Function")
+        lines.append(f"{'---':>3}  {'-----':>5}  {'-------':>7}  {'-' * 60}")
+
+    def _add_function_call_analysis(self, lines: list[str]) -> None:
+        """Add function call frequency analysis section.
+
+        Shows the most frequently called functions by call site count.
+        """
+        self._add_section_header(lines, "Top Called Functions")
+
+        symbol_sizes = self._build_symbol_sizes()
+
+        # Sort by call count descending
+        sorted_calls = sorted(
+            self._function_call_counts.items(), key=lambda x: x[1], reverse=True
+        )
+
+        self._add_call_table_header(lines)
+
+        for i, (mangled, count) in enumerate(sorted_calls[: self.TOP_CALLS_LIMIT]):
+            lines.append(self._format_call_row(i + 1, mangled, count, symbol_sizes))
+
+        total_calls = sum(self._function_call_counts.values())
+        lines.append("")
+        lines.append(
+            f"Total: {len(self._function_call_counts)} unique targets, "
+            f"{total_calls:,} call sites"
+        )
+        lines.append("")
+
+    def _add_inline_candidates(self, lines: list[str]) -> None:
+        """Add inlining candidates section.
+
+        Shows frequently called functions that are small enough to benefit
+        from inlining (< 16 bytes). These are the best candidates for
+        reducing call overhead.
+        """
+        self._add_section_header(
+            lines,
+            f"Inlining Candidates (<{self.INLINE_SIZE_THRESHOLD} B, by call count)",
+        )
+
+        symbol_sizes = self._build_symbol_sizes()
+
+        # Filter to small functions with known size, sort by call count
+        candidates = sorted(
+            (
+                (mangled, count)
+                for mangled, count in self._function_call_counts.items()
+                if mangled in symbol_sizes
+                and symbol_sizes[mangled] < self.INLINE_SIZE_THRESHOLD
+            ),
+            key=lambda x: x[1],
+            reverse=True,
+        )
+
+        if not candidates:
+            lines.append("No candidates found.")
+            lines.append("")
+            return
+
+        self._add_call_table_header(lines)
+
+        for i, (mangled, count) in enumerate(
+            candidates[: self.INLINE_CANDIDATES_LIMIT]
+        ):
+            lines.append(self._format_call_row(i + 1, mangled, count, symbol_sizes))
+
+        lines.append("")
+        lines.append(
+            f"Showing top {min(len(candidates), self.INLINE_CANDIDATES_LIMIT)} "
+            f"of {len(candidates)} functions under "
+            f"{self.INLINE_SIZE_THRESHOLD} B"
+        )
+        lines.append("")
 
     def generate_report(self, detailed: bool = False) -> str:
         """Generate a formatted memory report."""
@@ -248,6 +453,9 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
             "RAM",
         )
 
+        # Top largest symbols in the binary
+        self._add_top_symbols(lines)
+
         # Add ESPHome core detailed analysis if there are core symbols
         if self._esphome_core_symbols:
             self._add_section_header(lines, f"{_COMPONENT_CORE} Detailed Analysis")
@@ -321,6 +529,11 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
             for name, mem in components
             if name.startswith(_COMPONENT_PREFIX_EXTERNAL)
         ]
+        library_components = [
+            (name, mem)
+            for name, mem in components
+            if name.startswith(_COMPONENT_PREFIX_LIB)
+        ]
 
         top_esphome_components = sorted(
             esphome_components, key=lambda x: x[1].flash_total, reverse=True
@@ -331,6 +544,11 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
             external_components, key=lambda x: x[1].flash_total, reverse=True
         )
 
+        # Include all library components
+        top_library_components = sorted(
+            library_components, key=lambda x: x[1].flash_total, reverse=True
+        )
+
         # Check if API component exists and ensure it's included
         api_component = None
         for name, mem in components:
@@ -349,10 +567,11 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
             if name in system_components_to_include
         ]
 
-        # Combine all components to analyze: top ESPHome + all external + API if not already included + system components
+        # Combine all components to analyze: top ESPHome + all external + libraries + API if not already included + system components
         components_to_analyze = (
             list(top_esphome_components)
             + list(top_external_components)
+            + list(top_library_components)
             + system_components
         )
         if api_component and api_component not in components_to_analyze:
@@ -371,15 +590,16 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
                 lines.append(f"Total size: {comp_mem.flash_total:,} B")
                 lines.append("")
 
-                # Show all symbols above threshold for better visibility
+                # Show symbols above threshold, always include storage symbols
                 large_symbols = [
                     (sym, dem, size, sec)
                     for sym, dem, size, sec in sorted_symbols
                     if size > self.SYMBOL_SIZE_THRESHOLD
+                    or dem.endswith(_PSTORAGE_SUFFIX)
                 ]
 
                 lines.append(
-                    f"{comp_name} Symbols > {self.SYMBOL_SIZE_THRESHOLD} B ({len(large_symbols)} symbols):"
+                    f"{comp_name} Symbols > {self.SYMBOL_SIZE_THRESHOLD} B & storage ({len(large_symbols)} symbols):"
                 )
                 for i, (symbol, demangled, size, section) in enumerate(large_symbols):
                     lines.append(
@@ -402,7 +622,10 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
             # Sort by size descending
             sorted_ram_syms = sorted(ram_syms, key=lambda x: x[2], reverse=True)
             large_ram_syms = [
-                s for s in sorted_ram_syms if s[2] > self.RAM_SYMBOL_SIZE_THRESHOLD
+                s
+                for s in sorted_ram_syms
+                if s[2] > self.RAM_SYMBOL_SIZE_THRESHOLD
+                or s[1].endswith(_PSTORAGE_SUFFIX)
             ]
 
             lines.append(f"{name} ({mem.ram_total:,} B total RAM):")
@@ -420,17 +643,27 @@ class MemoryAnalyzerCLI(MemoryAnalyzer):
                 for symbol, demangled, size, section in large_ram_syms[:10]:
                     # Format section label consistently by stripping leading dot
                     section_label = section.lstrip(".") if section else ""
+                    display_name = _format_pstorage_name(demangled)
                     # Add ellipsis if name is truncated
-                    demangled_display = (
-                        f"{demangled[:70]}..." if len(demangled) > 70 else demangled
-                    )
-                    lines.append(
-                        f"    {size:>6,} B [{section_label}] {demangled_display}"
+                    display_name = (
+                        f"{display_name[:70]}..."
+                        if len(display_name) > 70
+                        else display_name
                     )
+                    lines.append(f"    {size:>6,} B [{section_label}] {display_name}")
                 if len(large_ram_syms) > 10:
                     lines.append(f"    ... and {len(large_ram_syms) - 10} more")
             lines.append("")
 
+        # CSWTCH (GCC switch table) analysis
+        if self._cswtch_symbols:
+            self._add_cswtch_analysis(lines)
+
+        # Function call frequency analysis
+        if self._function_call_counts:
+            self._add_function_call_analysis(lines)
+            self._add_inline_candidates(lines)
+
         lines.append(
             "Note: This analysis covers symbols in the ELF file. Some runtime allocations may not be included."
         )
@@ -506,7 +739,7 @@ def main():
     import json
     from pathlib import Path
 
-    from esphome.platformio_api import IDEData
+    from esphome.platformio.toolchain import IDEData
 
     build_path = Path(build_dir)
 

esphome/analyze_memory/const.py

@@ -9,20 +9,61 @@ ESPHOME_COMPONENT_PATTERN = re.compile(r"esphome::([a-zA-Z0-9_]+)::")
 # Maps standard section names to their various platform-specific variants
 # Note: Order matters! More specific patterns (.bss) must come before general ones (.dram)
 # because ESP-IDF uses names like ".dram0.bss" which would match ".dram" otherwise
+#
+# Platform-specific sections:
+# - ESP8266/ESP32: .iram*, .dram*
+# - LibreTiny RTL87xx: .xip.code_* (flash), .ram.code_* (RAM)
+# - LibreTiny BK7231: .itcm.code (fast RAM), .vectors (interrupt vectors)
+# - LibreTiny LN882X: .flash_text, .flash_copy* (flash code)
+# - Zephyr/nRF52: text, rodata, datas, bss (no leading dots)
 SECTION_MAPPING = {
-    ".text": frozenset([".text", ".iram"]),
-    ".rodata": frozenset([".rodata"]),
-    ".bss": frozenset([".bss"]),  # Must be before .data to catch ".dram0.bss"
-    ".data": frozenset([".data", ".dram"]),
-}
-
-# Section to ComponentMemory attribute mapping
-# Maps section names to the attribute name in ComponentMemory dataclass
-SECTION_TO_ATTR = {
-    ".text": "text_size",
-    ".rodata": "rodata_size",
-    ".data": "data_size",
-    ".bss": "bss_size",
+    ".text": frozenset(
+        [
+            ".text",
+            ".iram",
+            # LibreTiny RTL87xx XIP (eXecute In Place) flash code
+            ".xip.code",
+            # LibreTiny RTL87xx RAM code
+            ".ram.code_text",
+            # LibreTiny BK7231 fast RAM code and vectors
+            ".itcm.code",
+            ".vectors",
+            # LibreTiny LN882X flash code
+            ".flash_text",
+            ".flash_copy",
+            # Zephyr/nRF52 sections (no leading dots)
+            "text",
+            "rom_start",
+        ]
+    ),
+    ".rodata": frozenset(
+        [
+            ".rodata",
+            # LibreTiny RTL87xx read-only data in RAM
+            ".ram.code_rodata",
+            # Zephyr/nRF52 sections (no leading dots)
+            "rodata",
+        ]
+    ),
+    # .bss patterns - must be before .data to catch ".dram0.bss"
+    ".bss": frozenset(
+        [
+            ".bss",
+            # LibreTiny LN882X BSS
+            ".bss_ram",
+            # Zephyr/nRF52 sections (no leading dots)
+            "bss",
+            "noinit",
+        ]
+    ),
+    ".data": frozenset(
+        [
+            ".data",
+            ".dram",
+            # Zephyr/nRF52 sections (no leading dots)
+            "datas",
+        ]
+    ),
 }
 
 # Component identification rules
@@ -215,7 +256,7 @@ SYMBOL_PATTERNS = {
     "ipv6_stack": ["nd6_", "ip6_", "mld6_", "icmp6_", "icmp6_input"],
     # Order matters! More specific categories must come before general ones.
     # mdns must come before bluetooth to avoid "_mdns_disable_pcb" matching "ble_" pattern
-    "mdns_lib": ["mdns"],
+    "mdns_lib": ["mdns", "packet$"],
     # memory_mgmt must come before wifi_stack to catch mmu_hal_* symbols
     "memory_mgmt": [
         "mem_",
@@ -367,7 +408,6 @@ SYMBOL_PATTERNS = {
     ],
     "arduino_core": [
         "pinMode",
-        "resetPins",
         "millis",
         "micros",
         "delay(",  # More specific - Arduino delay function with parenthesis
@@ -463,7 +503,9 @@ SYMBOL_PATTERNS = {
         "__FUNCTION__$",
         "DAYS_IN_MONTH",
         "_DAYS_BEFORE_MONTH",
-        "CSWTCH$",
+        # Note: CSWTCH$ symbols are GCC switch table lookup tables.
+        # They are attributed to their source object files via _analyze_cswtch_symbols()
+        # rather than being lumped into libc.
         "dst$",
         "sulp",
         "_strtol_l",  # String to long with locale
@@ -751,7 +793,6 @@ SYMBOL_PATTERNS = {
         "s_dp",
         "s_ni",
         "s_reg_dump",
-        "packet$",
         "d_mult_table",
         "K",
         "fcstab",

esphome/analyze_memory/helpers.py

@@ -94,13 +94,13 @@ def parse_symbol_line(line: str) -> tuple[str, str, int, str] | None:
         return None
 
     # Find section, size, and name
+    # Try each part as a potential section name
     for i, part in enumerate(parts):
-        if not part.startswith("."):
-            continue
-
+        # Skip parts that are clearly flags, addresses, or other metadata
+        # Sections start with '.' (standard ELF) or are known section names (Zephyr)
         section = map_section_name(part)
         if not section:
-            break
+            continue
 
         # Need at least size field after section
         if i + 1 >= len(parts):

esphome/analyze_memory/toolchain.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import os
 from pathlib import Path
 import subprocess
 from typing import TYPE_CHECKING
@@ -17,10 +18,82 @@ TOOLCHAIN_PREFIXES = [
     "xtensa-lx106-elf-",  # ESP8266
     "xtensa-esp32-elf-",  # ESP32
     "xtensa-esp-elf-",  # ESP32 (newer IDF)
+    "arm-zephyr-eabi-",  # nRF52/Zephyr SDK
+    "arm-none-eabi-",  # Generic ARM (RP2040, etc.)
     "",  # System default (no prefix)
 ]
 
 
+def _find_in_platformio_packages(tool_name: str) -> str | None:
+    """Search for a tool in PlatformIO package directories.
+
+    This handles cases like Zephyr SDK where tools are installed in nested
+    directories that aren't in PATH.
+
+    Args:
+        tool_name: Name of the tool (e.g., "readelf", "objdump")
+
+    Returns:
+        Full path to the tool or None if not found
+    """
+    # Get PlatformIO packages directory
+    platformio_home = Path(os.path.expanduser("~/.platformio/packages"))
+    if not platformio_home.exists():
+        return None
+
+    # Search patterns for toolchains that might contain the tool
+    # Order matters - more specific patterns first
+    search_patterns = [
+        # Zephyr SDK deeply nested structure (4 levels)
+        # e.g., toolchain-gccarmnoneeabi/zephyr-sdk-0.17.4/arm-zephyr-eabi/bin/arm-zephyr-eabi-objdump
+        f"toolchain-*/*/*/bin/*-{tool_name}",
+        # Zephyr SDK nested structure (3 levels)
+        f"toolchain-*/*/bin/*-{tool_name}",
+        f"toolchain-*/bin/*-{tool_name}",
+        # Standard PlatformIO toolchain structure
+        f"toolchain-*/bin/*{tool_name}",
+    ]
+
+    for pattern in search_patterns:
+        matches = list(platformio_home.glob(pattern))
+        if matches:
+            # Sort to get consistent results, prefer arm-zephyr-eabi over arm-none-eabi
+            matches.sort(key=lambda p: ("zephyr" not in str(p), str(p)))
+            tool_path = str(matches[0])
+            _LOGGER.debug("Found %s in PlatformIO packages: %s", tool_name, tool_path)
+            return tool_path
+
+    return None
+
+
+def resolve_tool_path(
+    tool_name: str,
+    derived_path: str | None,
+    objdump_path: str | None = None,
+) -> str | None:
+    """Resolve a tool path, falling back to find_tool if derived path doesn't exist.
+
+    Args:
+        tool_name: Name of the tool (e.g., "objdump", "readelf")
+        derived_path: Path derived from idedata (may not exist for some platforms)
+        objdump_path: Path to objdump binary to derive other tool paths from
+
+    Returns:
+        Resolved path to the tool, or the original derived_path if it exists
+    """
+    if derived_path and not Path(derived_path).exists():
+        found = find_tool(tool_name, objdump_path)
+        if found:
+            _LOGGER.debug(
+                "Derived %s path %s not found, using %s",
+                tool_name,
+                derived_path,
+                found,
+            )
+            return found
+    return derived_path
+
+
 def find_tool(
     tool_name: str,
     objdump_path: str | None = None,
@@ -28,7 +101,8 @@ def find_tool(
     """Find a toolchain tool by name.
 
     First tries to derive the tool path from objdump_path (if provided),
-    then falls back to searching for platform-specific tools.
+    then searches PlatformIO package directories (for cross-compile toolchains),
+    and finally falls back to searching for platform-specific tools in PATH.
 
     Args:
         tool_name: Name of the tool (e.g., "objdump", "nm", "c++filt")
@@ -47,7 +121,13 @@ def find_tool(
             _LOGGER.debug("Found %s at: %s", tool_name, potential_path)
             return potential_path
 
-    # Try platform-specific tools
+    # Search in PlatformIO packages directory first (handles Zephyr SDK, etc.)
+    # This must come before PATH search because system tools (e.g., /usr/bin/objdump)
+    # are for the host architecture, not the target (ARM, Xtensa, etc.)
+    if found := _find_in_platformio_packages(tool_name):
+        return found
+
+    # Try platform-specific tools in PATH (fallback for when tools are installed globally)
     for prefix in TOOLCHAIN_PREFIXES:
         cmd = f"{prefix}{tool_name}"
         try:

esphome/async_thread.py

@@ -0,0 +1,56 @@
+"""Helpers for running an async coroutine from sync code via a daemon thread.
+
+``asyncio.run(coro())`` in the main thread blocks until the loop's cleanup
+cycle finishes, which can add hundreds of milliseconds before the caller
+receives the result. Running the loop in a daemon thread lets the caller
+observe the result as soon as the coroutine completes while cleanup finishes
+in the background.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from collections.abc import Awaitable, Callable
+import threading
+from typing import Generic, TypeVar
+
+_T = TypeVar("_T")
+
+
+class AsyncThreadRunner(threading.Thread, Generic[_T]):
+    """Run an async coroutine in a daemon thread and expose its result.
+
+    The runner catches all exceptions from the coroutine and stores them in
+    ``exception`` so ``event`` is always set — this prevents callers waiting
+    on ``event`` from hanging forever when the coroutine crashes.
+
+    Typical usage::
+
+        runner = AsyncThreadRunner(lambda: my_coro(arg))
+        runner.start()
+        if not runner.event.wait(timeout=5.0):
+            ...  # timed out
+        if runner.exception is not None:
+            raise runner.exception
+        result = runner.result
+    """
+
+    def __init__(self, coro_factory: Callable[[], Awaitable[_T]]) -> None:
+        super().__init__(daemon=True)
+        self._coro_factory = coro_factory
+        self.result: _T | None = None
+        self.exception: BaseException | None = None
+        self.event = threading.Event()
+
+    async def _runner(self) -> None:
+        try:
+            self.result = await self._coro_factory()
+        except Exception as exc:  # pylint: disable=broad-except
+            # Capture all exceptions so ``event`` is always set — otherwise a
+            # crash would hang the waiter forever.
+            self.exception = exc
+        finally:
+            self.event.set()
+
+    def run(self) -> None:
+        asyncio.run(self._runner())

esphome/automation.py

@@ -1,3 +1,6 @@
+from dataclasses import dataclass, field
+import logging
+
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import (
@@ -57,8 +60,42 @@ def maybe_conf(conf, *validators):
     return validate
 
 
-def register_action(name: str, action_type: MockObjClass, schema: cv.Schema):
-    return ACTION_REGISTRY.register(name, action_type, schema)
+_LOGGER = logging.getLogger(__name__)
+
+
+def register_action(
+    name: str,
+    action_type: MockObjClass,
+    schema: cv.Schema,
+    *,
+    synchronous: bool | None = None,
+):
+    """Register an action type.
+
+    All callers must pass ``synchronous`` explicitly.
+
+    ``synchronous=True`` — the action never defers ``play_next_()`` to a
+    later point (callback, timer, or ``loop()``).  Trigger arguments are
+    only used during the initial call, so string args can use non-owning
+    StringRef for zero-copy access.
+
+    ``synchronous=False`` — the action defers ``play_next_()`` via a
+    callback, timer, or ``Component::loop()``.  Trigger arguments must
+    outlive the initial call, so string args use owning std::string to
+    prevent dangling references.
+    """
+    if synchronous is None:
+        _LOGGER.warning(
+            "register_action('%s', ...) is missing the synchronous= parameter. "
+            "Defaulting to synchronous=False (safe but prevents StringRef "
+            "optimization). Check the C++ class: use synchronous=False if "
+            "play_next_() is deferred to a callback, timer, or loop(); "
+            "use synchronous=True if play_next_() always runs before the "
+            "initial play/play_complex call returns",
+            name,
+        )
+        synchronous = False
+    return ACTION_REGISTRY.register(name, action_type, schema, synchronous=synchronous)
 
 
 def register_condition(name: str, condition_type: MockObjClass, schema: cv.Schema):
@@ -90,7 +127,7 @@ def validate_potentially_or_condition(value):
     return validate_condition(value)
 
 
-DelayAction = cg.esphome_ns.class_("DelayAction", Action, cg.Component)
+DelayAction = cg.esphome_ns.class_("DelayAction", Action)
 LambdaAction = cg.esphome_ns.class_("LambdaAction", Action)
 StatelessLambdaAction = cg.esphome_ns.class_("StatelessLambdaAction", Action)
 IfAction = cg.esphome_ns.class_("IfAction", Action)
@@ -101,6 +138,9 @@ UpdateComponentAction = cg.esphome_ns.class_("UpdateComponentAction", Action)
 SuspendComponentAction = cg.esphome_ns.class_("SuspendComponentAction", Action)
 ResumeComponentAction = cg.esphome_ns.class_("ResumeComponentAction", Action)
 Automation = cg.esphome_ns.class_("Automation")
+TriggerForwarder = cg.esphome_ns.class_("TriggerForwarder")
+TriggerOnTrueForwarder = cg.esphome_ns.class_("TriggerOnTrueForwarder")
+TriggerOnFalseForwarder = cg.esphome_ns.class_("TriggerOnFalseForwarder")
 
 LambdaCondition = cg.esphome_ns.class_("LambdaCondition", Condition)
 StatelessLambdaCondition = cg.esphome_ns.class_("StatelessLambdaCondition", Condition)
@@ -159,11 +199,10 @@ def validate_automation(extra_schema=None, extra_validators=None, single=False):
                     return cv.Schema([schema])(value)
                 except cv.Invalid as err2:
                     if "extra keys not allowed" in str(err2) and len(err2.path) == 2:
-                        # pylint: disable=raise-missing-from
-                        raise err
+                        raise err from None
                     if "Unable to find action" in str(err):
-                        raise err2
-                    raise cv.MultipleInvalid([err, err2])
+                        raise err2 from None
+                    raise cv.MultipleInvalid([err, err2]) from None
         elif isinstance(value, dict):
             if CONF_THEN in value:
                 return [schema(value)]
@@ -211,7 +250,9 @@ async def and_condition_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )
 
 
 @register_condition("or", OrCondition, validate_condition_list)
@@ -222,7 +263,9 @@ async def or_condition_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )
 
 
 @register_condition("all", AndCondition, validate_condition_list)
@@ -233,7 +276,9 @@ async def all_condition_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )
 
 
 @register_condition("any", OrCondition, validate_condition_list)
@@ -244,7 +289,9 @@ async def any_condition_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )
 
 
 @register_condition("not", NotCondition, validate_potentially_and_condition)
@@ -266,7 +313,9 @@ async def xor_condition_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(condition_id, template_arg, conditions)
+    return cg.new_Pvariable(
+        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
+    )
 
 
 @register_condition("lambda", LambdaCondition, cv.returning_lambda)
@@ -335,7 +384,10 @@ async def component_is_idle_condition_to_code(
 
 
 @register_action(
-    "delay", DelayAction, cv.templatable(cv.positive_time_period_milliseconds)
+    "delay",
+    DelayAction,
+    cv.templatable(cv.positive_time_period_milliseconds),
+    synchronous=False,
 )
 async def delay_action_to_code(
     config: ConfigType,
@@ -344,7 +396,6 @@ async def delay_action_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     var = cg.new_Pvariable(action_id, template_arg)
-    await cg.register_component(var, {})
     template_ = await cg.templatable(config, args, cg.uint32)
     cg.add(var.set_delay(template_))
     return var
@@ -366,6 +417,7 @@ async def delay_action_to_code(
         cv.has_at_least_one_key(CONF_THEN, CONF_ELSE),
         cv.has_at_least_one_key(CONF_CONDITION, CONF_ANY, CONF_ALL),
     ),
+    synchronous=True,
 )
 async def if_action_to_code(
     config: ConfigType,
@@ -373,13 +425,16 @@ async def if_action_to_code(
     template_arg: cg.TemplateArguments,
     args: TemplateArgsType,
 ) -> MockObj:
+    has_else = CONF_ELSE in config
+    # Prepend HasElse bool to template arguments: IfAction<HasElse, Ts...>
+    if_template_arg = cg.TemplateArguments(has_else, *template_arg)
     cond_conf = next(el for el in config if el in (CONF_ANY, CONF_ALL, CONF_CONDITION))
     condition = await build_condition(config[cond_conf], template_arg, args)
-    var = cg.new_Pvariable(action_id, template_arg, condition)
+    var = cg.new_Pvariable(action_id, if_template_arg, condition)
     if CONF_THEN in config:
         actions = await build_action_list(config[CONF_THEN], template_arg, args)
         cg.add(var.add_then(actions))
-    if CONF_ELSE in config:
+    if has_else:
         actions = await build_action_list(config[CONF_ELSE], template_arg, args)
         cg.add(var.add_else(actions))
     return var
@@ -394,6 +449,7 @@ async def if_action_to_code(
             cv.Required(CONF_THEN): validate_action_list,
         }
     ),
+    synchronous=True,
 )
 async def while_action_to_code(
     config: ConfigType,
@@ -417,6 +473,7 @@ async def while_action_to_code(
             cv.Required(CONF_THEN): validate_action_list,
         }
     ),
+    synchronous=True,
 )
 async def repeat_action_to_code(
     config: ConfigType,
@@ -445,7 +502,7 @@ _validate_wait_until = cv.maybe_simple_value(
 )
 
 
-@register_action("wait_until", WaitUntilAction, _validate_wait_until)
+@register_action("wait_until", WaitUntilAction, _validate_wait_until, synchronous=False)
 async def wait_until_action_to_code(
     config: ConfigType,
     action_id: ID,
@@ -461,7 +518,12 @@ async def wait_until_action_to_code(
     return var
 
 
-@register_action("lambda", LambdaAction, cv.lambda_)
+# Lambda executes user C++ inline and returns — synchronous by execution model.
+# User code could theoretically store the StringRef for deferred use, but StringRef
+# is a view type and storing views beyond their scope is always unsafe regardless
+# of this optimization.  Marking non-synchronous would disable StringRef for nearly
+# all user services since most use lambda.
+@register_action("lambda", LambdaAction, cv.lambda_, synchronous=True)
 async def lambda_action_to_code(
     config: ConfigType,
     action_id: ID,
@@ -480,6 +542,7 @@ async def lambda_action_to_code(
             cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
         }
     ),
+    synchronous=True,
 )
 async def component_update_action_to_code(
     config: ConfigType,
@@ -499,6 +562,7 @@ async def component_update_action_to_code(
             cv.Required(CONF_ID): cv.use_id(cg.PollingComponent),
         }
     ),
+    synchronous=True,
 )
 async def component_suspend_action_to_code(
     config: ConfigType,
@@ -521,6 +585,7 @@ async def component_suspend_action_to_code(
             ),
         }
     ),
+    synchronous=True,
 )
 async def component_resume_action_to_code(
     config: ConfigType,
@@ -531,7 +596,7 @@ async def component_resume_action_to_code(
     comp = await cg.get_variable(config[CONF_ID])
     var = cg.new_Pvariable(action_id, template_arg, comp)
     if CONF_UPDATE_INTERVAL in config:
-        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, int)
+        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, cg.uint32)
         cg.add(var.set_update_interval(template_))
     return var
 
@@ -578,6 +643,27 @@ async def build_condition_list(
     return conditions
 
 
+def has_non_synchronous_actions(actions: ConfigType) -> bool:
+    """Check if a validated action list contains any non-synchronous actions.
+
+    Non-synchronous actions (delay, wait_until, script.wait, etc.) store
+    trigger args for later execution, making non-owning types like StringRef
+    unsafe.
+    """
+    if isinstance(actions, list):
+        return any(has_non_synchronous_actions(item) for item in actions)
+    if isinstance(actions, dict):
+        for key in actions:
+            if key in ACTION_REGISTRY and not ACTION_REGISTRY[key].synchronous:
+                return True
+        return any(
+            has_non_synchronous_actions(v)
+            for v in actions.values()
+            if isinstance(v, (list, dict))
+        )
+    return False
+
+
 async def build_automation(
     trigger: MockObj, args: TemplateArgsType, config: ConfigType
 ) -> MockObj:
@@ -587,3 +673,76 @@ async def build_automation(
     actions = await build_action_list(config[CONF_THEN], templ, args)
     cg.add(obj.add_actions(actions))
     return obj
+
+
+async def build_callback_automation(
+    parent: MockObj,
+    callback_method: str,
+    args: TemplateArgsType,
+    config: ConfigType,
+    forwarder: MockObj | MockObjClass | None = None,
+) -> None:
+    """Build an Automation and register it as a callback on the parent.
+
+    Eliminates the need for a Trigger wrapper object by registering the
+    automation's trigger() directly as a callback on the parent component.
+
+    Uses template forwarder structs so the compiler deduplicates the operator()
+    body across all call sites with the same signature. The forwarder must be
+    pointer-sized (single Automation* field) to fit inline in Callback::ctx_
+    and avoid heap allocation.
+
+    :param parent: The component object (e.g., button, sensor).
+    :param callback_method: Name of the callback method (e.g., "add_on_press_callback").
+    :param args: Automation template args as list of (type, name) tuples.
+    :param config: The automation config dict.
+    :param forwarder: Optional forwarder type to use instead of the default
+        TriggerForwarder<Ts...>. Pass any struct type whose aggregate init takes
+        a single Automation pointer (e.g., TriggerOnTrueForwarder).
+    """
+    arg_types = [arg[0] for arg in args]
+    templ = cg.TemplateArguments(*arg_types)
+    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ)
+    actions = await build_action_list(config[CONF_THEN], templ, args)
+    cg.add(obj.add_actions(actions))
+    # Use template forwarder structs for deduplication. The compiler generates
+    # one operator() per forwarder type; different automation pointers are just
+    # data in the struct.
+    if forwarder is None:
+        forwarder = TriggerForwarder.template(templ)
+    # RawExpression for aggregate init — both forwarder and obj are codegen
+    # MockObjs (not user input), and there's no Expression type for positional
+    # aggregate initialization (StructInitializer uses named fields).
+    cg.add(getattr(parent, callback_method)(cg.RawExpression(f"{forwarder}{{{obj}}}")))
+
+
+@dataclass(frozen=True, slots=True)
+class CallbackAutomation:
+    """A single callback automation entry for build_callback_automations."""
+
+    conf_key: str
+    callback_method: str
+    args: TemplateArgsType = field(default_factory=list)
+    forwarder: MockObj | MockObjClass | None = None
+
+
+async def build_callback_automations(
+    parent: MockObj,
+    config: ConfigType,
+    entries: tuple[CallbackAutomation, ...],
+) -> None:
+    """Build multiple callback automations from a tuple of entries.
+
+    :param parent: The component object (e.g., button, sensor).
+    :param config: The full component config dict.
+    :param entries: Tuple of CallbackAutomation entries to process.
+    """
+    for entry in entries:
+        for conf in config.get(entry.conf_key, []):
+            await build_callback_automation(
+                parent,
+                entry.callback_method,
+                entry.args,
+                conf,
+                forwarder=entry.forwarder,
+            )

esphome/build_gen/espidf.py

@@ -0,0 +1,234 @@
+"""ESP-IDF direct build generator for ESPHome."""
+
+import json
+from pathlib import Path
+
+from esphome.components.esp32 import get_esp32_variant, idf_version
+import esphome.config_validation as cv
+from esphome.core import CORE
+from esphome.helpers import mkdir_p, write_file_if_changed
+from esphome.writer import update_storage_json
+
+
+def get_available_components() -> list[str] | None:
+    """Get list of built-in ESP-IDF components from project_description.json.
+
+    Excludes ``src``, IDF-managed components (``managed_components/``), and
+    converted PIO libs (``pio_components/``). Returns ``None`` if the build
+    dir or ``project_description.json`` isn't ready yet.
+    """
+    if CORE.build_path is None:
+        return None
+    project_desc = Path(CORE.build_path) / "build" / "project_description.json"
+    if not project_desc.exists():
+        return None
+
+    try:
+        with open(project_desc, encoding="utf-8") as f:
+            data = json.load(f)
+
+        component_info = data.get("build_component_info", {})
+
+        result = []
+        for name, info in component_info.items():
+            # Exclude our own src component
+            if name == "src":
+                continue
+
+            # Exclude IDF-managed and converted-PIO components (external).
+            comp_dir = info.get("dir", "")
+            if "managed_components" in comp_dir or "pio_components" in comp_dir:
+                continue
+
+            result.append(name)
+
+        return result
+    except (json.JSONDecodeError, OSError):
+        return None
+
+
+def has_discovered_components() -> bool:
+    """Check if we have discovered components from a previous configure."""
+    return get_available_components() is not None
+
+
+def get_project_cmakelists(minimal: bool = False) -> str:
+    """Generate the top-level CMakeLists.txt for ESP-IDF project.
+
+    When ``minimal`` is true, omit ``ESPHOME_PROJECT_BUILTIN_COMPONENTS``
+    since ``project_description.json`` may be stale on the first write.
+    """
+    # Get IDF target from ESP32 variant (e.g., ESP32S3 -> esp32s3)
+    variant = get_esp32_variant()
+    idf_target = variant.lower().replace("-", "")
+
+    # esp_idf_size 2.x (bundled with IDF >=6.0) made NG the default and
+    # removed the --ng flag; on 1.x (IDF 5.5) --ng is required to get
+    # --format=raw because the legacy mode doesn't support it.
+    size_ng_flag = "--ng" if idf_version() < cv.Version(6, 0, 0) else ""
+
+    # Project-wide compile options: -D defines and -W warning flags (skip
+    # -Wl, linker flags — those go on the src component via
+    # target_link_options below). Emitted via idf_build_set_property so the
+    # flags propagate to every IDF component (including managed ones like
+    # esphome__micro-mp3) rather than just src/. Required so suppressions
+    # like ``-Wno-error=maybe-uninitialized`` actually silence warnings in
+    # third-party components we don't author.
+    project_compile_opts = [
+        flag
+        for flag in sorted(CORE.build_flags)
+        if flag.startswith("-D")
+        or (flag.startswith("-W") and not flag.startswith("-Wl,"))
+    ]
+    extra_compile_options = "\n".join(
+        f'idf_build_set_property(COMPILE_OPTIONS "{flag}" APPEND)'
+        for flag in project_compile_opts
+    )
+
+    # Per-project list exposed as a CMake variable so converted PIO libs
+    # can reference ${ESPHOME_PROJECT_MANAGED_COMPONENTS} without baking
+    # project-specific names into their cached CMakeLists.
+    #
+    # Emit via idf_build_set_property (not plain set()) so the value is
+    # serialised into build_properties.temp.cmake and visible to IDF's
+    # early requirements-expansion pass (component_get_requirements.cmake
+    # runs as a separate CMake script invocation that doesn't load the
+    # project's top-level CMakeLists; without this, ${ESPHOME_PROJECT_
+    # MANAGED_COMPONENTS} in a converted-lib REQUIRES expands to empty).
+    from esphome.components.esp32 import get_managed_component_require_names
+
+    managed_components_property = "\n".join(
+        f"idf_build_set_property(ESPHOME_PROJECT_MANAGED_COMPONENTS {name} APPEND)"
+        for name in get_managed_component_require_names()
+    )
+
+    # Built-in IDF components exposed via our own property (not IDF's
+    # __COMPONENT_REQUIRES_COMMON, which would append them to every
+    # component's REQUIRES including real IDF components). Referenced by
+    # src/CMakeLists and by each converted PIO lib's CMakeLists. Skipped
+    # on minimal writes because project_description.json may be stale.
+    builtin_components_property = (
+        ""
+        if minimal
+        else "\n".join(
+            f"idf_build_set_property(ESPHOME_PROJECT_BUILTIN_COMPONENTS {name} APPEND)"
+            for name in sorted(get_available_components() or [])
+        )
+    )
+
+    return f"""\
+# Auto-generated by ESPHome
+cmake_minimum_required(VERSION 3.16)
+
+# On Windows, Ninja can fail with:
+#   "CreateProcess: The parameter is incorrect (is the command line too long?)"
+# when compiler/linker command lines exceed the OS length limit.
+#
+# The following settings force CMake/Ninja to use *response files* (@file.rsp)
+# to pass long lists of includes, objects, and other arguments indirectly,
+# avoiding command-line length limits and fixing the build failure.
+#
+# This is especially useful for large ESP-IDF / ESPHome projects with many
+# source files or include directories.
+set(CMAKE_C_USE_RESPONSE_FILE_FOR_INCLUDES 1)
+set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_INCLUDES 1)
+set(CMAKE_C_USE_RESPONSE_FILE_FOR_OBJECTS 1)
+set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_OBJECTS 1)
+set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
+
+set(IDF_TARGET {idf_target})
+set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)
+
+include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)
+
+{extra_compile_options}
+
+{managed_components_property}
+
+{builtin_components_property}
+
+project({CORE.name})
+
+# Emit raw JSON size data for ESPHome to read post-build.
+add_custom_command(
+    TARGET ${{CMAKE_PROJECT_NAME}}.elf POST_BUILD
+    COMMAND ${{PYTHON}} -m esp_idf_size {size_ng_flag} --format=raw
+            -o ${{CMAKE_BINARY_DIR}}/esp_idf_size.json
+            ${{CMAKE_PROJECT_NAME}}.map
+    WORKING_DIRECTORY ${{CMAKE_BINARY_DIR}}
+    VERBATIM
+)
+"""
+
+
+def get_component_cmakelists() -> str:
+    """Generate the main component CMakeLists.txt.
+
+    REQUIRES pulls in the discovered built-in IDF components via the
+    project-level variables set in the top-level CMakeLists.
+    """
+    # Extract linker options (-Wl, flags). Compile flags (-D, -W) are
+    # emitted project-wide via idf_build_set_property in
+    # get_project_cmakelists so they reach every component, not just src/.
+    link_opts = [flag for flag in CORE.build_flags if flag.startswith("-Wl,")]
+    link_opts_str = "\n    ".join(sorted(link_opts)) if link_opts else ""
+
+    return f"""\
+# Auto-generated by ESPHome
+# CONFIGURE_DEPENDS asks CMake to re-check the glob each build so test
+# runs that reuse the build dir don't compile stale source paths. It's
+# invalid in script mode (cmake -P), which is how IDF's
+# component_get_requirements.cmake includes us, so skip it there.
+if(CMAKE_SCRIPT_MODE_FILE)
+    file(GLOB_RECURSE app_sources
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cpp"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cpp"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c"
+    )
+else()
+    file(GLOB_RECURSE app_sources CONFIGURE_DEPENDS
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.cpp"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/*.c"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.cpp"
+        "${{CMAKE_CURRENT_SOURCE_DIR}}/esphome/*.c"
+    )
+endif()
+
+idf_component_register(
+    SRCS ${{app_sources}}
+    INCLUDE_DIRS "." "esphome"
+    REQUIRES ${{ESPHOME_PROJECT_BUILTIN_COMPONENTS}}
+)
+
+# Apply C++ standard
+target_compile_features(${{COMPONENT_LIB}} PUBLIC cxx_std_20)
+
+# ESPHome linker options
+target_link_options(${{COMPONENT_LIB}} PUBLIC
+    {link_opts_str}
+)
+"""
+
+
+def write_project(minimal: bool = False) -> None:
+    """Write ESP-IDF project files."""
+    # Refresh <data_dir>/storage/<name>.yaml.json so the dashboard's
+    # /info and /downloads endpoints can locate the build (they 404
+    # otherwise). This mirrors the PlatformIO build-gen path's call
+    # in build_gen/platformio.py:write_ini().
+    update_storage_json()
+    mkdir_p(CORE.build_path)
+    mkdir_p(CORE.relative_src_path())
+
+    # Write top-level CMakeLists.txt
+    write_file_if_changed(
+        CORE.relative_build_path("CMakeLists.txt"),
+        get_project_cmakelists(minimal=minimal),
+    )
+
+    # Write component CMakeLists.txt in src/
+    write_file_if_changed(
+        CORE.relative_src_path("CMakeLists.txt"),
+        get_component_cmakelists(),
+    )

esphome/bundle.py

@@ -0,0 +1,694 @@
+"""Config bundle creator and extractor for ESPHome.
+
+A bundle is a self-contained .tar.gz archive containing a YAML config
+and every local file it depends on. Bundles can be created from a config
+and compiled directly: ``esphome compile my_device.esphomebundle.tar.gz``
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from enum import StrEnum
+import io
+import json
+import logging
+from pathlib import Path
+import re
+import shutil
+import tarfile
+from typing import Any
+
+from esphome import const, yaml_util
+from esphome.const import (
+    CONF_ESPHOME,
+    CONF_EXTERNAL_COMPONENTS,
+    CONF_INCLUDES,
+    CONF_INCLUDES_C,
+    CONF_PATH,
+    CONF_SOURCE,
+    CONF_TYPE,
+)
+from esphome.core import CORE, EsphomeError
+
+_LOGGER = logging.getLogger(__name__)
+
+BUNDLE_EXTENSION = ".esphomebundle.tar.gz"
+MANIFEST_FILENAME = "manifest.json"
+CURRENT_MANIFEST_VERSION = 1
+MAX_DECOMPRESSED_SIZE = 500 * 1024 * 1024  # 500 MB
+MAX_MANIFEST_SIZE = 1024 * 1024  # 1 MB
+
+# Directories preserved across bundle extractions (build caches)
+_PRESERVE_DIRS = (".esphome", ".pioenvs", ".pio")
+_BUNDLE_STAGING_DIR = ".bundle_staging"
+
+
+class ManifestKey(StrEnum):
+    """Keys used in bundle manifest.json."""
+
+    MANIFEST_VERSION = "manifest_version"
+    ESPHOME_VERSION = "esphome_version"
+    CONFIG_FILENAME = "config_filename"
+    FILES = "files"
+    HAS_SECRETS = "has_secrets"
+
+
+# String prefixes that are never local file paths
+_NON_PATH_PREFIXES = ("http://", "https://", "ftp://", "mdi:", "<")
+
+# File extensions recognized when resolving relative path strings.
+# A relative string with one of these extensions is resolved against the
+# config directory and included if the file exists.
+_KNOWN_FILE_EXTENSIONS = frozenset(
+    {
+        # Fonts
+        ".ttf",
+        ".otf",
+        ".woff",
+        ".woff2",
+        ".pcf",
+        ".bdf",
+        # Images
+        ".png",
+        ".jpg",
+        ".jpeg",
+        ".bmp",
+        ".gif",
+        ".svg",
+        ".ico",
+        ".webp",
+        # Certificates
+        ".pem",
+        ".crt",
+        ".key",
+        ".der",
+        ".p12",
+        ".pfx",
+        # C/C++ includes
+        ".h",
+        ".hpp",
+        ".c",
+        ".cpp",
+        ".ino",
+        # Web assets
+        ".css",
+        ".js",
+        ".html",
+    }
+)
+
+
+# Matches !secret references in YAML text.  An optional surrounding
+# quote pair around the key is allowed and ignored: YAML treats
+# ``!secret 'foo'`` and ``!secret foo`` as the same key.  This is
+# intentionally a simple regex scan rather than a YAML parse — it may
+# match inside comments or multi-line strings, which is the conservative
+# direction (include more secrets rather than fewer).
+_SECRET_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""")
+
+
+def _find_used_secret_keys(yaml_files: list[Path]) -> set[str]:
+    """Scan YAML files for ``!secret <key>`` references."""
+    keys: set[str] = set()
+    for fpath in yaml_files:
+        try:
+            text = fpath.read_text(encoding="utf-8")
+        except (OSError, UnicodeDecodeError):
+            continue
+        for match in _SECRET_RE.finditer(text):
+            keys.add(match.group(1))
+    return keys
+
+
+@dataclass
+class BundleFile:
+    """A file to include in the bundle."""
+
+    path: str  # Relative path inside the archive
+    source: Path  # Absolute path on disk
+
+
+@dataclass
+class BundleResult:
+    """Result of creating a bundle."""
+
+    data: bytes
+    manifest: dict[str, Any]
+    files: list[BundleFile]
+
+
+@dataclass
+class BundleManifest:
+    """Parsed and validated bundle manifest."""
+
+    manifest_version: int
+    esphome_version: str
+    config_filename: str
+    files: list[str]
+    has_secrets: bool
+
+
+class ConfigBundleCreator:
+    """Creates a self-contained bundle from an ESPHome config."""
+
+    def __init__(self, config: dict[str, Any]) -> None:
+        self._config = config
+        self._config_dir = Path(CORE.config_dir).resolve()
+        self._config_path = Path(CORE.config_path).resolve()
+        self._files: list[BundleFile] = []
+        self._seen_paths: set[Path] = set()
+        self._secrets_paths: set[Path] = set()
+
+    def discover_files(self) -> list[BundleFile]:
+        """Discover all files needed for the bundle."""
+        self._files = []
+        self._seen_paths = set()
+        self._secrets_paths = set()
+
+        # The main config file
+        self._add_file(self._config_path)
+
+        # Phase 1: YAML includes (tracked during config loading)
+        self._discover_yaml_includes()
+
+        # Phase 2: Component-referenced files from validated config
+        self._discover_component_files()
+
+        return list(self._files)
+
+    def create_bundle(self) -> BundleResult:
+        """Create the bundle archive."""
+        files = self.discover_files()
+
+        # Determine which secret keys are actually referenced by the
+        # bundled YAML files so we only ship those, not the entire
+        # secrets.yaml which may contain secrets for other devices.
+        yaml_sources = [
+            bf.source for bf in files if bf.source.suffix in (".yaml", ".yml")
+        ]
+        used_secret_keys = _find_used_secret_keys(yaml_sources)
+        filtered_secrets = self._build_filtered_secrets(used_secret_keys)
+
+        has_secrets = bool(filtered_secrets)
+        if has_secrets:
+            _LOGGER.warning(
+                "Bundle contains secrets (e.g. Wi-Fi passwords). "
+                "Do not share it with untrusted parties."
+            )
+
+        manifest = self._build_manifest(files, has_secrets=has_secrets)
+
+        buf = io.BytesIO()
+        with tarfile.open(fileobj=buf, mode="w:gz") as tar:
+            # Add manifest first
+            manifest_data = json.dumps(manifest, indent=2).encode("utf-8")
+            _add_bytes_to_tar(tar, MANIFEST_FILENAME, manifest_data)
+
+            # Add filtered secrets files
+            for rel_path, data in sorted(filtered_secrets.items()):
+                _add_bytes_to_tar(tar, rel_path, data)
+
+            # Add files in sorted order for determinism, skipping secrets
+            # files which were already added above with filtered content
+            for bf in sorted(files, key=lambda f: f.path):
+                if bf.source in self._secrets_paths:
+                    continue
+                self._add_to_tar(tar, bf)
+
+        return BundleResult(data=buf.getvalue(), manifest=manifest, files=files)
+
+    def _add_file(self, abs_path: Path) -> bool:
+        """Add a file to the bundle. Returns False if already added."""
+        abs_path = abs_path.resolve()
+        if abs_path in self._seen_paths:
+            return False
+        if not abs_path.is_file():
+            _LOGGER.warning("Bundle: skipping missing file %s", abs_path)
+            return False
+
+        rel_path = self._relative_to_config_dir(abs_path)
+        if rel_path is None:
+            _LOGGER.warning(
+                "Bundle: skipping file outside config directory: %s", abs_path
+            )
+            return False
+
+        self._seen_paths.add(abs_path)
+        self._files.append(BundleFile(path=rel_path, source=abs_path))
+        return True
+
+    def _add_directory(self, abs_path: Path) -> None:
+        """Recursively add all files in a directory."""
+        abs_path = abs_path.resolve()
+        if not abs_path.is_dir():
+            _LOGGER.warning("Bundle: skipping missing directory %s", abs_path)
+            return
+        for child in sorted(abs_path.rglob("*")):
+            if child.is_file() and "__pycache__" not in child.parts:
+                self._add_file(child)
+
+    def _relative_to_config_dir(self, abs_path: Path) -> str | None:
+        """Get a path relative to the config directory. Returns None if outside.
+
+        Always uses forward slashes for consistency in tar archives.
+        """
+        try:
+            return abs_path.relative_to(self._config_dir).as_posix()
+        except ValueError:
+            return None
+
+    def _discover_yaml_includes(self) -> None:
+        """Discover YAML files loaded during config parsing.
+
+        Delegates to :func:`yaml_util.discover_user_yaml_files`, which does a
+        fresh re-parse and force-loads every deferred ``IncludeFile`` so that
+        *all* potentially-reachable includes are captured (even branches not
+        selected by local substitutions). Bundles are meant to be compiled on
+        another system where command-line substitution overrides may choose a
+        different branch — e.g. ``!include network/${eth_model}/config.yaml``
+        must ship every candidate so the remote build can pick any one.
+        """
+        discovered = yaml_util.discover_user_yaml_files(self._config_path)
+        self._secrets_paths.update(discovered.secrets)
+        config_resolved = self._config_path.resolve()
+        for fpath in discovered.files:
+            if fpath == config_resolved:
+                continue  # Already added as config
+            self._add_file(fpath)
+
+    def _discover_component_files(self) -> None:
+        """Walk the validated config for file references.
+
+        Uses a generic recursive walk to find file paths instead of
+        hardcoding per-component knowledge about config dict formats.
+        After validation, components typically resolve paths to absolute
+        using CORE.relative_config_path() or cv.file_(). Relative paths
+        with known file extensions are also resolved and checked.
+
+        Core ESPHome concepts that use relative paths or directories
+        are handled explicitly.
+        """
+        config = self._config
+
+        # Generic walk: find all file paths in the validated config
+        self._walk_config_for_files(config)
+
+        # --- Core ESPHome concepts needing explicit handling ---
+
+        # esphome.includes / includes_c - can be relative paths and directories
+        esphome_conf = config.get(CONF_ESPHOME, {})
+        for include_path in esphome_conf.get(CONF_INCLUDES, []):
+            resolved = _resolve_include_path(include_path)
+            if resolved is None:
+                continue
+            if resolved.is_dir():
+                self._add_directory(resolved)
+            else:
+                self._add_file(resolved)
+        for include_path in esphome_conf.get(CONF_INCLUDES_C, []):
+            resolved = _resolve_include_path(include_path)
+            if resolved is not None:
+                self._add_file(resolved)
+
+        # external_components with source: local - directories
+        for ext_conf in config.get(CONF_EXTERNAL_COMPONENTS, []):
+            source = ext_conf.get(CONF_SOURCE, {})
+            if not isinstance(source, dict):
+                continue
+            if source.get(CONF_TYPE) != "local":
+                continue
+            path = source.get(CONF_PATH)
+            if not path:
+                continue
+            p = Path(path)
+            if not p.is_absolute():
+                p = CORE.relative_config_path(p)
+            self._add_directory(p)
+
+    def _walk_config_for_files(self, obj: Any) -> None:
+        """Recursively walk the config dict looking for file path references."""
+        if isinstance(obj, dict):
+            for value in obj.values():
+                self._walk_config_for_files(value)
+        elif isinstance(obj, (list, tuple)):
+            for item in obj:
+                self._walk_config_for_files(item)
+        elif isinstance(obj, Path):
+            if obj.is_absolute() and obj.is_file():
+                self._add_file(obj)
+        elif isinstance(obj, str):
+            self._check_string_path(obj)
+
+    def _check_string_path(self, value: str) -> None:
+        """Check if a string value is a local file reference."""
+        # Fast exits for strings that cannot be file paths
+        if len(value) < 2 or "\n" in value:
+            return
+        if value.startswith(_NON_PATH_PREFIXES):
+            return
+        # File paths must contain a path separator or a dot (for extension)
+        if "/" not in value and "\\" not in value and "." not in value:
+            return
+
+        p = Path(value)
+
+        # Absolute path - check if it points to an existing file
+        if p.is_absolute():
+            if p.is_file():
+                self._add_file(p)
+            return
+
+        # Relative path with a known file extension - likely a component
+        # validator that forgot to resolve to absolute via cv.file_() or
+        # CORE.relative_config_path(). Warn and try to resolve.
+        if p.suffix.lower() in _KNOWN_FILE_EXTENSIONS:
+            _LOGGER.warning(
+                "Bundle: non-absolute path in validated config: %s "
+                "(component validator should return absolute paths)",
+                value,
+            )
+            resolved = CORE.relative_config_path(p)
+            if resolved.is_file():
+                self._add_file(resolved)
+
+    def _build_filtered_secrets(self, used_keys: set[str]) -> dict[str, bytes]:
+        """Build filtered secrets files containing only the referenced keys.
+
+        Returns a dict mapping relative archive path to YAML bytes.
+        """
+        if not used_keys or not self._secrets_paths:
+            return {}
+
+        result: dict[str, bytes] = {}
+        for secrets_path in self._secrets_paths:
+            rel_path = self._relative_to_config_dir(secrets_path)
+            if rel_path is None:
+                continue
+            try:
+                all_secrets = yaml_util.load_yaml(secrets_path, clear_secrets=False)
+            except EsphomeError:
+                _LOGGER.warning("Bundle: failed to load secrets file %s", secrets_path)
+                continue
+            if not isinstance(all_secrets, dict):
+                continue
+            filtered = {k: v for k, v in all_secrets.items() if k in used_keys}
+            if filtered:
+                data = yaml_util.dump(filtered, show_secrets=True).encode("utf-8")
+                result[rel_path] = data
+        return result
+
+    def _build_manifest(
+        self, files: list[BundleFile], *, has_secrets: bool
+    ) -> dict[str, Any]:
+        """Build the manifest.json content."""
+        return {
+            ManifestKey.MANIFEST_VERSION: CURRENT_MANIFEST_VERSION,
+            ManifestKey.ESPHOME_VERSION: const.__version__,
+            ManifestKey.CONFIG_FILENAME: self._config_path.name,
+            ManifestKey.FILES: [f.path for f in files],
+            ManifestKey.HAS_SECRETS: has_secrets,
+        }
+
+    @staticmethod
+    def _add_to_tar(tar: tarfile.TarFile, bf: BundleFile) -> None:
+        """Add a BundleFile to the tar archive with deterministic metadata."""
+        with open(bf.source, "rb") as f:
+            _add_bytes_to_tar(tar, bf.path, f.read())
+
+
+def extract_bundle(
+    bundle_path: Path,
+    target_dir: Path | None = None,
+) -> Path:
+    """Extract a bundle archive and return the path to the config YAML.
+
+    Sanity checks reject path traversal, symlinks, absolute paths, and
+    oversized archives to prevent accidental file overwrites or extraction
+    outside the target directory.  These are **not** a security boundary —
+    bundles are assumed to come from the user's own machine or a trusted
+    build pipeline.
+
+    Args:
+        bundle_path: Path to the .tar.gz bundle file.
+        target_dir: Directory to extract into. If None, extracts next to
+                     the bundle file in a directory named after it.
+
+    Returns:
+        Absolute path to the extracted config YAML file.
+
+    Raises:
+        EsphomeError: If the bundle is invalid or extraction fails.
+    """
+
+    bundle_path = bundle_path.resolve()
+    if not bundle_path.is_file():
+        raise EsphomeError(f"Bundle file not found: {bundle_path}")
+
+    if target_dir is None:
+        target_dir = _default_target_dir(bundle_path)
+
+    target_dir = target_dir.resolve()
+    target_dir.mkdir(parents=True, exist_ok=True)
+
+    # Read and validate the archive
+    try:
+        with tarfile.open(bundle_path, "r:gz") as tar:
+            manifest = _read_manifest_from_tar(tar)
+            _validate_tar_members(tar, target_dir)
+            tar.extractall(path=target_dir, filter="data")
+    except tarfile.TarError as err:
+        raise EsphomeError(f"Failed to extract bundle: {err}") from err
+
+    config_filename = manifest[ManifestKey.CONFIG_FILENAME]
+    config_path = target_dir / config_filename
+    if not config_path.is_file():
+        raise EsphomeError(
+            f"Bundle manifest references config '{config_filename}' "
+            f"but it was not found in the archive"
+        )
+
+    return config_path
+
+
+def read_bundle_manifest(bundle_path: Path) -> BundleManifest:
+    """Read and validate the manifest from a bundle without full extraction.
+
+    Args:
+        bundle_path: Path to the .tar.gz bundle file.
+
+    Returns:
+        Parsed BundleManifest.
+
+    Raises:
+        EsphomeError: If the manifest is missing, invalid, or version unsupported.
+    """
+
+    try:
+        with tarfile.open(bundle_path, "r:gz") as tar:
+            manifest = _read_manifest_from_tar(tar)
+    except tarfile.TarError as err:
+        raise EsphomeError(f"Failed to read bundle: {err}") from err
+
+    return BundleManifest(
+        manifest_version=manifest[ManifestKey.MANIFEST_VERSION],
+        esphome_version=manifest.get(ManifestKey.ESPHOME_VERSION, "unknown"),
+        config_filename=manifest[ManifestKey.CONFIG_FILENAME],
+        files=manifest.get(ManifestKey.FILES, []),
+        has_secrets=manifest.get(ManifestKey.HAS_SECRETS, False),
+    )
+
+
+def _read_manifest_from_tar(tar: tarfile.TarFile) -> dict[str, Any]:
+    """Read and validate manifest.json from an open tar archive."""
+
+    try:
+        member = tar.getmember(MANIFEST_FILENAME)
+    except KeyError:
+        raise EsphomeError("Invalid bundle: missing manifest.json") from None
+
+    f = tar.extractfile(member)
+    if f is None:
+        raise EsphomeError("Invalid bundle: manifest.json is not a regular file")
+
+    if member.size > MAX_MANIFEST_SIZE:
+        raise EsphomeError(
+            f"Invalid bundle: manifest.json too large "
+            f"({member.size} bytes, max {MAX_MANIFEST_SIZE})"
+        )
+
+    try:
+        manifest = json.loads(f.read())
+    except (json.JSONDecodeError, UnicodeDecodeError) as err:
+        raise EsphomeError(f"Invalid bundle: malformed manifest.json: {err}") from err
+
+    # Version check
+    version = manifest.get(ManifestKey.MANIFEST_VERSION)
+    if version is None:
+        raise EsphomeError("Invalid bundle: manifest.json missing 'manifest_version'")
+    if not isinstance(version, int) or version < 1:
+        raise EsphomeError(
+            f"Invalid bundle: manifest_version must be a positive integer, got {version!r}"
+        )
+    if version > CURRENT_MANIFEST_VERSION:
+        raise EsphomeError(
+            f"Bundle manifest version {version} is newer than this ESPHome "
+            f"version supports (max {CURRENT_MANIFEST_VERSION}). "
+            f"Please upgrade ESPHome to compile this bundle."
+        )
+
+    # Required fields
+    if ManifestKey.CONFIG_FILENAME not in manifest:
+        raise EsphomeError("Invalid bundle: manifest.json missing 'config_filename'")
+
+    return manifest
+
+
+def _validate_tar_members(tar: tarfile.TarFile, target_dir: Path) -> None:
+    """Sanity-check tar members to prevent mistakes and accidental overwrites.
+
+    This is not a security boundary — bundles are created locally or come
+    from a trusted build pipeline.  The checks catch malformed archives
+    and common mistakes (stray absolute paths, ``..`` components) that
+    could silently overwrite unrelated files.
+    """
+
+    total_size = 0
+    for member in tar.getmembers():
+        # Reject absolute paths (Unix and Windows)
+        if member.name.startswith(("/", "\\")):
+            raise EsphomeError(
+                f"Invalid bundle: absolute path in archive: {member.name}"
+            )
+
+        # Reject path traversal (split on both / and \ for cross-platform)
+        parts = re.split(r"[/\\]", member.name)
+        if ".." in parts:
+            raise EsphomeError(
+                f"Invalid bundle: path traversal in archive: {member.name}"
+            )
+
+        # Reject symlinks
+        if member.issym() or member.islnk():
+            raise EsphomeError(f"Invalid bundle: symlink in archive: {member.name}")
+
+        # Ensure extraction stays within target_dir
+        target_path = (target_dir / member.name).resolve()
+        if not target_path.is_relative_to(target_dir):
+            raise EsphomeError(
+                f"Invalid bundle: file would extract outside target: {member.name}"
+            )
+
+        # Track total decompressed size
+        total_size += member.size
+        if total_size > MAX_DECOMPRESSED_SIZE:
+            raise EsphomeError(
+                f"Invalid bundle: decompressed size exceeds "
+                f"{MAX_DECOMPRESSED_SIZE // (1024 * 1024)}MB limit"
+            )
+
+
+def is_bundle_path(path: Path) -> bool:
+    """Check if a path looks like a bundle file."""
+    return path.name.lower().endswith(BUNDLE_EXTENSION)
+
+
+def _add_bytes_to_tar(tar: tarfile.TarFile, name: str, data: bytes) -> None:
+    """Add in-memory bytes to a tar archive with deterministic metadata."""
+    info = tarfile.TarInfo(name=name)
+    info.size = len(data)
+    info.mtime = 0
+    info.uid = 0
+    info.gid = 0
+    info.mode = 0o644
+    tar.addfile(info, io.BytesIO(data))
+
+
+def _resolve_include_path(include_path: Any) -> Path | None:
+    """Resolve an include path to absolute, skipping system includes."""
+    if isinstance(include_path, str) and include_path.startswith("<"):
+        return None  # System include, not a local file
+    p = Path(include_path)
+    if not p.is_absolute():
+        p = CORE.relative_config_path(p)
+    return p
+
+
+def _default_target_dir(bundle_path: Path) -> Path:
+    """Compute the default extraction directory for a bundle."""
+    name = bundle_path.name
+    if name.lower().endswith(BUNDLE_EXTENSION):
+        name = name[: -len(BUNDLE_EXTENSION)]
+    return bundle_path.parent / name
+
+
+def _restore_preserved_dirs(preserved: dict[str, Path], target_dir: Path) -> None:
+    """Move preserved build cache directories back into target_dir.
+
+    If the bundle contained entries under a preserved directory name,
+    the extracted copy is removed so the original cache always wins.
+    """
+    for dirname, src in preserved.items():
+        dst = target_dir / dirname
+        if dst.exists():
+            shutil.rmtree(dst)
+        shutil.move(str(src), str(dst))
+
+
+def prepare_bundle_for_compile(
+    bundle_path: Path,
+    target_dir: Path | None = None,
+) -> Path:
+    """Extract a bundle for compilation, preserving build caches.
+
+    Unlike extract_bundle(), this preserves .esphome/ and .pioenvs/
+    directories in the target if they already exist (for incremental builds).
+
+    Args:
+        bundle_path: Path to the .tar.gz bundle file.
+        target_dir: Directory to extract into. Must be specified for
+                     build server use.
+
+    Returns:
+        Absolute path to the extracted config YAML file.
+    """
+
+    bundle_path = bundle_path.resolve()
+    if not bundle_path.is_file():
+        raise EsphomeError(f"Bundle file not found: {bundle_path}")
+
+    if target_dir is None:
+        target_dir = _default_target_dir(bundle_path)
+
+    target_dir = target_dir.resolve()
+    target_dir.mkdir(parents=True, exist_ok=True)
+
+    preserved: dict[str, Path] = {}
+
+    # Temporarily move preserved dirs out of the way
+    staging = target_dir / _BUNDLE_STAGING_DIR
+    for dirname in _PRESERVE_DIRS:
+        src = target_dir / dirname
+        if src.is_dir():
+            dst = staging / dirname
+            dst.parent.mkdir(parents=True, exist_ok=True)
+            shutil.move(str(src), str(dst))
+            preserved[dirname] = dst
+
+    try:
+        # Clean non-preserved content and extract fresh
+        for item in target_dir.iterdir():
+            if item.name == _BUNDLE_STAGING_DIR:
+                continue
+            if item.is_dir():
+                shutil.rmtree(item)
+            else:
+                item.unlink()
+
+        config_path = extract_bundle(bundle_path, target_dir)
+    finally:
+        # Restore preserved dirs (idempotent) and clean staging
+        _restore_preserved_dirs(preserved, target_dir)
+        if staging.is_dir():
+            shutil.rmtree(staging)
+
+    return config_path

esphome/codegen.py

@@ -11,6 +11,7 @@
 from esphome.cpp_generator import (  # noqa: F401
     ArrayInitializer,
     Expression,
+    FlashStringLiteral,
     LineComment,
     LogStringLiteral,
     MockObj,
@@ -69,6 +70,7 @@ from esphome.cpp_types import (  # noqa: F401
     JsonObjectConst,
     Parented,
     PollingComponent,
+    StringRef,
     arduino_json_ns,
     bool_,
     const_char_ptr,
@@ -77,6 +79,7 @@ from esphome.cpp_types import (  # noqa: F401
     float_,
     global_ns,
     gpio_Flags,
+    int8,
     int16,
     int32,
     int64,
@@ -86,6 +89,7 @@ from esphome.cpp_types import (  # noqa: F401
     size_t,
     std_ns,
     std_shared_ptr,
+    std_span,
     std_string,
     std_string_ref,
     std_vector,

esphome/compiled_config.py

@@ -0,0 +1,76 @@
+"""Validated-config cache for the upload/logs fast path.
+
+compile dumps the validated config to <data_dir>/storage/<file>.validated.yaml;
+the next upload/logs for that YAML reuses it instead of running the full
+read_config pipeline. YAML round-trip (yaml_util.dump/load_yaml) keeps
+!lambda/!include/IDs/paths intact; mtime gates staleness.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+
+from esphome.core import CORE
+from esphome.helpers import write_file
+from esphome.storage_json import StorageJSON, ext_storage_path
+from esphome.types import ConfigType
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def compiled_config_path(config_filename: str) -> Path:
+    """Path to the cached validated config alongside the storage sidecar."""
+    return CORE.data_dir / "storage" / f"{config_filename}.validated.yaml"
+
+
+def _cache_is_fresh(cache_path: Path, source_path: Path) -> bool:
+    """True iff the cache file exists and isn't older than the source."""
+    try:
+        return cache_path.stat().st_mtime >= source_path.stat().st_mtime
+    except OSError:
+        return False
+
+
+def save_compiled_config(config: ConfigType) -> None:
+    """Write the validated-config cache. Always-write so mtime stays fresh.
+
+    Mode 0600 because show_secrets=True resolves !secret inline.
+    Failures are non-fatal: the fast path falls back to read_config.
+    """
+    from esphome import yaml_util
+
+    try:
+        rendered = yaml_util.dump(config, show_secrets=True)
+        write_file(compiled_config_path(CORE.config_filename), rendered, private=True)
+    except Exception as err:  # pylint: disable=broad-except
+        _LOGGER.debug("Skipping compiled config cache write: %s", err)
+
+
+def load_compiled_config(conf_path: Path) -> ConfigType | None:
+    """Load the cached validated config and apply storage metadata to CORE.
+
+    Returns None (caller falls back to read_config) when the cache is
+    missing, older than the source YAML, unparseable, or the sidecar
+    is incomplete.
+    """
+    cache_path = compiled_config_path(conf_path.name)
+    if not _cache_is_fresh(cache_path, conf_path):
+        return None
+
+    from esphome import yaml_util
+
+    try:
+        config = yaml_util.load_yaml(cache_path, clear_secrets=False)
+    except Exception:  # pylint: disable=broad-except
+        return None
+
+    storage = StorageJSON.load(ext_storage_path(conf_path.name))
+    if storage is None:
+        return None
+    # apply_to_core assumes a real compile wrote the sidecar; wizard-only
+    # sidecars leave both of these unset and can't drive upload/logs.
+    if not storage.core_platform and not storage.target_platform:
+        return None
+    storage.apply_to_core()
+    return config

esphome/components/a01nyub/a01nyub.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a01nyub {
+namespace esphome::a01nyub {
 
 static const char *const TAG = "a01nyub.sensor";
 
@@ -42,5 +41,4 @@ void A01nyubComponent::check_buffer_() {
 
 void A01nyubComponent::dump_config() { LOG_SENSOR("", "A01nyub Sensor", this); }
 
-}  // namespace a01nyub
-}  // namespace esphome
+}  // namespace esphome::a01nyub

esphome/components/a01nyub/a01nyub.h

@@ -6,8 +6,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome {
-namespace a01nyub {
+namespace esphome::a01nyub {
 
 class A01nyubComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -23,5 +22,4 @@ class A01nyubComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace a01nyub
-}  // namespace esphome
+}  // namespace esphome::a01nyub

esphome/components/a02yyuw/a02yyuw.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a02yyuw {
+namespace esphome::a02yyuw {
 
 static const char *const TAG = "a02yyuw.sensor";
 
@@ -41,5 +40,4 @@ void A02yyuwComponent::check_buffer_() {
 
 void A02yyuwComponent::dump_config() { LOG_SENSOR("", "A02yyuw Sensor", this); }
 
-}  // namespace a02yyuw
-}  // namespace esphome
+}  // namespace esphome::a02yyuw

esphome/components/a02yyuw/a02yyuw.h

@@ -6,8 +6,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome {
-namespace a02yyuw {
+namespace esphome::a02yyuw {
 
 class A02yyuwComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -23,5 +22,4 @@ class A02yyuwComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace a02yyuw
-}  // namespace esphome
+}  // namespace esphome::a02yyuw

esphome/components/a4988/a4988.cpp

@@ -1,8 +1,7 @@
 #include "a4988.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a4988 {
+namespace esphome::a4988 {
 
 static const char *const TAG = "a4988.stepper";
 
@@ -51,5 +50,4 @@ void A4988::loop() {
   this->step_pin_->digital_write(false);
 }
 
-}  // namespace a4988
-}  // namespace esphome
+}  // namespace esphome::a4988

esphome/components/a4988/a4988.h

@@ -4,8 +4,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/stepper/stepper.h"
 
-namespace esphome {
-namespace a4988 {
+namespace esphome::a4988 {
 
 class A4988 : public stepper::Stepper, public Component {
  public:
@@ -25,5 +24,4 @@ class A4988 : public stepper::Stepper, public Component {
   HighFrequencyLoopRequester high_freq_;
 };
 
-}  // namespace a4988
-}  // namespace esphome
+}  // namespace esphome::a4988

esphome/components/absolute_humidity/absolute_humidity.cpp

@@ -1,22 +1,29 @@
 #include "esphome/core/log.h"
 #include "absolute_humidity.h"
 
-namespace esphome {
-namespace absolute_humidity {
+namespace esphome::absolute_humidity {
 
-static const char *const TAG = "absolute_humidity.sensor";
+static const char *const TAG{"absolute_humidity.sensor"};
 
 void AbsoluteHumidityComponent::setup() {
+  this->temperature_sensor_->add_on_state_callback([this](float state) {
+    this->temperature_ = state;
+    this->enable_loop();
+  });
   ESP_LOGD(TAG, "  Added callback for temperature '%s'", this->temperature_sensor_->get_name().c_str());
-  this->temperature_sensor_->add_on_state_callback([this](float state) { this->temperature_callback_(state); });
+  // Get initial value
   if (this->temperature_sensor_->has_state()) {
-    this->temperature_callback_(this->temperature_sensor_->get_state());
+    this->temperature_ = this->temperature_sensor_->get_state();
   }
 
+  this->humidity_sensor_->add_on_state_callback([this](float state) {
+    this->humidity_ = state;
+    this->enable_loop();
+  });
   ESP_LOGD(TAG, "  Added callback for relative humidity '%s'", this->humidity_sensor_->get_name().c_str());
-  this->humidity_sensor_->add_on_state_callback([this](float state) { this->humidity_callback_(state); });
+  // Get initial value
   if (this->humidity_sensor_->has_state()) {
-    this->humidity_callback_(this->humidity_sensor_->get_state());
+    this->humidity_ = this->humidity_sensor_->get_state();
   }
 }
 
@@ -45,17 +52,13 @@ void AbsoluteHumidityComponent::dump_config() {
                 this->temperature_sensor_->get_name().c_str(), this->humidity_sensor_->get_name().c_str());
 }
 
-float AbsoluteHumidityComponent::get_setup_priority() const { return setup_priority::DATA; }
-
 void AbsoluteHumidityComponent::loop() {
-  if (!this->next_update_) {
-    return;
-  }
-  this->next_update_ = false;
+  // Only run once
+  this->disable_loop();
 
   // Ensure we have source data
-  const bool no_temperature = std::isnan(this->temperature_);
-  const bool no_humidity = std::isnan(this->humidity_);
+  const bool no_temperature{std::isnan(this->temperature_)};
+  const bool no_humidity{std::isnan(this->humidity_)};
   if (no_temperature || no_humidity) {
     if (no_temperature) {
       ESP_LOGW(TAG, "No valid state from temperature sensor!");
@@ -69,9 +72,9 @@ void AbsoluteHumidityComponent::loop() {
   }
 
   // Convert to desired units
-  const float temperature_c = this->temperature_;
-  const float temperature_k = temperature_c + 273.15;
-  const float hr = this->humidity_ / 100;
+  const float temperature_c{this->temperature_};
+  const float temperature_k{temperature_c + 273.15f};
+  const float hr{this->humidity_ / 100.0f};
 
   // Calculate saturation vapor pressure
   float es;
@@ -92,12 +95,9 @@ void AbsoluteHumidityComponent::loop() {
   }
 
   // Calculate absolute humidity
-  const float absolute_humidity = vapor_density(es, hr, temperature_k);
+  const float absolute_humidity{vapor_density(es, hr, temperature_k)};
 
-  ESP_LOGD(TAG,
-           "Saturation vapor pressure %f kPa\n"
-           "Publishing absolute humidity %f g/m³",
-           es, absolute_humidity);
+  ESP_LOGD(TAG, "Saturation vapor pressure %f kPa, absolute humidity %f g/m³", es, absolute_humidity);
 
   // Publish absolute humidity
   this->status_clear_warning();
@@ -108,16 +108,16 @@ void AbsoluteHumidityComponent::loop() {
 // More accurate than Tetens in normal meteorologic conditions
 float AbsoluteHumidityComponent::es_buck(float temperature_c) {
   float a, b, c, d;
-  if (temperature_c >= 0) {
-    a = 0.61121;
-    b = 18.678;
-    c = 234.5;
-    d = 257.14;
+  if (temperature_c >= 0.0f) {
+    a = 0.61121f;
+    b = 18.678f;
+    c = 234.5f;
+    d = 257.14f;
   } else {
-    a = 0.61115;
-    b = 18.678;
-    c = 233.7;
-    d = 279.82;
+    a = 0.61115f;
+    b = 18.678f;
+    c = 233.7f;
+    d = 279.82f;
   }
   return a * expf((b - (temperature_c / c)) * (temperature_c / (d + temperature_c)));
 }
@@ -125,14 +125,14 @@ float AbsoluteHumidityComponent::es_buck(float temperature_c) {
 // Tetens equation (https://en.wikipedia.org/wiki/Tetens_equation)
 float AbsoluteHumidityComponent::es_tetens(float temperature_c) {
   float a, b;
-  if (temperature_c >= 0) {
-    a = 17.27;
-    b = 237.3;
+  if (temperature_c >= 0.0f) {
+    a = 17.27f;
+    b = 237.3f;
   } else {
-    a = 21.875;
-    b = 265.5;
+    a = 21.875f;
+    b = 265.5f;
   }
-  return 0.61078 * expf((a * temperature_c) / (temperature_c + b));
+  return 0.61078f * expf((a * temperature_c) / (temperature_c + b));
 }
 
 // Wobus equation
@@ -151,18 +151,18 @@ float AbsoluteHumidityComponent::es_wobus(float t) {
   //
   //     Baker, Schlatter  17-MAY-1982     Original version.
 
-  const float c0 = +0.99999683e00;
-  const float c1 = -0.90826951e-02;
-  const float c2 = +0.78736169e-04;
-  const float c3 = -0.61117958e-06;
-  const float c4 = +0.43884187e-08;
-  const float c5 = -0.29883885e-10;
-  const float c6 = +0.21874425e-12;
-  const float c7 = -0.17892321e-14;
-  const float c8 = +0.11112018e-16;
-  const float c9 = -0.30994571e-19;
-  const float p = c0 + t * (c1 + t * (c2 + t * (c3 + t * (c4 + t * (c5 + t * (c6 + t * (c7 + t * (c8 + t * (c9)))))))));
-  return 0.61078 / pow(p, 8);
+  constexpr float c0{+0.99999683e+00f};
+  constexpr float c1{-0.90826951e-02f};
+  constexpr float c2{+0.78736169e-04f};
+  constexpr float c3{-0.61117958e-06f};
+  constexpr float c4{+0.43884187e-08f};
+  constexpr float c5{-0.29883885e-10f};
+  constexpr float c6{+0.21874425e-12f};
+  constexpr float c7{-0.17892321e-14f};
+  constexpr float c8{+0.11112018e-16f};
+  constexpr float c9{-0.30994571e-19f};
+  const float p{c0 + t * (c1 + t * (c2 + t * (c3 + t * (c4 + t * (c5 + t * (c6 + t * (c7 + t * (c8 + t * (c9)))))))))};
+  return 0.61078f / powf(p, 8.0f);
 }
 
 // From https://www.environmentalbiophysics.org/chalk-talk-how-to-calculate-absolute-humidity/
@@ -173,11 +173,10 @@ float AbsoluteHumidityComponent::vapor_density(float es, float hr, float ta) {
   // hr = relative humidity [0-1]
   // ta = absolute temperature (K)
 
-  const float ea = hr * es * 1000;   // vapor pressure of the air (Pa)
-  const float mw = 18.01528;         // molar mass of water (g⋅mol⁻¹)
-  const float r = 8.31446261815324;  // molar gas constant (J⋅K⁻¹)
+  const float ea{hr * es * 1000.0f};  // vapor pressure of the air (Pa)
+  const float mw{18.01528f};          // molar mass of water (g⋅mol⁻¹)
+  const float r{8.31446261815324f};   // molar gas constant (J⋅K⁻¹)
   return (ea * mw) / (r * ta);
 }
 
-}  // namespace absolute_humidity
-}  // namespace esphome
+}  // namespace esphome::absolute_humidity

esphome/components/absolute_humidity/absolute_humidity.h

@@ -3,8 +3,7 @@
 #include "esphome/core/component.h"
 #include "esphome/components/sensor/sensor.h"
 
-namespace esphome {
-namespace absolute_humidity {
+namespace esphome::absolute_humidity {
 
 /// Enum listing all implemented saturation vapor pressure equations.
 enum SaturationVaporPressureEquation {
@@ -16,27 +15,15 @@ enum SaturationVaporPressureEquation {
 /// This class implements calculation of absolute humidity from temperature and relative humidity.
 class AbsoluteHumidityComponent : public sensor::Sensor, public Component {
  public:
-  AbsoluteHumidityComponent() = default;
-
   void set_temperature_sensor(sensor::Sensor *temperature_sensor) { this->temperature_sensor_ = temperature_sensor; }
   void set_humidity_sensor(sensor::Sensor *humidity_sensor) { this->humidity_sensor_ = humidity_sensor; }
   void set_equation(SaturationVaporPressureEquation equation) { this->equation_ = equation; }
 
   void setup() override;
   void dump_config() override;
-  float get_setup_priority() const override;
   void loop() override;
 
  protected:
-  void temperature_callback_(float state) {
-    this->next_update_ = true;
-    this->temperature_ = state;
-  }
-  void humidity_callback_(float state) {
-    this->next_update_ = true;
-    this->humidity_ = state;
-  }
-
   /** Buck equation for saturation vapor pressure in kPa.
    *
    * @param temperature_c Air temperature in °C.
@@ -58,19 +45,15 @@ class AbsoluteHumidityComponent : public sensor::Sensor, public Component {
    * @param es Saturation vapor pressure in kPa.
    * @param hr Relative humidity 0 to 1.
    * @param ta Absolute temperature in K.
-   * @param heater_duration The duration in ms that the heater should turn on for when measuring.
    */
   static float vapor_density(float es, float hr, float ta);
 
   sensor::Sensor *temperature_sensor_{nullptr};
   sensor::Sensor *humidity_sensor_{nullptr};
 
-  bool next_update_{false};
-
   float temperature_{NAN};
   float humidity_{NAN};
   SaturationVaporPressureEquation equation_;
 };
 
-}  // namespace absolute_humidity
-}  // namespace esphome
+}  // namespace esphome::absolute_humidity

esphome/components/ac_dimmer/ac_dimmer.cpp

@@ -190,7 +190,7 @@ void AcDimmer::setup() {
     this->zero_cross_pin_->setup();
     this->store_.zero_cross_pin = this->zero_cross_pin_->to_isr();
     this->zero_cross_pin_->attach_interrupt(&AcDimmerDataStore::s_gpio_intr, &this->store_,
-                                            gpio::INTERRUPT_FALLING_EDGE);
+                                            this->zero_cross_interrupt_type_);
   }
 
 #ifdef USE_ESP8266
@@ -199,12 +199,19 @@ void AcDimmer::setup() {
   setTimer1Callback(&timer_interrupt);
 #endif
 #ifdef USE_ESP32
-  dimmer_timer = timer_begin(TIMER_FREQUENCY_HZ);
-  timer_attach_interrupt(dimmer_timer, &AcDimmerDataStore::s_timer_intr);
-  // For ESP32, we can't use dynamic interval calculation because the timerX functions
-  // are not callable from ISR (placed in flash storage).
-  // Here we just use an interrupt firing every 50 µs.
-  timer_alarm(dimmer_timer, TIMER_INTERVAL_US, true, 0);
+  if (dimmer_timer == nullptr) {
+    dimmer_timer = timer_begin(TIMER_FREQUENCY_HZ);
+    if (dimmer_timer == nullptr) {
+      ESP_LOGE(TAG, "Failed to create GPTimer for AC dimmer");
+      this->mark_failed();
+      return;
+    }
+    timer_attach_interrupt(dimmer_timer, &AcDimmerDataStore::s_timer_intr);
+    // For ESP32, we can't use dynamic interval calculation because the timerX functions
+    // are not callable from ISR (placed in flash storage).
+    // Here we just use an interrupt firing every 50 µs.
+    timer_alarm(dimmer_timer, TIMER_INTERVAL_US, true, 0);
+  }
 #endif
 }
 
@@ -219,19 +226,25 @@ void AcDimmer::write_state(float state) {
 void AcDimmer::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "AcDimmer:\n"
-                "   Min Power: %.1f%%\n"
-                "   Init with half cycle: %s",
+                "  Min Power: %.1f%%\n"
+                "  Init with half cycle: %s",
                 this->store_.min_power / 10.0f, YESNO(this->init_with_half_cycle_));
   LOG_PIN("  Output Pin: ", this->gate_pin_);
   LOG_PIN("  Zero-Cross Pin: ", this->zero_cross_pin_);
-  if (method_ == DIM_METHOD_LEADING_PULSE) {
-    ESP_LOGCONFIG(TAG, "   Method: leading pulse");
-  } else if (method_ == DIM_METHOD_LEADING) {
-    ESP_LOGCONFIG(TAG, "   Method: leading");
+  if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_RISING_EDGE) {
+    ESP_LOGCONFIG(TAG, "  Interrupt Type: rising");
+  } else if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_FALLING_EDGE) {
+    ESP_LOGCONFIG(TAG, "  Interrupt Type: falling");
   } else {
-    ESP_LOGCONFIG(TAG, "   Method: trailing");
+    ESP_LOGCONFIG(TAG, "  Interrupt Type: any");
+  }
+  if (method_ == DIM_METHOD_LEADING_PULSE) {
+    ESP_LOGCONFIG(TAG, "  Method: leading pulse");
+  } else if (method_ == DIM_METHOD_LEADING) {
+    ESP_LOGCONFIG(TAG, "  Method: leading");
+  } else {
+    ESP_LOGCONFIG(TAG, "  Method: trailing");
   }
-
   LOG_FLOAT_OUTPUT(this);
   ESP_LOGV(TAG, "  Estimated Frequency: %.3fHz", 1e6f / this->store_.cycle_time_us / 2);
 }

esphome/components/ac_dimmer/ac_dimmer.h

@@ -48,6 +48,7 @@ class AcDimmer : public output::FloatOutput, public Component {
   void dump_config() override;
   void set_gate_pin(InternalGPIOPin *gate_pin) { gate_pin_ = gate_pin; }
   void set_zero_cross_pin(InternalGPIOPin *zero_cross_pin) { zero_cross_pin_ = zero_cross_pin; }
+  void set_zero_cross_interrupt_type(gpio::InterruptType type) { zero_cross_interrupt_type_ = type; }
   void set_init_with_half_cycle(bool init_with_half_cycle) { init_with_half_cycle_ = init_with_half_cycle; }
   void set_method(DimMethod method) { method_ = method; }
 
@@ -56,6 +57,7 @@ class AcDimmer : public output::FloatOutput, public Component {
 
   InternalGPIOPin *gate_pin_;
   InternalGPIOPin *zero_cross_pin_;
+  gpio::InterruptType zero_cross_interrupt_type_;
   AcDimmerDataStore store_;
   bool init_with_half_cycle_;
   DimMethod method_;

esphome/components/ac_dimmer/output.py

@@ -7,6 +7,8 @@ from esphome.core import CORE
 
 CODEOWNERS = ["@glmnet"]
 
+gpio_ns = cg.esphome_ns.namespace("gpio")
+
 ac_dimmer_ns = cg.esphome_ns.namespace("ac_dimmer")
 AcDimmer = ac_dimmer_ns.class_("AcDimmer", output.FloatOutput, cg.Component)
 
@@ -17,15 +19,26 @@ DIM_METHODS = {
     "TRAILING": DimMethod.DIM_METHOD_TRAILING,
 }
 
+ZC_INTERRUPT_TYPES = {
+    "RISING": gpio_ns.INTERRUPT_RISING_EDGE,
+    "FALLING": gpio_ns.INTERRUPT_FALLING_EDGE,
+    "ANY": gpio_ns.INTERRUPT_ANY_EDGE,
+}
+
 CONF_GATE_PIN = "gate_pin"
 CONF_ZERO_CROSS_PIN = "zero_cross_pin"
 CONF_INIT_WITH_HALF_CYCLE = "init_with_half_cycle"
+CONF_ZERO_CROSS_INTERRUPT_TYPE = "zero_cross_interrupt_type"
+
 CONFIG_SCHEMA = cv.All(
     output.FLOAT_OUTPUT_SCHEMA.extend(
         {
             cv.Required(CONF_ID): cv.declare_id(AcDimmer),
             cv.Required(CONF_GATE_PIN): pins.internal_gpio_output_pin_schema,
             cv.Required(CONF_ZERO_CROSS_PIN): pins.internal_gpio_input_pin_schema,
+            cv.Optional(CONF_ZERO_CROSS_INTERRUPT_TYPE, default="FALLING"): cv.enum(
+                ZC_INTERRUPT_TYPES, upper=True, space="_"
+            ),
             cv.Optional(CONF_INIT_WITH_HALF_CYCLE, default=True): cv.boolean,
             cv.Optional(CONF_METHOD, default="leading pulse"): cv.enum(
                 DIM_METHODS, upper=True, space="_"
@@ -54,5 +67,6 @@ async def to_code(config):
     cg.add(var.set_gate_pin(pin))
     pin = await cg.gpio_pin_expression(config[CONF_ZERO_CROSS_PIN])
     cg.add(var.set_zero_cross_pin(pin))
+    cg.add(var.set_zero_cross_interrupt_type(config[CONF_ZERO_CROSS_INTERRUPT_TYPE]))
     cg.add(var.set_init_with_half_cycle(config[CONF_INIT_WITH_HALF_CYCLE]))
     cg.add(var.set_method(config[CONF_METHOD]))

esphome/components/adalight/adalight_light_effect.cpp

@@ -1,8 +1,7 @@
 #include "adalight_light_effect.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adalight {
+namespace esphome::adalight {
 
 static const char *const TAG = "adalight_light_effect";
 
@@ -129,7 +128,7 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   uint8_t *led_data = &frame_[6];
 
   for (int led = 0; led < accepted_led_count; led++, led_data += 3) {
-    auto white = std::min(std::min(led_data[0], led_data[1]), led_data[2]);
+    auto white = std::min({led_data[0], led_data[1], led_data[2]});
 
     it[led].set(Color(led_data[0], led_data[1], led_data[2], white));
   }
@@ -138,5 +137,4 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   return CONSUMED;
 }
 
-}  // namespace adalight
-}  // namespace esphome
+}  // namespace esphome::adalight

esphome/components/adalight/adalight_light_effect.h

@@ -6,8 +6,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace adalight {
+namespace esphome::adalight {
 
 class AdalightLightEffect : public light::AddressableLightEffect, public uart::UARTDevice {
  public:
@@ -35,5 +34,4 @@ class AdalightLightEffect : public light::AddressableLightEffect, public uart::U
   std::vector<uint8_t> frame_;
 };
 
-}  // namespace adalight
-}  // namespace esphome
+}  // namespace esphome::adalight

esphome/components/adc/adc_sensor.h

@@ -17,12 +17,12 @@
 #include <zephyr/drivers/adc.h>
 #endif
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 #ifdef USE_ESP32
 // clang-format off
-#if (ESP_IDF_VERSION_MAJOR == 5 && \
+#if ESP_IDF_VERSION_MAJOR >= 6 || \
+    (ESP_IDF_VERSION_MAJOR == 5 && \
      ((ESP_IDF_VERSION_MINOR == 0 && ESP_IDF_VERSION_PATCH >= 5) || \
       (ESP_IDF_VERSION_MINOR == 1 && ESP_IDF_VERSION_PATCH >= 3) || \
       (ESP_IDF_VERSION_MINOR >= 2)) \
@@ -68,11 +68,6 @@ class ADCSensor : public sensor::Sensor, public PollingComponent, public voltage
   /// This method is called during the ESPHome setup process to log the configuration.
   void dump_config() override;
 
-  /// Return the setup priority for this component.
-  /// Components with higher priority are initialized earlier during setup.
-  /// @return A float representing the setup priority.
-  float get_setup_priority() const override;
-
 #ifdef USE_ZEPHYR
   /// Set the ADC channel to be used by the ADC sensor.
   /// @param channel Pointer to an adc_dt_spec structure representing the ADC channel.
@@ -166,5 +161,4 @@ class ADCSensor : public sensor::Sensor, public PollingComponent, public voltage
 #endif
 };
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc

esphome/components/adc/adc_sensor_common.cpp

@@ -1,8 +1,7 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.common";
 
@@ -79,7 +78,4 @@ void ADCSensor::set_sample_count(uint8_t sample_count) {
 
 void ADCSensor::set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
 
-float ADCSensor::get_setup_priority() const { return setup_priority::DATA; }
-
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc

esphome/components/adc/adc_sensor_esp32.cpp

@@ -2,9 +2,9 @@
 
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
+#include <cinttypes>
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.esp32";
 
@@ -42,11 +42,11 @@ void ADCSensor::setup() {
     adc_oneshot_unit_init_cfg_t init_config = {};  // Zero initialize
     init_config.unit_id = this->adc_unit_;
     init_config.ulp_mode = ADC_ULP_MODE_DISABLE;
-#if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
-    USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2
+#if USE_ESP32_VARIANT_ESP32C2 || USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || \
+    USE_ESP32_VARIANT_ESP32C6 || USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2
     init_config.clk_src = ADC_DIGI_CLK_SRC_DEFAULT;
-#endif  // USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 ||
-        // USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2
+#endif  // USE_ESP32_VARIANT_ESP32C2 || USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 ||
+        // USE_ESP32_VARIANT_ESP32C6 || USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2
     esp_err_t err = adc_oneshot_new_unit(&init_config, &ADCSensor::shared_adc_handles[this->adc_unit_]);
     if (err != ESP_OK) {
       ESP_LOGE(TAG, "Error initializing %s: %d", LOG_STR_ARG(adc_unit_to_str(this->adc_unit_)), err);
@@ -76,7 +76,7 @@ void ADCSensor::setup() {
 
 #if USE_ESP32_VARIANT_ESP32C3 || USE_ESP32_VARIANT_ESP32C5 || USE_ESP32_VARIANT_ESP32C6 || \
     USE_ESP32_VARIANT_ESP32C61 || USE_ESP32_VARIANT_ESP32H2 || USE_ESP32_VARIANT_ESP32P4 || USE_ESP32_VARIANT_ESP32S3
-    // RISC-V variants and S3 use curve fitting calibration
+    // RISC-V variants (except C2) and S3 use curve fitting calibration
     adc_cali_curve_fitting_config_t cali_config = {};  // Zero initialize first
 #if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0)
     cali_config.chan = this->channel_;
@@ -94,14 +94,14 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Curve fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#else  // Other ESP32 variants use line fitting calibration
+#else  // ESP32, ESP32-S2, and ESP32-C2 use line fitting calibration
     adc_cali_line_fitting_config_t cali_config = {
       .unit_id = this->adc_unit_,
       .atten = this->attenuation_,
       .bitwidth = ADC_BITWIDTH_DEFAULT,
-#if !defined(USE_ESP32_VARIANT_ESP32S2)
+#if !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
       .default_vref = 1100,  // Default reference voltage in mV
-#endif  // !defined(USE_ESP32_VARIANT_ESP32S2)
+#endif  // !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
     };
     err = adc_cali_create_scheme_line_fitting(&cali_config, &handle);
     if (err == ESP_OK) {
@@ -112,7 +112,7 @@ void ADCSensor::setup() {
       ESP_LOGW(TAG, "Line fitting calibration failed with error %d, will use uncalibrated readings", err);
       this->setup_flags_.calibration_complete = false;
     }
-#endif  // USE_ESP32_VARIANT_ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
   }
 
   this->setup_flags_.init_complete = true;
@@ -189,7 +189,7 @@ float ADCSensor::sample_fixed_attenuation_() {
         adc_cali_delete_scheme_curve_fitting(this->calibration_handle_);
 #else   // Other ESP32 variants use line fitting calibration
         adc_cali_delete_scheme_line_fitting(this->calibration_handle_);
-#endif  // USE_ESP32_VARIANT_ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
+#endif  // ESP32C3 || ESP32C5 || ESP32C6 || ESP32C61 || ESP32H2 || ESP32P4 || ESP32S3
         this->calibration_handle_ = nullptr;
       }
     }
@@ -247,7 +247,7 @@ float ADCSensor::sample_autorange_() {
       .unit_id = this->adc_unit_,
       .atten = atten,
       .bitwidth = ADC_BITWIDTH_DEFAULT,
-#if !defined(USE_ESP32_VARIANT_ESP32S2)
+#if !defined(USE_ESP32_VARIANT_ESP32S2) && !defined(USE_ESP32_VARIANT_ESP32C2)
       .default_vref = 1100,
 #endif
     };
@@ -346,7 +346,8 @@ float ADCSensor::sample_autorange_() {
   ESP_LOGVV(TAG, "Autorange summary:");
   ESP_LOGVV(TAG, "  Raw readings: 12db=%d, 6db=%d, 2.5db=%d, 0db=%d", raw12, raw6, raw2, raw0);
   ESP_LOGVV(TAG, "  Voltages: 12db=%.6f, 6db=%.6f, 2.5db=%.6f, 0db=%.6f", mv12, mv6, mv2, mv0);
-  ESP_LOGVV(TAG, "  Coefficients: c12=%u, c6=%u, c2=%u, c0=%u, sum=%u", c12, c6, c2, c0, csum);
+  ESP_LOGVV(TAG, "  Coefficients: c12=%" PRIu32 ", c6=%" PRIu32 ", c2=%" PRIu32 ", c0=%" PRIu32 ", sum=%" PRIu32, c12,
+            c6, c2, c0, csum);
 
   if (csum == 0) {
     ESP_LOGE(TAG, "Invalid weight sum in autorange calculation");
@@ -354,13 +355,14 @@ float ADCSensor::sample_autorange_() {
   }
 
   const float final_result = (mv12 * c12 + mv6 * c6 + mv2 * c2 + mv0 * c0) / csum;
-  ESP_LOGV(TAG, "Autorange final: (%.6f*%u + %.6f*%u + %.6f*%u + %.6f*%u)/%u = %.6fV", mv12, c12, mv6, c6, mv2, c2, mv0,
-           c0, csum, final_result);
+  ESP_LOGV(TAG,
+           "Autorange final: (%.6f*%" PRIu32 " + %.6f*%" PRIu32 " + %.6f*%" PRIu32 " + %.6f*%" PRIu32 ")/%" PRIu32
+           " = %.6fV",
+           mv12, c12, mv6, c6, mv2, c2, mv0, c0, csum, final_result);
 
   return final_result;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_ESP32

esphome/components/adc/adc_sensor_esp8266.cpp

@@ -11,8 +11,7 @@ ADC_MODE(ADC_VCC)
 #include <Arduino.h>
 #endif  // USE_ADC_SENSOR_VCC
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.esp8266";
 
@@ -55,7 +54,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1024.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_ESP8266

esphome/components/adc/adc_sensor_libretiny.cpp

@@ -3,8 +3,7 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.libretiny";
 
@@ -48,7 +47,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1000.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_LIBRETINY

esphome/components/adc/adc_sensor_rp2040.cpp

@@ -8,8 +8,14 @@
 #endif  // CYW43_USES_VSYS_PIN
 #include <hardware/adc.h>
 
-namespace esphome {
-namespace adc {
+// PICO_VSYS_PIN is defined in pico-sdk board headers (e.g. boards/pico2.h),
+// but the Arduino framework's config_autogen.h includes a generic board header
+// that doesn't define it. Provide the standard value (pin 29) as a fallback.
+#ifndef PICO_VSYS_PIN
+#define PICO_VSYS_PIN 29  // NOLINT(cppcoreguidelines-macro-usage)
+#endif
+
+namespace esphome::adc {
 
 static const char *const TAG = "adc.rp2040";
 
@@ -91,7 +97,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() * 3.3f / 4096.0f * coeff;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_RP2040

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -5,8 +5,7 @@
 
 #include "hal/nrf_saadc.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.zephyr";
 
@@ -202,6 +201,5 @@ float ADCSensor::sample() {
   return val_mv / 1000.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 #endif

esphome/components/adc/sensor.py

@@ -2,7 +2,11 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
-from esphome.components.esp32 import get_esp32_variant
+from esphome.components.esp32 import (
+    get_esp32_variant,
+    include_builtin_idf_component,
+    require_adc_oneshot_iram,
+)
 from esphome.components.nrf52.const import AIN_TO_GPIO, EXTRA_ADC
 from esphome.components.zephyr import (
     zephyr_add_overlay,
@@ -24,6 +28,7 @@ from esphome.const import (
     PlatformFramework,
 )
 from esphome.core import CORE
+from esphome.types import ConfigType
 
 from . import (
     ATTENUATION_MODES,
@@ -65,6 +70,13 @@ def validate_config(config):
     return config
 
 
+def _require_adc_iram(config: ConfigType) -> ConfigType:
+    """Register ADC oneshot IRAM requirement during config validation."""
+    if CORE.is_esp32:
+        require_adc_oneshot_iram()
+    return config
+
+
 ADCSensor = adc_ns.class_(
     "ADCSensor", sensor.Sensor, cg.PollingComponent, voltage_sampler.VoltageSampler
 )
@@ -95,6 +107,7 @@ CONFIG_SCHEMA = cv.All(
     )
     .extend(cv.polling_component_schema("60s")),
     validate_config,
+    _require_adc_iram,
 )
 
 CONF_ADC_CHANNEL_ID = "adc_channel_id"
@@ -118,6 +131,9 @@ async def to_code(config):
     cg.add(var.set_sampling_mode(config[CONF_SAMPLING_MODE]))
 
     if CORE.is_esp32:
+        # Re-enable ESP-IDF's ADC driver (excluded by default to save compile time)
+        include_builtin_idf_component("esp_adc")
+
         if attenuation := config.get(CONF_ATTENUATION):
             if attenuation == "auto":
                 cg.add(var.set_autorange(cg.global_ns.true))
@@ -160,21 +176,21 @@ async def to_code(config):
         zephyr_add_user("io-channels", f"<&adc {channel_id}>")
         zephyr_add_overlay(
             f"""
-&adc {{
-    #address-cells = <1>;
-    #size-cells = <0>;
+                &adc {{
+                    #address-cells = <1>;
+                    #size-cells = <0>;
 
-    channel@{channel_id} {{
-        reg = <{channel_id}>;
-        zephyr,gain = "{gain}";
-        zephyr,reference = "ADC_REF_INTERNAL";
-        zephyr,acquisition-time = <ADC_ACQ_TIME_DEFAULT>;
-        zephyr,input-positive = <NRF_SAADC_{pin_number}>;
-        zephyr,resolution = <14>;
-        zephyr,oversampling = <8>;
-    }};
-}};
-"""
+                    channel@{channel_id} {{
+                        reg = <{channel_id}>;
+                        zephyr,gain = "{gain}";
+                        zephyr,reference = "ADC_REF_INTERNAL";
+                        zephyr,acquisition-time = <ADC_ACQ_TIME_DEFAULT>;
+                        zephyr,input-positive = <NRF_SAADC_{pin_number}>;
+                        zephyr,resolution = <14>;
+                        zephyr,oversampling = <8>;
+                    }};
+                }};
+            """
         )
 
 

esphome/components/adc128s102/adc128s102.cpp

@@ -1,8 +1,7 @@
 #include "adc128s102.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 static const char *const TAG = "adc128s102";
 
@@ -28,5 +27,4 @@ uint16_t ADC128S102::read_data(uint8_t channel) {
   return digital_value;
 }
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/adc128s102.h

@@ -4,8 +4,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/spi/spi.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 class ADC128S102 : public Component,
                    public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW, spi::CLOCK_PHASE_LEADING,
@@ -19,5 +18,4 @@ class ADC128S102 : public Component,
   uint16_t read_data(uint8_t channel);
 };
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/sensor/adc128s102_sensor.cpp

@@ -2,15 +2,12 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 static const char *const TAG = "adc128s102.sensor";
 
 ADC128S102Sensor::ADC128S102Sensor(uint8_t channel) : channel_(channel) {}
 
-float ADC128S102Sensor::get_setup_priority() const { return setup_priority::DATA; }
-
 void ADC128S102Sensor::dump_config() {
   LOG_SENSOR("", "ADC128S102 Sensor", this);
   ESP_LOGCONFIG(TAG, "  Pin: %u", this->channel_);
@@ -20,5 +17,4 @@ void ADC128S102Sensor::dump_config() {
 float ADC128S102Sensor::sample() { return this->parent_->read_data(this->channel_); }
 void ADC128S102Sensor::update() { this->publish_state(this->sample()); }
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/sensor/adc128s102_sensor.h

@@ -7,8 +7,7 @@
 
 #include "../adc128s102.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 class ADC128S102Sensor : public PollingComponent,
                          public Parented<ADC128S102>,
@@ -19,11 +18,9 @@ class ADC128S102Sensor : public PollingComponent,
 
   void update() override;
   void dump_config() override;
-  float get_setup_priority() const override;
   float sample() override;
 
  protected:
   uint8_t channel_;
 };
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/addressable_light/addressable_light_display.cpp

@@ -1,8 +1,7 @@
 #include "addressable_light_display.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace addressable_light {
+namespace esphome::addressable_light {
 
 static const char *const TAG = "addressable_light.display";
 
@@ -58,10 +57,12 @@ void HOT AddressableLightDisplay::draw_absolute_pixel_internal(int x, int y, Col
 
   if (this->pixel_mapper_f_.has_value()) {
     // Params are passed by reference, so they may be modified in call.
-    this->addressable_light_buffer_[(*this->pixel_mapper_f_)(x, y)] = color;
+    int index = (*this->pixel_mapper_f_)(x, y);
+    if (index < 0 || static_cast<size_t>(index) >= this->addressable_light_buffer_.size())
+      return;
+    this->addressable_light_buffer_[index] = color;
   } else {
     this->addressable_light_buffer_[y * this->get_width_internal() + x] = color;
   }
 }
-}  // namespace addressable_light
-}  // namespace esphome
+}  // namespace esphome::addressable_light

esphome/components/addressable_light/addressable_light_display.h

@@ -7,8 +7,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace addressable_light {
+namespace esphome::addressable_light {
 
 class AddressableLightDisplay : public display::DisplayBuffer {
  public:
@@ -33,7 +32,7 @@ class AddressableLightDisplay : public display::DisplayBuffer {
         // - Save the current effect index.
         this->last_effect_index_ = light_state_->get_current_effect_index();
         // - Disable any current effect.
-        light_state_->make_call().set_effect(0).perform();
+        light_state_->make_call().set_effect(uint32_t{0}).perform();
       }
     }
     enabled_ = enabled;
@@ -61,5 +60,4 @@ class AddressableLightDisplay : public display::DisplayBuffer {
   optional<uint32_t> last_effect_index_;
   optional<std::function<int(int, int)>> pixel_mapper_f_;
 };
-}  // namespace addressable_light
-}  // namespace esphome
+}  // namespace esphome::addressable_light

esphome/components/ade7880/ade7880.cpp

@@ -13,8 +13,7 @@
 
 #include <cinttypes>
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 static const char *const TAG = "ade7880";
 
@@ -121,7 +120,7 @@ void ADE7880::update() {
     this->update_sensor_from_s32_register16_(chan->forward_active_energy, AFWATTHR, [&chan](float val) {
       return chan->forward_active_energy_total += val / 14400.0f;
     });
-    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, AFWATTHR, [&chan](float val) {
+    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, ARWATTHR, [&chan](float val) {
       return chan->reverse_active_energy_total += val / 14400.0f;
     });
   }
@@ -137,7 +136,7 @@ void ADE7880::update() {
     this->update_sensor_from_s32_register16_(chan->forward_active_energy, BFWATTHR, [&chan](float val) {
       return chan->forward_active_energy_total += val / 14400.0f;
     });
-    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, BFWATTHR, [&chan](float val) {
+    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, BRWATTHR, [&chan](float val) {
       return chan->reverse_active_energy_total += val / 14400.0f;
     });
   }
@@ -153,7 +152,7 @@ void ADE7880::update() {
     this->update_sensor_from_s32_register16_(chan->forward_active_energy, CFWATTHR, [&chan](float val) {
       return chan->forward_active_energy_total += val / 14400.0f;
     });
-    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, CFWATTHR, [&chan](float val) {
+    this->update_sensor_from_s32_register16_(chan->reverse_active_energy, CRWATTHR, [&chan](float val) {
       return chan->reverse_active_energy_total += val / 14400.0f;
     });
   }
@@ -313,5 +312,4 @@ void ADE7880::reset_device_() {
   this->store_.reset_pending = true;
 }
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880.h

@@ -16,8 +16,7 @@
 
 #include "ade7880_registers.h"
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 struct NeutralChannel {
   void set_current(sensor::Sensor *sens) { this->current = sens; }
@@ -125,5 +124,4 @@ class ADE7880 : public i2c::I2CDevice, public PollingComponent {
   void write_u32_register16_(uint16_t a_register, uint32_t value);
 };
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880_i2c.cpp

@@ -9,8 +9,7 @@
 
 #include "ade7880.h"
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 // adapted from https://stackoverflow.com/a/55912127/1886371
 template<size_t Bits, typename T> inline T sign_extend(const T &v) noexcept {
@@ -97,5 +96,4 @@ void ADE7880::write_u32_register16_(uint16_t a_register, uint32_t value) {
   this->write_register16(a_register, reinterpret_cast<uint8_t *>(&out), sizeof(out));
 }
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880_registers.h

@@ -4,8 +4,7 @@
 
 // Source: https://www.analog.com/media/en/technical-documentation/application-notes/AN-1127.pdf
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 // DSP Data Memory RAM registers
 constexpr uint16_t AIGAIN = 0x4380;
@@ -85,6 +84,9 @@ constexpr uint16_t CWATTHR = 0xE402;
 constexpr uint16_t AFWATTHR = 0xE403;
 constexpr uint16_t BFWATTHR = 0xE404;
 constexpr uint16_t CFWATTHR = 0xE405;
+constexpr uint16_t ARWATTHR = 0xE406;
+constexpr uint16_t BRWATTHR = 0xE407;
+constexpr uint16_t CRWATTHR = 0xE408;
 constexpr uint16_t AFVARHR = 0xE409;
 constexpr uint16_t BFVARHR = 0xE40A;
 constexpr uint16_t CFVARHR = 0xE40B;
@@ -239,5 +241,4 @@ constexpr uint8_t DSPWP_SET_RO = (1 << 7);
 // DSPWP_SEL Register Bits
 constexpr uint8_t DSPWP_SEL_SET = 0xAD;
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7953_base/ade7953_base.cpp

@@ -3,11 +3,13 @@
 
 #include <cinttypes>
 
-namespace esphome {
-namespace ade7953_base {
+namespace esphome::ade7953_base {
 
 static const char *const TAG = "ade7953";
 
+constexpr uint16_t CONFIG_DEFAULT = 0x8004u;
+constexpr uint16_t CONFIG_LOCK_BIT = 0x8000u;
+
 static const float ADE_POWER_FACTOR = 154.0f;
 static const float ADE_WATTSEC_POWER_FACTOR = ADE_POWER_FACTOR * ADE_POWER_FACTOR / 3600;
 
@@ -18,7 +20,12 @@ void ADE7953::setup() {
 
   // The chip might take up to 100ms to initialise
   this->set_timeout(100, [this]() {
-    // this->ade_write_8(0x0010, 0x04);
+    // Lock communication interface (SPI or I2C)
+    uint16_t config_v = CONFIG_DEFAULT;
+    this->ade_read_16(CONFIG_16, &config_v);
+    config_v &= static_cast<uint16_t>(~CONFIG_LOCK_BIT);  // Clear the lock bit
+    this->ade_write_16(CONFIG_16, config_v);
+    // Configure optimum settings according to datasheet
     this->ade_write_8(0x00FE, 0xAD);
     this->ade_write_16(0x0120, 0x0030);
     // Set gains
@@ -152,5 +159,4 @@ void ADE7953::update() {
   ADE_PUBLISH(frequency, 223750.0f, 1 + val_16);
 }
 
-}  // namespace ade7953_base
-}  // namespace esphome
+}  // namespace esphome::ade7953_base

esphome/components/ade7953_base/ade7953_base.h

@@ -6,34 +6,37 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_base {
+namespace esphome::ade7953_base {
 
-static const uint8_t PGA_V_8 =
+static constexpr uint8_t PGA_V_8 =
     0x007;  // PGA_V,  (R/W) Default: 0x00, Unsigned, Voltage channel gain configuration (Bits[2:0])
-static const uint8_t PGA_IA_8 =
+static constexpr uint8_t PGA_IA_8 =
     0x008;  // PGA_IA, (R/W) Default: 0x00, Unsigned, Current Channel A gain configuration (Bits[2:0])
-static const uint8_t PGA_IB_8 =
+static constexpr uint8_t PGA_IB_8 =
     0x009;  // PGA_IB, (R/W) Default: 0x00, Unsigned, Current Channel B gain configuration (Bits[2:0])
 
-static const uint32_t AIGAIN_32 =
+static constexpr uint16_t CONFIG_16 = 0x102;  // CONFIG, (R/W) Default: 0x8004, Unsigned, Configuration register
+
+static constexpr uint16_t AIGAIN_32 =
     0x380;  // AIGAIN, (R/W)   Default: 0x400000, Unsigned,Current channel gain (Current Channel A)(32 bit)
-static const uint32_t AVGAIN_32 = 0x381;  // AVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
-static const uint32_t AWGAIN_32 =
+static constexpr uint16_t AVGAIN_32 =
+    0x381;  // AVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
+static constexpr uint16_t AWGAIN_32 =
     0x382;  // AWGAIN, (R/W)   Default: 0x400000, Unsigned,Active power gain (Current Channel A)(32 bit)
-static const uint32_t AVARGAIN_32 =
+static constexpr uint16_t AVARGAIN_32 =
     0x383;  // AVARGAIN, (R/W) Default: 0x400000, Unsigned, Reactive power gain (Current Channel A)(32 bit)
-static const uint32_t AVAGAIN_32 =
+static constexpr uint16_t AVAGAIN_32 =
     0x384;  // AVAGAIN, (R/W)  Default: 0x400000, Unsigned,Apparent power gain (Current Channel A)(32 bit)
 
-static const uint32_t BIGAIN_32 =
+static constexpr uint16_t BIGAIN_32 =
     0x38C;  // BIGAIN, (R/W)   Default: 0x400000, Unsigned,Current channel gain (Current Channel B)(32 bit)
-static const uint32_t BVGAIN_32 = 0x38D;  // BVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
-static const uint32_t BWGAIN_32 =
+static constexpr uint16_t BVGAIN_32 =
+    0x38D;  // BVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
+static constexpr uint16_t BWGAIN_32 =
     0x38E;  // BWGAIN, (R/W)   Default: 0x400000, Unsigned,Active power gain (Current Channel B)(32 bit)
-static const uint32_t BVARGAIN_32 =
+static constexpr uint16_t BVARGAIN_32 =
     0x38F;  // BVARGAIN, (R/W) Default: 0x400000, Unsigned, Reactive power gain (Current Channel B)(32 bit)
-static const uint32_t BVAGAIN_32 =
+static constexpr uint16_t BVAGAIN_32 =
     0x390;  // BVAGAIN, (R/W)  Default: 0x400000, Unsigned,Apparent power gain (Current Channel B)(32 bit)
 
 class ADE7953 : public PollingComponent, public sensor::Sensor {
@@ -127,5 +130,4 @@ class ADE7953 : public PollingComponent, public sensor::Sensor {
   virtual bool ade_read_32(uint16_t reg, uint32_t *value) = 0;
 };
 
-}  // namespace ade7953_base
-}  // namespace esphome
+}  // namespace esphome::ade7953_base

esphome/components/ade7953_i2c/ade7953_i2c.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ade7953_i2c {
+namespace esphome::ade7953_i2c {
 
 static const char *const TAG = "ade7953";
 
@@ -76,5 +75,4 @@ bool AdE7953I2c::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace ade7953_i2c
-}  // namespace esphome
+}  // namespace esphome::ade7953_i2c

esphome/components/ade7953_i2c/ade7953_i2c.h

@@ -8,8 +8,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_i2c {
+namespace esphome::ade7953_i2c {
 
 class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
  public:
@@ -24,5 +23,4 @@ class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace ade7953_i2c
-}  // namespace esphome
+}  // namespace esphome::ade7953_i2c

esphome/components/ade7953_spi/ade7953_spi.cpp

@@ -2,11 +2,13 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ade7953_spi {
+namespace esphome::ade7953_spi {
 
 static const char *const TAG = "ade7953";
 
+// Datasheet requires at least 1.2µs after clearing CONFIG LOCK_BIT before raising CS
+constexpr uint8_t CONFIG_LOCK_SETTLE_US = 2;
+
 void AdE7953Spi::setup() {
   this->spi_setup();
   ade7953_base::ADE7953::setup();
@@ -32,6 +34,9 @@ bool AdE7953Spi::ade_write_16(uint16_t reg, uint16_t value) {
   this->write_byte16(reg);
   this->transfer_byte(0);
   this->write_byte16(value);
+  if (reg == ade7953_base::CONFIG_16) {
+    delayMicroseconds(CONFIG_LOCK_SETTLE_US);
+  }
   this->disable();
   return false;
 }
@@ -77,5 +82,4 @@ bool AdE7953Spi::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace ade7953_spi
-}  // namespace esphome
+}  // namespace esphome::ade7953_spi

esphome/components/ade7953_spi/ade7953_spi.h

@@ -8,11 +8,10 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_spi {
+namespace esphome::ade7953_spi {
 
 class AdE7953Spi : public ade7953_base::ADE7953,
-                   public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH, spi::CLOCK_PHASE_LEADING,
+                   public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH, spi::CLOCK_PHASE_TRAILING,
                                          spi::DATA_RATE_1MHZ> {
  public:
   void setup() override;
@@ -28,5 +27,4 @@ class AdE7953Spi : public ade7953_base::ADE7953,
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace ade7953_spi
-}  // namespace esphome
+}  // namespace esphome::ade7953_spi

esphome/components/ads1115/ads1115.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ads1115 {
+namespace esphome::ads1115 {
 
 static const char *const TAG = "ads1115";
 static const uint8_t ADS1115_REGISTER_CONVERSION = 0x00;
@@ -173,19 +172,8 @@ float ADS1115Component::request_measurement(ADS1115Multiplexer multiplexer, ADS1
   }
 
   if (resolution == ADS1015_12_BITS) {
-    bool negative = (raw_conversion >> 15) == 1;
-
-    // shift raw_conversion as it's only 12-bits, left justified
-    raw_conversion = raw_conversion >> (16 - ADS1015_12_BITS);
-
-    // check if number was negative in order to keep the sign
-    if (negative) {
-      // the number was negative
-      // 1) set the negative bit back
-      raw_conversion |= 0x8000;
-      // 2) reset the former (shifted) negative bit
-      raw_conversion &= 0xF7FF;
-    }
+    // ADS1015 returns 12-bit value left-justified in 16 bits; shift right and sign-extend
+    raw_conversion = static_cast<uint16_t>(static_cast<int16_t>(raw_conversion) >> (16 - ADS1015_12_BITS));
   }
 
   auto signed_conversion = static_cast<int16_t>(raw_conversion);
@@ -219,5 +207,4 @@ float ADS1115Component::request_measurement(ADS1115Multiplexer multiplexer, ADS1
   return millivolts / 1e3f;
 }
 
-}  // namespace ads1115
-}  // namespace esphome
+}  // namespace esphome::ads1115