[dashboard] Test PR for deprecation-comment bot

Trivial docstring tweak under esphome/dashboard/ to verify that the
workflow added in #16378 posts the expected comment. Will be closed
without merging.

.clang-tidy

@@ -5,24 +5,30 @@ Checks: >-
   -altera-*,
   -android-*,
   -boost-*,
+  -bugprone-derived-method-shadowing-base-method,
   -bugprone-easily-swappable-parameters,
   -bugprone-implicit-widening-of-multiplication-result,
+  -bugprone-invalid-enum-default-initialization,
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
+  -bugprone-tagged-union-member-count,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
   -cert-err33-c,
   -cert-err58-cpp,
+  -cert-int09-c,
   -cert-oop57-cpp,
   -cert-str34-c,
   -clang-analyzer-optin.core.EnumCastOutOfRange,
   -clang-analyzer-optin.cplusplus.UninitializedObject,
   -clang-analyzer-osx.*,
+  -clang-analyzer-security.ArrayBound,
   -clang-diagnostic-delete-abstract-non-virtual-dtor,
   -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
   -clang-diagnostic-deprecated-declarations,
   -clang-diagnostic-ignored-optimization-argument,
+  -clang-diagnostic-missing-designated-field-initializers,
   -clang-diagnostic-missing-field-initializers,
   -clang-diagnostic-shadow-field,
   -clang-diagnostic-unused-const-variable,
@@ -42,6 +48,7 @@ Checks: >-
   -cppcoreguidelines-owning-memory,
   -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
+  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -cppcoreguidelines-pro-type-const-cast,
@@ -54,12 +61,13 @@ Checks: >-
   -cppcoreguidelines-rvalue-reference-param-not-moved,
   -cppcoreguidelines-special-member-functions,
   -cppcoreguidelines-use-default-member-init,
+  -cppcoreguidelines-use-enum-class,
   -cppcoreguidelines-virtual-class-destructor,
+  -fuchsia-default-arguments-calls,
+  -fuchsia-default-arguments-declarations,
   -fuchsia-multiple-inheritance,
   -fuchsia-overloaded-operator,
   -fuchsia-statically-constructed-objects,
-  -fuchsia-default-arguments-declarations,
-  -fuchsia-default-arguments-calls,
   -google-build-using-namespace,
   -google-explicit-constructor,
   -google-readability-braces-around-statements,
@@ -71,49 +79,64 @@ Checks: >-
   -llvm-else-after-return,
   -llvm-header-guard,
   -llvm-include-order,
+  -llvm-prefer-static-over-anonymous-namespace,
   -llvm-qualified-auto,
+  -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
   -misc-include-cleaner,
+  -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
+  -misc-override-with-different-visibility,
   -misc-unused-parameters,
   -misc-use-anonymous-namespace,
+  -misc-use-internal-linkage,
   -modernize-avoid-bind,
+  -modernize-avoid-variadic-functions,
   -modernize-avoid-c-arrays,
-  -modernize-concat-nested-namespaces,
+  -modernize-avoid-c-style-cast,
   -modernize-macro-to-enum,
   -modernize-return-braced-init-list,
   -modernize-type-traits,
   -modernize-use-auto,
   -modernize-use-constraints,
   -modernize-use-default-member-init,
+  -modernize-use-designated-initializers,
   -modernize-use-equals-default,
+  -modernize-use-integer-sign-comparison,
   -modernize-use-nodiscard,
   -modernize-use-nullptr,
-  -modernize-use-nodiscard,
-  -modernize-use-nullptr,
+  -modernize-use-ranges,
   -modernize-use-trailing-return-type,
   -mpi-*,
   -objc-*,
   -performance-enum-size,
+  -portability-avoid-pragma-once,
+  -portability-template-virtual-member-function,
+  -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
   -readability-container-contains,
   -readability-container-data-pointer,
   -readability-convert-member-functions-to-static,
   -readability-else-after-return,
+  -readability-enum-initial-value,
   -readability-function-cognitive-complexity,
   -readability-implicit-bool-conversion,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
+  -readability-math-missing-parentheses,
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
   -readability-redundant-member-init,
-  -readability-redundant-string-init,
+  -readability-redundant-parentheses,
+  -readability-redundant-typename,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
+  -readability-use-std-min-max,
+  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
 FormatStyle:     google
 CheckOptions:

.clang-tidy.hash

@@ -1 +1 @@
-1b1ce6324c50c4595703c7df0a8a479b4fe84b71ff1a8793cce1a16f17a33324
+96c95feaa60831da5f43e3c6a7c7a3a237e17c5d12995a730dbc3884c8dcd11c

.dockerignore

@@ -115,4 +115,4 @@ examples/
 Dockerfile
 .git/
 tests/
-.*
+.?*

.github/scripts/auto-label-pr/detectors.js

@@ -1,4 +1,3 @@
-const fs = require('fs');
 const { DOCS_PR_PATTERNS } = require('./constants');
 const {
   COMPONENT_REGEX,
@@ -9,6 +8,31 @@ const {
 } = require('../detect-tags');
 const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
 
+// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
+// Ruff/Black enforce exactly one space around `=` and no space before `:`,
+// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
+const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
+
+// Fetch a file's contents from the PR head SHA via the GitHub API.
+// The auto-label workflow runs on `pull_request_target`, which checks out the
+// base branch — files added by the PR don't exist in the workspace, so we have
+// to fetch them from the head SHA. Returns null if the file can't be fetched.
+async function fetchPrFileContent(github, context, path) {
+  try {
+    const { owner, repo } = context.repo;
+    const { data } = await github.rest.repos.getContent({
+      owner,
+      repo,
+      path,
+      ref: context.payload.pull_request.head.sha,
+    });
+    return Buffer.from(data.content, 'base64').toString('utf8');
+  } catch (error) {
+    console.log(`Failed to fetch ${path} from PR head:`, error.message);
+    return null;
+  }
+}
+
 // Strategy: Merge branch detection
 async function detectMergeBranch(context) {
   const labels = new Set();
@@ -45,52 +69,64 @@ async function detectComponentPlatforms(changedFiles, apiData) {
 }
 
 // Strategy: New component detection
-async function detectNewComponents(prFiles) {
+async function detectNewComponents(github, context, prFiles) {
   const labels = new Set();
+  let hasYamlLoadable = false;
   const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
 
   for (const file of addedFiles) {
     const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
-    if (componentMatch) {
-      try {
-        const content = fs.readFileSync(file, 'utf8');
-        if (content.includes('IS_TARGET_PLATFORM = True')) {
-          labels.add('new-target-platform');
-        }
-      } catch (error) {
-        console.log(`Failed to read content of ${file}:`, error.message);
-      }
-      labels.add('new-component');
+    if (!componentMatch) continue;
+
+    labels.add('new-component');
+    const content = await fetchPrFileContent(github, context, file);
+    if (content === null) {
+      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+      hasYamlLoadable = true;
+      continue;
+    }
+    if (content.includes('IS_TARGET_PLATFORM = True')) {
+      labels.add('new-target-platform');
+    }
+    if (CONFIG_SCHEMA_REGEX.test(content)) {
+      hasYamlLoadable = true;
     }
   }
 
-  return labels;
+  return { labels, hasYamlLoadable };
 }
 
 // Strategy: New platform detection
-async function detectNewPlatforms(prFiles, apiData) {
+async function detectNewPlatforms(github, context, prFiles, apiData) {
   const labels = new Set();
+  let hasYamlLoadable = false;
   const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
 
-  for (const file of addedFiles) {
-    const platformFileMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/);
-    if (platformFileMatch) {
-      const [, component, platform] = platformFileMatch;
-      if (apiData.platformComponents.includes(platform)) {
-        labels.add('new-platform');
-      }
-    }
+  const platformPathPatterns = [
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
+    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
+  ];
 
-    const platformDirMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/);
-    if (platformDirMatch) {
-      const [, component, platform] = platformDirMatch;
-      if (apiData.platformComponents.includes(platform)) {
-        labels.add('new-platform');
+  for (const file of addedFiles) {
+    for (const re of platformPathPatterns) {
+      const match = file.match(re);
+      if (!match) continue;
+      const platform = match[2];
+      if (!apiData.platformComponents.includes(platform)) break;
+
+      labels.add('new-platform');
+      const content = await fetchPrFileContent(github, context, file);
+      if (content === null) {
+        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
+        hasYamlLoadable = true;
+      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
+        hasYamlLoadable = true;
       }
+      break;
     }
   }
 
-  return labels;
+  return { labels, hasYamlLoadable };
 }
 
 // Strategy: Core files detection
@@ -300,7 +336,7 @@ function detectMaintainerAccess(context) {
 }
 
 // Strategy: Requirements detection
-async function detectRequirements(allLabels, prFiles, context) {
+async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
   const labels = new Set();
 
   // Check for missing tests
@@ -308,8 +344,15 @@ async function detectRequirements(allLabels, prFiles, context) {
     labels.add('needs-tests');
   }
 
-  // Check for missing docs
-  if (allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) {
+  // Check for missing docs.
+  // `new-feature` (PR-body checkbox) always counts. `new-component` / `new-platform`
+  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
+  // i.e. the new component/platform is actually loadable from YAML.
+  const docsEligible =
+    allLabels.has('new-feature') ||
+    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
+
+  if (docsEligible) {
     const prBody = context.payload.pull_request.body || '';
     const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
 

.github/scripts/auto-label-pr/index.js

@@ -106,8 +106,8 @@ module.exports = async ({ github, context }) => {
   const [
     branchLabels,
     componentLabels,
-    newComponentLabels,
-    newPlatformLabels,
+    newComponentResult,
+    newPlatformResult,
     coreLabels,
     sizeLabels,
     dashboardLabels,
@@ -120,8 +120,8 @@ module.exports = async ({ github, context }) => {
   ] = await Promise.all([
     detectMergeBranch(context),
     detectComponentPlatforms(changedFiles, apiData),
-    detectNewComponents(prFiles),
-    detectNewPlatforms(prFiles, apiData),
+    detectNewComponents(github, context, prFiles),
+    detectNewPlatforms(github, context, prFiles, apiData),
     detectCoreChanges(changedFiles),
     detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
     detectDashboardChanges(changedFiles),
@@ -133,6 +133,13 @@ module.exports = async ({ github, context }) => {
     detectMaintainerAccess(context)
   ]);
 
+  // Extract new-component / new-platform results
+  const newComponentLabels = newComponentResult.labels;
+  const newPlatformLabels = newPlatformResult.labels;
+  // Eligible for needs-docs only if any newly added component or platform file
+  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
+  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
+
   // Extract deprecated component info
   const deprecatedLabels = deprecatedResult.labels;
   const deprecatedInfo = deprecatedResult.deprecatedInfo;
@@ -154,7 +161,7 @@ module.exports = async ({ github, context }) => {
   ]);
 
   // Detect requirements based on all other labels
-  const requirementLabels = await detectRequirements(allLabels, prFiles, context);
+  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
   for (const label of requirementLabels) {
     allLabels.add(label);
   }

.github/workflows/auto-label-pr.yml

@@ -6,9 +6,10 @@ on:
   pull_request_target:
     types: [labeled, opened, reopened, synchronize, edited]
 
+# All PR/label/review writes are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  pull-requests: write
-  contents: read
+  contents: read  # actions/checkout reads the workflow source
 
 env:
   SMALL_PR_THRESHOLD: 30
@@ -27,10 +28,14 @@ jobs:
 
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v2
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
+          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
+          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
+          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
 
       - name: Auto Label PR
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/ci-api-proto.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-api-proto.yml"
 
 permissions:
-  contents: read
-  pull-requests: write
+  contents: read        # actions/checkout for the PR head
+  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale
 
 jobs:
   check:

.github/workflows/ci-clang-tidy-hash.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-clang-tidy-hash.yml"
 
 permissions:
-  contents: read
-  pull-requests: write
+  contents: read        # actions/checkout for the PR head
+  pull-requests: write  # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date
 
 jobs:
   verify-hash:

.github/workflows/ci-docker.yml

@@ -22,8 +22,7 @@ on:
       - "script/platformio_install_deps.py"
 
 permissions:
-  contents: read
-  packages: read
+  contents: read  # actions/checkout only; the build does not push images
 
 concurrency:
   # yamllint disable-line rule:line-length

.github/workflows/ci-memory-impact-comment.yml

@@ -7,9 +7,9 @@ on:
     types: [completed]
 
 permissions:
-  contents: read
-  pull-requests: write
-  actions: read
+  contents: read        # actions/checkout of the base repo at the PR's target branch
+  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
+  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
 
 jobs:
   memory-impact-comment:

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ on:
   merge_group:
 
 permissions:
-  contents: read
+  contents: read  # actions/checkout for all jobs; individual jobs add their own scopes when they need to write
 
 env:
   DEFAULT_PYTHON: "3.11"
@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Generate cache-key
         id: cache-key
-        run: echo key="${{ hashFiles('requirements.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
+        run: echo key="${{ hashFiles('requirements.txt', 'requirements_dev.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
         id: python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -58,7 +58,7 @@ jobs:
           python -m venv venv
           . venv/bin/activate
           python --version
-          pip install -r requirements.txt -r requirements_test.txt pre-commit
+          pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt pre-commit
           pip install -e .
 
   pylint:
@@ -108,6 +108,81 @@ jobs:
           script/generate-esp32-boards.py --check
           script/generate-rp2040-boards.py --check
 
+  import-time:
+    name: Check import esphome.__main__ time
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.import-time == 'true'
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+      - name: Check import time against budget and write waterfall HAR
+        run: |
+          . venv/bin/activate
+          script/check_import_time.py --check --har importtime.har
+      - name: Upload waterfall HAR
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: import-time-waterfall
+          path: importtime.har
+          if-no-files-found: ignore
+          retention-days: 14
+
+  device-builder:
+    name: Test downstream esphome/device-builder
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: needs.determine-jobs.outputs.device-builder == 'true'
+    steps:
+      - name: Check out esphome (this PR)
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          path: esphome
+      - name: Check out esphome/device-builder
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: esphome/device-builder
+          ref: main
+          path: device-builder
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: "3.13"
+      - name: Set up uv
+        # Mirrors the install shape device-builder's own CI uses
+        # (esphome/device-builder#192): uv replaces pip for the
+        # install step (order-of-magnitude faster on cold boots,
+        # with its own wheel cache). actions/setup-python still
+        # provides the interpreter.
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+      - name: Install device-builder + esphome from PR
+        # Install device-builder with its esphome + test extras
+        # first so its pinned versions of pytest/etc. land, then
+        # overlay the PR's esphome so the downstream tests run
+        # against this PR's Python code. ``--system`` installs into
+        # the runner's Python instead of a venv.
+        run: |
+          uv pip install --system -e './device-builder[esphome,test]'
+          uv pip install --system -e ./esphome
+      - name: Run device-builder pytest
+        # ``-n auto`` runs under pytest-xdist (matches device-builder's
+        # own CI). No ``--cov`` here -- this is purely a downstream
+        # smoke check against this PR's esphome code.
+        working-directory: device-builder
+        run: pytest -q -n auto --maxfail=5 --durations=10 --no-cov --ignore=tests/benchmarks
+
   pytest:
     name: Run pytest
     strategy:
@@ -171,11 +246,12 @@ jobs:
       - common
     outputs:
       integration-tests: ${{ steps.determine.outputs.integration-tests }}
-      integration-tests-run-all: ${{ steps.determine.outputs.integration-tests-run-all }}
-      integration-test-files: ${{ steps.determine.outputs.integration-test-files }}
+      integration-test-buckets: ${{ steps.determine.outputs.integration-test-buckets }}
       clang-tidy: ${{ steps.determine.outputs.clang-tidy }}
       clang-tidy-mode: ${{ steps.determine.outputs.clang-tidy-mode }}
       python-linters: ${{ steps.determine.outputs.python-linters }}
+      import-time: ${{ steps.determine.outputs.import-time }}
+      device-builder: ${{ steps.determine.outputs.device-builder }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -214,11 +290,12 @@ jobs:
 
           # Extract individual fields
           echo "integration-tests=$(echo "$output" | jq -r '.integration_tests')" >> $GITHUB_OUTPUT
-          echo "integration-tests-run-all=$(echo "$output" | jq -r '.integration_tests_run_all')" >> $GITHUB_OUTPUT
-          echo "integration-test-files=$(echo "$output" | jq -c '.integration_test_files')" >> $GITHUB_OUTPUT
+          echo "integration-test-buckets=$(echo "$output" | jq -c '.integration_test_buckets')" >> $GITHUB_OUTPUT
           echo "clang-tidy=$(echo "$output" | jq -r '.clang_tidy')" >> $GITHUB_OUTPUT
           echo "clang-tidy-mode=$(echo "$output" | jq -r '.clang_tidy_mode')" >> $GITHUB_OUTPUT
           echo "python-linters=$(echo "$output" | jq -r '.python_linters')" >> $GITHUB_OUTPUT
+          echo "import-time=$(echo "$output" | jq -r '.import_time')" >> $GITHUB_OUTPUT
+          echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -237,12 +314,16 @@ jobs:
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
   integration-tests:
-    name: Run integration tests
+    name: Run integration tests (${{ matrix.bucket.name }})
     runs-on: ubuntu-latest
     needs:
       - common
       - determine-jobs
     if: needs.determine-jobs.outputs.integration-tests == 'true'
+    strategy:
+      fail-fast: false
+      matrix:
+        bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -269,19 +350,14 @@ jobs:
         run: echo "::add-matcher::.github/workflows/matchers/pytest.json"
       - name: Run integration tests
         env:
-          INTEGRATION_TEST_FILES: ${{ needs.determine-jobs.outputs.integration-test-files }}
-          INTEGRATION_TESTS_RUN_ALL: ${{ needs.determine-jobs.outputs.integration-tests-run-all }}
+          # JSON array of test paths; parsed into a bash array below to avoid
+          # shell word-splitting / glob hazards.
+          BUCKET_TESTS: ${{ toJson(matrix.bucket.tests) }}
         run: |
           . venv/bin/activate
-          if [[ "$INTEGRATION_TESTS_RUN_ALL" == "true" ]]; then
-            echo "Running all integration tests"
-            pytest -vv --no-cov --tb=native -n auto tests/integration/
-          else
-            # Parse JSON array into bash array to avoid shell expansion issues
-            mapfile -t test_files < <(echo "$INTEGRATION_TEST_FILES" | jq -r '.[]')
-            echo "Running ${#test_files[@]} specific integration tests"
-            pytest -vv --no-cov --tb=native -n auto "${test_files[@]}"
-          fi
+          mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
+          echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
+          pytest -vv --no-cov --tb=native -n auto "${test_files[@]}"
 
   cpp-unit-tests:
     name: Run C++ unit tests
@@ -339,7 +415,7 @@ jobs:
           echo "binary=$BINARY" >> $GITHUB_OUTPUT
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@658a901452bb54c799643e060733b7afe9121b8d # v4.14.0
+        uses: CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd # v4.15.1
         with:
           run: ${{ steps.build.outputs.binary }}
           mode: simulation
@@ -707,6 +783,91 @@ jobs:
           # Run compilation with grouping and isolation
           python3 script/test_build_components.py -e compile -c "$components_csv" -f --isolate "$directly_changed_csv"
 
+  test-native-idf:
+    name: Test components with native ESP-IDF
+    runs-on: ubuntu-24.04
+    needs:
+      - common
+      - determine-jobs
+    if: github.event_name == 'pull_request'
+    env:
+      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
+      TEST_COMPONENTS: esp32,api,heatpumpir,bme280_i2c,bh1750,aht10,esp32_ble,esp32_ble_beacon,esp32_ble_client,esp32_ble_server,esp32_ble_tracker,ble_client,ble_presence,ble_rssi,ble_scanner
+    steps:
+      - name: Check out code from GitHub
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Restore Python
+        uses: ./.github/actions/restore-python
+        with:
+          python-version: ${{ env.DEFAULT_PYTHON }}
+          cache-key: ${{ needs.common.outputs.cache-key }}
+
+      - name: Cache ESPHome
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.esphome-idf
+          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
+
+      - name: Run native ESP-IDF compile test
+        run: |
+          . venv/bin/activate
+
+          # Check if /mnt has more free space than / before bind mounting
+          # Extract available space in KB for comparison
+          root_avail=$(df -k / | awk 'NR==2 {print $4}')
+          mnt_avail=$(df -k /mnt 2>/dev/null | awk 'NR==2 {print $4}')
+
+          echo "Available space: / has ${root_avail}KB, /mnt has ${mnt_avail}KB"
+
+          # Only use /mnt if it has more space than /
+          if [ -n "$mnt_avail" ] && [ "$mnt_avail" -gt "$root_avail" ]; then
+            echo "Using /mnt for build files (more space available)"
+            # Bind mount PlatformIO directory to /mnt (tools, packages, build cache all go there)
+            sudo mkdir -p /mnt/esphome-idf
+            sudo chown $USER:$USER /mnt/esphome-idf
+            mkdir -p ~/.esphome-idf
+            sudo mount --bind /mnt/esphome-idf ~/.esphome-idf
+
+            # Bind mount test build directory to /mnt
+            sudo mkdir -p /mnt/test_build_components_build
+            sudo chown $USER:$USER /mnt/test_build_components_build
+            mkdir -p tests/test_build_components/build
+            sudo mount --bind /mnt/test_build_components_build tests/test_build_components/build
+          else
+            echo "Using / for build files (more space available than /mnt or /mnt unavailable)"
+          fi
+
+          echo "Testing components: $TEST_COMPONENTS"
+          echo ""
+
+          # Show disk space before validation (after bind mounts setup)
+          echo "Disk space before config validation:"
+          df -h
+          echo ""
+
+          # Run config validation (auto-grouped by test_build_components.py)
+          python3 script/test_build_components.py -e config -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
+
+          echo ""
+          echo "Config validation passed! Starting compilation..."
+          echo ""
+
+          # Show disk space before compilation
+          echo "Disk space before compilation:"
+          df -h
+          echo ""
+
+          # Run compilation (auto-grouped by test_build_components.py)
+          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
+
+      - name: Save ESPHome cache
+        if: github.ref == 'refs/heads/dev'
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.esphome-idf
+          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
+
   pre-commit-ci-lite:
     name: pre-commit.ci lite
     runs-on: ubuntu-latest
@@ -986,8 +1147,8 @@ jobs:
       - memory-impact-pr-branch
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && fromJSON(needs.determine-jobs.outputs.memory_impact).should_run == 'true' && needs.memory-impact-target-branch.outputs.skip != 'true'
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read        # actions/checkout to load the comment-posting script
+      pull-requests: write  # ci_memory_impact_comment.py posts/updates the memory-impact comment on the PR
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
@@ -1036,7 +1197,9 @@ jobs:
       - clang-tidy-nosplit
       - clang-tidy-split
       - determine-jobs
+      - device-builder
       - test-build-components-split
+      - test-native-idf
       - pre-commit-ci-lite
       - memory-impact-target-branch
       - memory-impact-pr-branch

.github/workflows/close-pr-from-fork-default-branch.yml

@@ -6,8 +6,8 @@ on:
     types: [opened, reopened]
 
 permissions:
-  pull-requests: write
-  issues: write
+  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
+  issues: write         # issues.createComment to explain to the contributor why the PR was closed
 
 jobs:
   close:

.github/workflows/codeowner-approved-label-update.yml

@@ -15,9 +15,9 @@ on:
       - beta
 
 permissions:
-  issues: write
-  pull-requests: read
-  contents: read
+  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
+  pull-requests: read  # listReviews to determine whether a codeowner has approved
+  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
 
 jobs:
   codeowner-approved:

.github/workflows/codeowner-review-request.yml

@@ -17,9 +17,10 @@ on:
       - release
       - beta
 
+# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
+# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  pull-requests: write
-  contents: read
+  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
 
 jobs:
   request-codeowner-reviews:
@@ -32,9 +33,20 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by the github-script step below.
+          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
+          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
+
       - name: Request reviews from component codeowners
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
 

.github/workflows/codeql.yml

@@ -16,6 +16,9 @@ on:
   schedule:
     - cron: "30 18 * * 4"
 
+# Deny by default; the analyze job opts in to exactly what it needs.
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -26,15 +29,10 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
+      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
+      packages: read          # fetch internal or private CodeQL query packs
+      actions: read           # required by codeql-action when run from a private repo
+      contents: read          # actions/checkout to scan the repository
 
     strategy:
       fail-fast: false
@@ -58,7 +56,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -86,6 +84,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/dashboard-deprecation-comment.yml

@@ -0,0 +1,113 @@
+name: Add Dashboard Deprecation Comment
+
+on:
+  pull_request_target:
+    types: [opened, synchronize]
+
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
+
+jobs:
+  dashboard-deprecation-comment:
+    name: Dashboard deprecation comment
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
+      - name: Add dashboard deprecation comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.generate-token.outputs.token }}
+          script: |
+            const commentMarker = "<!-- This comment was generated automatically by the dashboard-deprecation-comment workflow. -->";
+
+            const commentBody = `Thanks for opening this PR!
+
+            Heads up: the legacy ESPHome dashboard (\`esphome/dashboard/\` and \`tests/dashboard/\`) is **deprecated** and is being replaced by [ESPHome Device Builder](https://github.com/esphome/device-builder). We are not adding new features to the legacy dashboard and it will eventually be removed from this repository.
+
+            What this means for your PR:
+
+            - **New features / enhancements**: please port the change to [esphome/device-builder](https://github.com/esphome/device-builder) instead. We are unlikely to review or merge new dashboard features here.
+            - **Bug fixes**: small fixes may still be considered, but please check first whether the same issue exists in Device Builder, where the fix will have a longer life.
+            - **Security issues**: please do not file a public PR. Report privately via [GitHub security advisories](https://github.com/esphome/esphome/security/advisories/new) so we can coordinate a fix.
+
+            We appreciate the contribution and apologize for the friction; flagging this early so your time isn't spent on a change that may not land.
+
+            ---
+            (Added by the PR bot)
+
+            ${commentMarker}`;
+
+            async function getDashboardChanges(github, owner, repo, prNumber) {
+                const changedFiles = await github.paginate(
+                    github.rest.pulls.listFiles,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        pull_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return changedFiles.filter(file =>
+                    file.filename.startsWith('esphome/dashboard/') ||
+                    file.filename.startsWith('tests/dashboard/')
+                );
+            }
+
+            async function findBotComment(github, owner, repo, prNumber) {
+                const comments = await github.paginate(
+                    github.rest.issues.listComments,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        issue_number: prNumber,
+                        per_page: 100,
+                    }
+                );
+
+                return comments.find(comment =>
+                    comment.body.includes(commentMarker) && comment.user.type === "Bot"
+                );
+            }
+
+            const prNumber = context.payload.pull_request.number;
+            const { owner, repo } = context.repo;
+
+            const dashboardChanges = await getDashboardChanges(github, owner, repo, prNumber);
+            const existingComment = await findBotComment(github, owner, repo, prNumber);
+
+            if (dashboardChanges.length === 0) {
+                // PR doesn't (or no longer) touches the legacy dashboard. If we previously
+                // commented (e.g. files were removed in a later push), leave the comment in
+                // place for history rather than thrash on edit/delete.
+                return;
+            }
+
+            if (existingComment) {
+                if (existingComment.body === commentBody) {
+                    return;
+                }
+                await github.rest.issues.updateComment({
+                    owner: owner,
+                    repo: repo,
+                    comment_id: existingComment.id,
+                    body: commentBody,
+                });
+            } else {
+                await github.rest.issues.createComment({
+                    owner: owner,
+                    repo: repo,
+                    issue_number: prNumber,
+                    body: commentBody,
+                });
+            }

.github/workflows/external-component-bot.yml

@@ -4,20 +4,29 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
-permissions:
-  contents: read       #  Needed to fetch PR details
-  issues: write        #  Needed to create and update comments (PR comments are managed via the issues REST API)
-  pull-requests: write  # also needed?
+# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
+# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
+permissions: {}
 
 jobs:
   external-comment:
     name: External component comment
     runs-on: ubuntu-latest
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
+          # the issues.*Comment APIs require the pull-requests scope, not issues.
+          permission-pull-requests: write
+
       - name: Add external component comment
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             // Generate external component usage instructions
             function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {

.github/workflows/issue-codeowner-notify.yml

@@ -9,8 +9,8 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write
-  contents: read
+  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
+  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
 
 jobs:
   notify-codeowners:

.github/workflows/lock.yml

@@ -6,6 +6,12 @@ on:
     - cron: "30 0 * * *"  # Run daily at 00:30 UTC
   workflow_dispatch:
 
+# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
+permissions: {}
+
 jobs:
   lock:
-    uses: esphome/workflows/.github/workflows/lock.yml@3c4e8446aa1029f1c346a482034b3ee1489077ca  # 2026.4.0
+    permissions:
+      issues: write         # issues.lock on closed issues
+      pull-requests: write  # issues.lock on closed pull requests
+    uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df  # 2026.4.1

.github/workflows/pr-title-check.yml

@@ -8,8 +8,8 @@ on:
       - beta
 
 permissions:
-  contents: read
-  pull-requests: read
+  contents: read       # actions/checkout to load detect-tags.js
+  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
 
 jobs:
   check:

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
     - cron: "0 2 * * *"
 
 permissions:
-  contents: read
+  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
 
 jobs:
   init:
@@ -57,8 +57,8 @@ jobs:
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      id-token: write
+      contents: read   # actions/checkout to build the sdist/wheel
+      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
@@ -78,8 +78,8 @@ jobs:
     name: Build ESPHome ${{ matrix.platform.arch }}
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
     runs-on: ${{ matrix.platform.os }}
     needs: [init]
     strategy:
@@ -152,8 +152,8 @@ jobs:
       - deploy-docker
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read
-      packages: write
+      contents: read   # actions/checkout to load Dockerfile and build context
+      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
     strategy:
       fail-fast: false
       matrix:
@@ -223,10 +223,11 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: home-assistant-addon
+          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -258,10 +259,11 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: esphome-schema
+          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -289,10 +291,11 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
-          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: version-notifier
+          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/stale.yml

@@ -7,8 +7,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write
-  pull-requests: write
+  issues: write         # actions/stale labels, comments on, and closes stale issues
+  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests
 
 concurrency:
   group: lock

.github/workflows/status-check-labels.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, reopened, labeled, unlabeled, synchronize]
 
+permissions:
+  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr)
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true

.github/workflows/sync-device-classes.yml

@@ -6,12 +6,27 @@ on:
   schedule:
     - cron: "45 6 * * *"
 
+# Repo writes (branch push, PR open) happen via the App token minted below,
+# so the workflow's GITHUB_TOKEN does not need any write scopes.
+permissions:
+  contents: read  # actions/checkout for this repo and home-assistant/core
+
 jobs:
   sync:
     name: Sync Device Classes
     runs-on: ubuntu-latest
     if: github.repository == 'esphome/esphome'
     steps:
+      - name: Generate a token
+        id: generate-token
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        with:
+          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
+          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
+          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
+          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -50,4 +65,4 @@ jobs:
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"
           body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}
+          token: ${{ steps.generate-token.outputs.token }}

.gitignore

@@ -146,5 +146,6 @@ sdkconfig.*
 
 /components
 /managed_components
+/dependencies.lock
 
 api-docs/

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.15.11
+    rev: v0.15.12
     hooks:
       # Run the linter.
       - id: ruff
@@ -55,7 +55,7 @@ repos:
     hooks:
       - id: pylint
         name: pylint
-        entry: python3 script/run-in-env.py pylint
+        entry: python script/run-in-env.py pylint
         language: system
         types: [python]
         files: ^esphome/.+\.py$
@@ -68,5 +68,5 @@ repos:
         additional_dependencies: []
       - id: ci-custom
         name: ci-custom
-        entry: python3 script/run-in-env.py script/ci-custom.py
+        entry: python script/run-in-env.py script/ci-custom.py
         language: system

CODEOWNERS

@@ -347,6 +347,7 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
+esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
@@ -415,6 +416,7 @@ esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
+esphome/components/ring_buffer/* @kahrendt
 esphome/components/rp2040/* @jesserockz
 esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan

docker/ha-addon-rootfs/etc/cont-init.d/40-device-builder.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/with-contenv bashio
+# ==============================================================================
+# Installs the latest prerelease of esphome-device-builder when the
+# `use_new_device_builder` config option is enabled.
+# This is a temporary install-on-boot step until esphome-device-builder
+# becomes a direct dependency of esphome.
+# ==============================================================================
+
+if ! bashio::config.true 'use_new_device_builder'; then
+  exit 0
+fi
+
+bashio::log.info "Installing latest prerelease of esphome-device-builder..."
+if command -v uv > /dev/null; then
+  uv pip install --system --no-cache-dir --prerelease=allow --upgrade \
+    esphome-device-builder ||
+    bashio::exit.nok "Failed installing esphome-device-builder."
+else
+  pip install --no-cache-dir --pre --upgrade esphome-device-builder ||
+    bashio::exit.nok "Failed installing esphome-device-builder."
+fi
+bashio::log.info "Installed esphome-device-builder."

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -49,5 +49,12 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "Starting ESPHome Device Builder..."
+    exec esphome-device-builder /config/esphome \
+        --ha-addon \
+        --ingress-port "$(bashio::addon.ingress_port)"
+fi
+
 bashio::log.info "Starting ESPHome dashboard..."
 exec esphome dashboard /config/esphome --socket /var/run/esphome.sock --ha-addon

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -4,6 +4,14 @@
 # Community Hass.io Add-ons: ESPHome
 # Configures NGINX for use with ESPHome
 # ==============================================================================
+
+# When the new device builder is enabled it serves HA ingress directly,
+# so nginx is not used at all -- skip configuration.
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "Skipping NGINX setup: new device builder serves ingress directly."
+    bashio::exit.ok
+fi
+
 mkdir -p /var/log/nginx
 
 # Generate Ingress configuration

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -5,6 +5,14 @@
 # Runs the NGINX proxy
 # ==============================================================================
 
+# The new device builder handles HA ingress itself, so nginx is bypassed.
+# Block the longrun forever so s6 keeps the dependency satisfied and does
+# not respawn it.
+if bashio::config.true 'use_new_device_builder'; then
+    bashio::log.info "NGINX bypassed: new device builder serves ingress directly."
+    exec sleep infinity
+fi
+
 bashio::log.info "Waiting for ESPHome dashboard to come up..."
 
 while [[ ! -S /var/run/esphome.sock ]]; do

esphome/__main__.py

@@ -21,13 +21,14 @@ import argcomplete
 # Note: Do not import modules from esphome.components here, as this would
 # cause them to be loaded before external components are processed, resulting
 # in the built-in version being used instead of the external component one.
-from esphome import const, writer, yaml_util
+from esphome import const
 import esphome.codegen as cg
 from esphome.config import iter_component_configs, read_config, strip_default_ids
 from esphome.const import (
     ALLOWED_NAME_CHARS,
     ARGUMENT_HELP_DEVICE,
     CONF_API,
+    CONF_AUTH,
     CONF_BAUD_RATE,
     CONF_BROKER,
     CONF_DEASSERT_RTS_DTR,
@@ -47,22 +48,26 @@ from esphome.const import (
     CONF_PORT,
     CONF_SUBSTITUTIONS,
     CONF_TOPIC,
+    CONF_USERNAME,
+    CONF_WEB_SERVER,
     ENV_NOGITIGNORE,
     KEY_CORE,
-    KEY_NATIVE_IDF,
     KEY_TARGET_PLATFORM,
     PLATFORM_ESP32,
     PLATFORM_ESP8266,
     PLATFORM_RP2040,
     SECRETS_FILES,
+    Toolchain,
 )
 from esphome.core import CORE, EsphomeError, coroutine
 from esphome.enum import StrEnum
 from esphome.helpers import get_bool_env, indent, is_ip_address
 from esphome.log import AnsiFore, color, setup_log
 from esphome.types import ConfigType
+from esphome.upload_targets import PortType, get_port_type
 from esphome.util import (
     PICOTOOL_PACKAGE,
+    FlashImage,
     detect_rp2040_bootsel,
     get_picotool_path,
     get_serial_ports,
@@ -72,7 +77,12 @@ from esphome.util import (
     run_external_process,
     safe_print,
 )
-from esphome.zeroconf import discover_mdns_devices
+
+# Keep expensive imports (zeroconf, writer, yaml_util, etc.) out of this
+# module's top level. Every `esphome` invocation — including fast paths
+# like `esphome version` — pays the cost of what's imported here before
+# any command runs. Import inside the function that needs it instead.
+# `script/check_import_time.py` enforces a budget in CI.
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -146,7 +156,6 @@ class ArgsProtocol(Protocol):
     configuration: str
     name: str
     upload_speed: str | None
-    native_idf: bool
 
 
 def choose_prompt(options, purpose: str = None):
@@ -186,14 +195,6 @@ class Purpose(StrEnum):
     LOGGING = "logging"
 
 
-class PortType(StrEnum):
-    SERIAL = "SERIAL"
-    NETWORK = "NETWORK"
-    MQTT = "MQTT"
-    MQTTIP = "MQTTIP"
-    BOOTSEL = "BOOTSEL"
-
-
 # Magic MQTT port types that require special handling
 _MQTT_PORT_TYPES = frozenset({PortType.MQTT, PortType.MQTTIP})
 
@@ -241,6 +242,8 @@ def _discover_mac_suffix_devices() -> list[str] | None:
     """
     if not (has_name_add_mac_suffix() and has_mdns() and has_non_ip_address()):
         return None
+    from esphome.zeroconf import discover_mdns_devices
+
     _LOGGER.info("Discovering devices...")
     if not (discovered := discover_mdns_devices(CORE.name)):
         _LOGGER.warning(
@@ -341,6 +344,17 @@ def choose_upload_log_host(
         elif bootsel.permission_error:
             bootsel_permission_error = True
 
+    # Annotate the OTA chooser entry only in the non-default case: when the
+    # config has web_server OTA but no native API OTA, the upload will fall
+    # through to the HTTP path and the user benefits from seeing that
+    # explicitly. The native-API path is the default and gets a plain label
+    # to avoid noise on the most common scenario. For LOGGING the OTA
+    # transport doesn't apply, so always leave the label plain.
+    if purpose == Purpose.UPLOADING and not has_native_ota() and has_web_server_ota():
+        ota_suffix = " via web_server"
+    else:
+        ota_suffix = ""
+
     def add_ota_options() -> None:
         """Add OTA options, using mDNS discovery if name_add_mac_suffix is enabled."""
         if (discovered := _discover_mac_suffix_devices()) is not None:
@@ -348,11 +362,11 @@ def choose_upload_log_host(
             # intentionally skip the base-name fallback since with
             # name_add_mac_suffix on, the base name doesn't exist on the net.
             for host in discovered:
-                options.append((f"Over The Air ({host})", host))
+                options.append((f"Over The Air{ota_suffix} ({host})", host))
         elif has_resolvable_address():
-            options.append((f"Over The Air ({CORE.address})", CORE.address))
+            options.append((f"Over The Air{ota_suffix} ({CORE.address})", CORE.address))
         if has_mqtt_ip_lookup():
-            options.append(("Over The Air (MQTT IP lookup)", "MQTTIP"))
+            options.append((f"Over The Air{ota_suffix} (MQTT IP lookup)", "MQTTIP"))
 
     if purpose == Purpose.LOGGING:
         if has_mqtt_logging():
@@ -421,7 +435,19 @@ def has_api() -> bool:
 
 
 def has_ota() -> bool:
-    """Check if OTA upload is available (requires platform: esphome)."""
+    """Check if any network OTA upload is available.
+
+    True if the config exposes either ``platform: esphome`` (native API
+    OTA) or ``platform: web_server`` (HTTP OTA). Both reach the device
+    over the same network stack, so the OTA discovery path treats them
+    interchangeably; ``upload_program`` picks the actual transport based
+    on ``--ota-platform`` and what's configured.
+    """
+    return has_native_ota() or has_web_server_ota()
+
+
+def has_native_ota() -> bool:
+    """Check if native API OTA upload is available (``platform: esphome``)."""
     if CONF_OTA not in CORE.config:
         return False
     return any(
@@ -430,6 +456,16 @@ def has_ota() -> bool:
     )
 
 
+def has_web_server_ota() -> bool:
+    """Check if web_server OTA upload is available (``platform: web_server``)."""
+    if CONF_OTA not in CORE.config:
+        return False
+    return any(
+        ota_item.get(CONF_PLATFORM) == CONF_WEB_SERVER
+        for ota_item in CORE.config[CONF_OTA]
+    )
+
+
 def has_mqtt_ip_lookup() -> bool:
     """Check if MQTT is available and IP lookup is supported."""
     from esphome.components.mqtt import CONF_DISCOVER_IP
@@ -554,33 +590,10 @@ def _resolve_network_devices(
     return network_devices
 
 
-def get_port_type(port: str) -> PortType:
-    """Determine the type of port/device identifier.
-
-    Returns:
-        PortType.SERIAL for serial ports (/dev/ttyUSB0, COM1, etc.)
-        PortType.BOOTSEL for RP2040 BOOTSEL upload via picotool
-        PortType.MQTT for MQTT logging
-        PortType.MQTTIP for MQTT IP lookup
-        PortType.NETWORK for IP addresses, hostnames, or mDNS names
-    """
-    if port == "BOOTSEL":
-        return PortType.BOOTSEL
-    if port.startswith("/") or port.startswith("COM"):
-        return PortType.SERIAL
-    if port == "MQTT":
-        return PortType.MQTT
-    if port == "MQTTIP":
-        return PortType.MQTTIP
-    return PortType.NETWORK
-
-
 def run_miniterm(config: ConfigType, port: str, args) -> int:
     from aioesphomeapi import LogParser
     import serial
 
-    from esphome import platformio_api
-
     if CONF_LOGGER not in config:
         _LOGGER.info("Logger is not enabled. Not starting UART logs.")
         return 1
@@ -595,8 +608,11 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
     try:
         module = importlib.import_module("esphome.components." + CORE.target_platform)
         process_stacktrace = getattr(module, "process_stacktrace")
-    except AttributeError:
-        pass
+    except (AttributeError, ImportError):
+        _LOGGER.info(
+            'Stacktrace analysis is unavailable: no compatible analyzer found for target platform "%s".',
+            CORE.target_platform,
+        )
 
     backtrace_state = False
     ser = serial.Serial()
@@ -639,14 +655,10 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
                             )
                             safe_print(parser.parse_line(line, time_str))
 
-                            if process_stacktrace:
+                            if process_stacktrace is not None:
                                 backtrace_state = process_stacktrace(
                                     config, line, backtrace_state
                                 )
-                            else:
-                                backtrace_state = platformio_api.process_stacktrace(
-                                    config, line, backtrace_state=backtrace_state
-                                )
                     except serial.SerialException:
                         _LOGGER.error("Serial port closed!")
                         return 0
@@ -660,7 +672,7 @@ def run_miniterm(config: ConfigType, port: str, args) -> int:
     return 0
 
 
-def wrap_to_code(name, comp):
+def _wrap_to_code(name, comp, yaml_util):
     coro = coroutine(comp.to_code)
 
     @functools.wraps(comp.to_code)
@@ -679,33 +691,36 @@ def wrap_to_code(name, comp):
     return wrapped
 
 
-def write_cpp(config: ConfigType, native_idf: bool = False) -> int:
+def write_cpp(config: ConfigType) -> int:
+    from esphome import writer
+
     if not get_bool_env(ENV_NOGITIGNORE):
         writer.write_gitignore()
 
-    # Store native_idf flag so esp32 component can check it
-    CORE.data[KEY_NATIVE_IDF] = native_idf
-
     generate_cpp_contents(config)
-    return write_cpp_file(native_idf=native_idf)
+    return write_cpp_file()
 
 
 def generate_cpp_contents(config: ConfigType) -> None:
+    from esphome import yaml_util
+
     _LOGGER.info("Generating C++ source...")
 
     for name, component, conf in iter_component_configs(CORE.config):
         if component.to_code is not None:
-            coro = wrap_to_code(name, component)
+            coro = _wrap_to_code(name, component, yaml_util)
             CORE.add_job(coro, conf)
 
     CORE.flush_tasks()
 
 
-def write_cpp_file(native_idf: bool = False) -> int:
+def write_cpp_file() -> int:
+    from esphome import writer
+
     code_s = indent(CORE.cpp_main_section)
     writer.write_cpp(code_s)
 
-    if native_idf and CORE.is_esp32 and CORE.target_framework == "esp-idf":
+    if CORE.using_toolchain_esp_idf:
         from esphome.build_gen import espidf
 
         espidf.write_project()
@@ -718,30 +733,33 @@ def write_cpp_file(native_idf: bool = False) -> int:
 
 
 def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
-    native_idf = getattr(args, "native_idf", False)
-
     # NOTE: "Build path:" format is parsed by script/ci_memory_impact_extract.py
     # If you change this format, update the regex in that script as well
     _LOGGER.info("Compiling app... Build path: %s", CORE.build_path)
 
-    if native_idf and CORE.is_esp32 and CORE.target_framework == "esp-idf":
-        from esphome import espidf_api
+    module = importlib.import_module("esphome.components." + CORE.target_platform)
+    platform_run_compile = getattr(module, "run_compile", None)
+    if platform_run_compile is not None and platform_run_compile(args, config):
+        pass
+    elif CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
 
-        rc = espidf_api.run_compile(config, CORE.verbose)
+        rc = toolchain.run_compile(config, CORE.verbose)
         if rc != 0:
             return rc
 
-        # Create factory.bin and ota.bin
-        espidf_api.create_factory_bin()
-        espidf_api.create_ota_bin()
+        # Create factory.bin, ota.bin, and firmware.elf copy
+        toolchain.create_factory_bin()
+        toolchain.create_ota_bin()
+        toolchain.create_elf_copy()
     else:
-        from esphome import platformio_api
+        from esphome.platformio import toolchain
 
-        rc = platformio_api.run_compile(config, CORE.verbose)
+        rc = toolchain.run_compile(config, CORE.verbose)
         if rc != 0:
             return rc
 
-        idedata = platformio_api.get_idedata(config)
+        idedata = toolchain.get_idedata(config)
         if idedata is None:
             return 1
 
@@ -830,22 +848,26 @@ def _make_crystal_freq_callback(
 def upload_using_esptool(
     config: ConfigType, port: str, file: str, speed: int
 ) -> str | int:
-    from esphome import platformio_api
-
     first_baudrate = speed or config[CONF_ESPHOME][CONF_PLATFORMIO_OPTIONS].get(
         "upload_speed", os.getenv("ESPHOME_UPLOAD_SPEED", "460800")
     )
 
     if file is not None:
-        flash_images = [platformio_api.FlashImage(path=file, offset="0x0")]
+        flash_images = [FlashImage(path=file, offset="0x0")]
+    elif CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
+
+        flash_images = [
+            FlashImage(path=toolchain.get_factory_firmware_path(), offset="0x0")
+        ]
     else:
-        idedata = platformio_api.get_idedata(config)
+        from esphome.platformio import toolchain
+
+        idedata = toolchain.get_idedata(config)
 
         firmware_offset = "0x10000" if CORE.is_esp32 else "0x0"
         flash_images = [
-            platformio_api.FlashImage(
-                path=idedata.firmware_bin_path, offset=firmware_offset
-            ),
+            FlashImage(path=idedata.firmware_bin_path, offset=firmware_offset),
         ]
         for image in idedata.extra_flash_images:
             if not image.path.is_file():
@@ -914,13 +936,13 @@ def upload_using_esptool(
 
 
 def upload_using_platformio(config: ConfigType, port: str) -> int:
-    from esphome import platformio_api
+    from esphome.platformio import toolchain
 
     # RP2040 platform-raspberrypi build recipe expects firmware.bin.signed for
     # the upload target, but 'nobuild' skips the build phase that creates it.
     # Create it here so the upload doesn't fail.
     if CORE.data.get(KEY_CORE, {}).get(KEY_TARGET_PLATFORM) == PLATFORM_RP2040:
-        idedata = platformio_api.get_idedata(config)
+        idedata = toolchain.get_idedata(config)
         build_dir = Path(idedata.firmware_elf_path).parent
         firmware_bin = build_dir / "firmware.bin"
         signed_bin = build_dir / "firmware.bin.signed"
@@ -930,15 +952,15 @@ def upload_using_platformio(config: ConfigType, port: str) -> int:
     upload_args = ["-t", "upload", "-t", "nobuild"]
     if port is not None:
         upload_args += ["--upload-port", port]
-    return platformio_api.run_platformio_cli_run(config, CORE.verbose, *upload_args)
+    return toolchain.run_platformio_cli_run(config, CORE.verbose, *upload_args)
 
 
 def _find_picotool() -> Path | None:
     """Find the picotool binary from PlatformIO packages."""
-    from esphome import platformio_api
+    from esphome.platformio import toolchain
 
     try:
-        idedata = platformio_api.get_idedata(CORE.config)
+        idedata = toolchain.get_idedata(CORE.config)
     except Exception:  # noqa: BLE001  # pylint: disable=broad-except
         return None
     return get_picotool_path(idedata.cc_path)
@@ -951,9 +973,9 @@ def upload_using_picotool(config: ConfigType) -> int:
     the mass storage copy approach that causes "disk not ejected properly"
     warnings on macOS.
     """
-    from esphome import platformio_api
+    from esphome.platformio import toolchain
 
-    idedata = platformio_api.get_idedata(config)
+    idedata = toolchain.get_idedata(config)
     firmware_elf = Path(idedata.firmware_elf_path)
 
     if not firmware_elf.is_file():
@@ -1078,6 +1100,22 @@ def upload_program(
 
     port_type = get_port_type(host)
 
+    # MQTT and MQTTIP are also OTA paths; MQTTIP gets resolved to a real IP later by
+    # _resolve_network_devices(). Only SERIAL and BOOTSEL are non-OTA upload paths.
+    is_partition_table = getattr(args, "partition_table", False)
+    is_bootloader = getattr(args, "bootloader", False)
+    if is_partition_table and is_bootloader:
+        raise EsphomeError(
+            "The options --partition-table and --bootloader can't be used together."
+        )
+    option_string = "--partition-table" if is_partition_table else "--bootloader"
+    if port_type in (PortType.SERIAL, PortType.BOOTSEL) and (
+        is_partition_table or is_bootloader
+    ):
+        raise EsphomeError(
+            f"The option {option_string} can only be used for Over The Air updates."
+        )
+
     if port_type == PortType.BOOTSEL:
         exit_code = upload_using_picotool(config)
         # Return None for device - BOOTSEL can't be used for logging,
@@ -1097,30 +1135,211 @@ def upload_program(
 
         return exit_code, host if exit_code == 0 else None
 
-    ota_conf = {}
+    requested_platform = getattr(args, "ota_platform", None)
+    chosen_platform = _choose_ota_platform(config, requested_platform)
+
+    # Resolve MQTT magic strings to actual IP addresses
+    network_devices = _resolve_network_devices(devices, config, args)
+
+    if chosen_platform == CONF_WEB_SERVER:
+        if is_partition_table or is_bootloader:
+            raise EsphomeError(
+                f"{option_string} is only supported with the esphome OTA platform; "
+                "the web_server OTA path can only update the firmware image."
+            )
+        binary = CORE.firmware_bin
+        if getattr(args, "file", None) is not None:
+            binary = Path(args.file)
+        return _upload_via_web_server(config, network_devices, binary)
+
+    return _upload_via_native_api(config, network_devices, args)
+
+
+def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
+    """Pick the OTA platform to use, optionally honoring ``--ota-platform``.
+
+    Default behavior prefers ``esphome`` (native API) when it is configured.
+    The native API uses challenge-response auth with MD5/SHA256 hashing of a
+    server-issued nonce, so the password is never sent over the wire; the
+    ``web_server`` path uses HTTP Basic auth which transmits credentials in
+    cleartext over the LAN. (The native path also supports gzip compression
+    on ESP8266, where flash space is tight; on ESP32/RP2040/LibreTiny the
+    backend reports ``supports_compression() == false`` and the firmware is
+    sent uncompressed regardless of which platform is used.) Falls back to
+    ``web_server`` only when that is the only available platform.
+    """
+    # Use a dict (insertion-ordered) instead of a list so error messages and
+    # membership checks see one entry per platform even if the user has
+    # multiple ``ota:`` items of the same platform; the web_server OTA
+    # platform's final-validate hook merges duplicates anyway.
+    available: dict[str, None] = {}
     for ota_item in config.get(CONF_OTA, []):
-        if ota_item[CONF_PLATFORM] == CONF_ESPHOME:
+        platform = ota_item.get(CONF_PLATFORM)
+        if platform in (CONF_ESPHOME, CONF_WEB_SERVER):
+            available[platform] = None
+
+    if not available:
+        raise EsphomeError(
+            f"Cannot upload Over the Air as the {CONF_OTA} configuration is not "
+            f"present or does not include {CONF_PLATFORM}: {CONF_ESPHOME} or "
+            f"{CONF_PLATFORM}: {CONF_WEB_SERVER}"
+        )
+
+    if requested is not None:
+        if requested not in available:
+            raise EsphomeError(
+                f"--ota-platform {requested} was requested but the configuration "
+                f"only provides: {', '.join(available)}"
+            )
+        return requested
+
+    if CONF_ESPHOME in available:
+        return CONF_ESPHOME
+    return CONF_WEB_SERVER
+
+
+def _upload_via_native_api(
+    config: ConfigType, network_devices: list[str], args: ArgsProtocol
+) -> tuple[int, str | None]:
+    ota_conf: ConfigType = {}
+    for ota_item in config.get(CONF_OTA, []):
+        if ota_item.get(CONF_PLATFORM) == CONF_ESPHOME:
             ota_conf = ota_item
             break
 
-    if not ota_conf:
-        raise EsphomeError(
-            f"Cannot upload Over the Air as the {CONF_OTA} configuration is not present or does not include {CONF_PLATFORM}: {CONF_ESPHOME}"
-        )
-
     from esphome import espota2
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
+
+    def check_partition_access(option_string: str) -> None:
+        if not ota_conf.get("allow_partition_access"):
+            raise EsphomeError(
+                f"The option {option_string} requires 'allow_partition_access: true' on the "
+                "esphome OTA platform in the device's YAML configuration. Add it, recompile, "
+                f"flash a build with the option enabled, and then retry {option_string}."
+            )
+
+    binary = CORE.firmware_bin
+    ota_type = espota2.OTA_TYPE_UPDATE_APP
+    if getattr(args, "partition_table", False):
+        # Fail fast if the resolved ESPHome OTA config does not enable allow_partition_access.
+        # The device-side handshake also rejects this with "Device only supports app updates",
+        # but checking here surfaces the misconfiguration before opening a network connection.
+        check_partition_access("--partition-table")
+        binary = CORE.partition_table_bin
+        ota_type = espota2.OTA_TYPE_UPDATE_PARTITION_TABLE
+    elif getattr(args, "bootloader", False):
+        check_partition_access("--bootloader")
+        binary = CORE.bootloader_bin
+        ota_type = espota2.OTA_TYPE_UPDATE_BOOTLOADER
     if getattr(args, "file", None) is not None:
         binary = Path(args.file)
-    else:
-        binary = CORE.firmware_bin
 
-    # Resolve MQTT magic strings to actual IP addresses
-    network_devices = _resolve_network_devices(devices, config, args)
+    if ota_type == espota2.OTA_TYPE_UPDATE_PARTITION_TABLE:
+        _validate_partition_table_binary(binary)
+    if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
+        _validate_bootloader_binary(binary)
 
-    return espota2.run_ota(network_devices, remote_port, password, binary)
+    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)
+
+
+def _upload_via_web_server(
+    config: ConfigType, network_devices: list[str], binary: Path
+) -> tuple[int, str | None]:
+    web_conf = config.get(CONF_WEB_SERVER)
+    if not web_conf:
+        raise EsphomeError(
+            f"Cannot upload via web_server OTA: the {CONF_WEB_SERVER} component "
+            f"is not configured."
+        )
+
+    remote_port = int(web_conf[CONF_PORT])
+    auth = web_conf.get(CONF_AUTH) or {}
+    username = auth.get(CONF_USERNAME)
+    password = auth.get(CONF_PASSWORD)
+
+    from esphome import web_server_ota
+
+    return web_server_ota.run_ota(
+        network_devices, remote_port, username, password, binary
+    )
+
+
+# Layout of esp_partition_info_t on flash. Each entry is 32 bytes, leading with a
+# 16-bit little-endian magic. ESP-IDF defines ESP_PARTITION_MAGIC = 0x50AA (stored as
+# bytes 0xAA, 0x50) for partition entries and ESP_PARTITION_MAGIC_MD5 = 0xEBEB for the
+# trailing checksum entry. Padding past the last entry is 0xFF. The full table is
+# exactly ESP_PARTITION_TABLE_MAX_LEN bytes.
+_PARTITION_TABLE_MAX_LEN = 0xC00
+_ESP_PARTITION_MAGIC = 0x50AA
+_ESP_PARTITION_MAGIC_MD5 = 0xEBEB
+_ESP_IMAGE_HEADER_MAGIC = 0xE9
+
+
+def _validate_partition_table_binary(binary: Path) -> None:
+    """Validate that ``binary`` looks like an ESP32 partition table image.
+
+    Catches common mistakes (wrong file, truncated build output, swapped --file path)
+    before opening a network connection so the failure mode is a clear local error
+    instead of a post-handshake device rejection.
+    """
+    try:
+        data = binary.read_bytes()
+    except OSError as err:
+        raise EsphomeError(
+            f"Cannot read partition table file '{binary}': {err}"
+        ) from err
+
+    if len(data) != _PARTITION_TABLE_MAX_LEN:
+        raise EsphomeError(
+            f"Partition table file '{binary}' has wrong size: expected "
+            f"{_PARTITION_TABLE_MAX_LEN} bytes, got {len(data)}. "
+            "Pass the partition table image (e.g. partitions.bin / partition-table.bin), "
+            "not the firmware image."
+        )
+
+    first_magic = data[0] | (data[1] << 8)
+    if first_magic != _ESP_PARTITION_MAGIC:
+        raise EsphomeError(
+            f"Partition table file '{binary}' does not start with the expected "
+            f"partition magic 0x{_ESP_PARTITION_MAGIC:04X} (got 0x{first_magic:04X}). "
+            "This file does not look like an ESP32 partition table."
+        )
+
+    # The MD5 checksum entry is required: without it the device-side
+    # esp_partition_table_verify will accept the table but the bootloader will
+    # refuse to boot from it. Scan the 32-byte entries for the MD5 magic.
+    if not any(
+        (data[off] | (data[off + 1] << 8)) == _ESP_PARTITION_MAGIC_MD5
+        for off in range(0, _PARTITION_TABLE_MAX_LEN, 32)
+    ):
+        raise EsphomeError(
+            f"Partition table file '{binary}' is missing the MD5 checksum entry. "
+            "Regenerate the partition table with gen_esp32part.py or rebuild the project."
+        )
+
+
+def _validate_bootloader_binary(binary: Path) -> None:
+    """Validate that ``binary`` looks like an ESP32 bootloader image."""
+    try:
+        data = binary.read_bytes()
+    except OSError as err:
+        raise EsphomeError(f"Cannot read bootloader file '{binary}': {err}") from err
+
+    if not data:
+        raise EsphomeError(
+            f"Bootloader file '{binary}' is empty. "
+            "This file does not look like an ESP32 bootloader."
+        )
+
+    first_magic = data[0]
+    if first_magic != _ESP_IMAGE_HEADER_MAGIC:
+        raise EsphomeError(
+            f"Bootloader file '{binary}' does not start with the expected "
+            f"image header magic 0x{_ESP_IMAGE_HEADER_MAGIC:02X} (got 0x{first_magic:02X}). "
+            "This file does not look like an ESP32 bootloader."
+        )
 
 
 def show_logs(config: ConfigType, args: ArgsProtocol, devices: list[str]) -> int | None:
@@ -1180,6 +1399,8 @@ def command_wizard(args: ArgsProtocol) -> int | None:
 
 
 def command_config(args: ArgsProtocol, config: ConfigType) -> int | None:
+    from esphome import yaml_util
+
     if not CORE.verbose:
         config = strip_default_ids(config)
     output = yaml_util.dump(config, args.show_secrets)
@@ -1203,8 +1424,7 @@ def command_vscode(args: ArgsProtocol) -> int | None:
 
 
 def command_compile(args: ArgsProtocol, config: ConfigType) -> int | None:
-    native_idf = getattr(args, "native_idf", False)
-    exit_code = write_cpp(config, native_idf=native_idf)
+    exit_code = write_cpp(config)
     if exit_code != 0:
         return exit_code
     if args.only_generate:
@@ -1214,9 +1434,14 @@ def command_compile(args: ArgsProtocol, config: ConfigType) -> int | None:
     if exit_code != 0:
         return exit_code
     if CORE.is_host:
-        from esphome.platformio_api import get_idedata
+        if CORE.using_toolchain_esp_idf:
+            from esphome.espidf import toolchain
 
-        program_path = str(get_idedata(config).firmware_elf_path)
+            program_path = str(toolchain.get_elf_path())
+        else:
+            from esphome.platformio.toolchain import get_idedata
+
+            program_path = str(get_idedata(config).firmware_elf_path)
         _LOGGER.info("Successfully compiled program to path '%s'", program_path)
     else:
         _LOGGER.info("Successfully compiled program.")
@@ -1259,8 +1484,7 @@ def command_logs(args: ArgsProtocol, config: ConfigType) -> int | None:
 
 
 def command_run(args: ArgsProtocol, config: ConfigType) -> int | None:
-    native_idf = getattr(args, "native_idf", False)
-    exit_code = write_cpp(config, native_idf=native_idf)
+    exit_code = write_cpp(config)
     if exit_code != 0:
         return exit_code
     exit_code = compile_program(args, config)
@@ -1268,9 +1492,14 @@ def command_run(args: ArgsProtocol, config: ConfigType) -> int | None:
         return exit_code
     _LOGGER.info("Successfully compiled program.")
     if CORE.is_host:
-        from esphome.platformio_api import get_idedata
+        if CORE.using_toolchain_esp_idf:
+            from esphome.espidf import toolchain
 
-        program_path = str(get_idedata(config).firmware_elf_path)
+            program_path = str(toolchain.get_elf_path())
+        else:
+            from esphome.platformio.toolchain import get_idedata
+
+            program_path = str(get_idedata(config).firmware_elf_path)
         _LOGGER.info("Running program from path '%s'", program_path)
         return run_external_process(program_path)
 
@@ -1321,6 +1550,8 @@ def command_clean_mqtt(args: ArgsProtocol, config: ConfigType) -> int | None:
 
 
 def command_clean_all(args: ArgsProtocol) -> int | None:
+    from esphome import writer
+
     try:
         writer.clean_all(args.configuration)
     except OSError as err:
@@ -1336,6 +1567,8 @@ def command_version(args: ArgsProtocol) -> int | None:
 
 
 def command_clean(args: ArgsProtocol, config: ConfigType) -> int | None:
+    from esphome import writer
+
     try:
         writer.clean_build()
     except OSError as err:
@@ -1457,12 +1690,19 @@ def command_update_all(args: ArgsProtocol) -> int | None:
 def command_idedata(args: ArgsProtocol, config: ConfigType) -> int:
     import json
 
-    from esphome import platformio_api
+    if not CORE.using_toolchain_platformio:
+        _LOGGER.error(
+            "The idedata command is not compatible with %s toolchain",
+            CORE.toolchain.value,
+        )
+        return 1
+
+    from esphome.platformio import toolchain
 
     logging.disable(logging.INFO)
     logging.disable(logging.WARNING)
 
-    idedata = platformio_api.get_idedata(config)
+    idedata = toolchain.get_idedata(config)
     if idedata is None:
         return 1
 
@@ -1476,7 +1716,6 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     This command compiles the configuration and performs memory analysis.
     Compilation is fast if sources haven't changed (just relinking).
     """
-    from esphome import platformio_api
     from esphome.analyze_memory.cli import MemoryAnalyzerCLI
     from esphome.analyze_memory.ram_strings import RamStringsAnalyzer
 
@@ -1490,12 +1729,25 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     _LOGGER.info("Successfully compiled program.")
 
     # Get idedata for analysis
-    idedata = platformio_api.get_idedata(config)
-    if idedata is None:
-        _LOGGER.error("Failed to get IDE data for memory analysis")
-        return 1
+    idedata = None
+    if CORE.using_toolchain_esp_idf:
+        from esphome.espidf import toolchain
 
-    firmware_elf = Path(idedata.firmware_elf_path)
+        objdump_path = str(toolchain.get_objdump_path())
+        readelf_path = str(toolchain.get_readelf_path())
+
+        firmware_elf = toolchain.get_elf_path()
+    else:
+        from esphome.platformio import toolchain
+
+        idedata = toolchain.get_idedata(config)
+        if idedata is None:
+            _LOGGER.error("Failed to get IDE data for memory analysis")
+            return 1
+        objdump_path = idedata.objdump_path
+        readelf_path = idedata.readelf_path
+
+        firmware_elf = Path(idedata.firmware_elf_path)
 
     # Extract external components from config
     external_components = detect_external_components(config)
@@ -1505,8 +1757,8 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     _LOGGER.info("Analyzing memory usage...")
     analyzer = MemoryAnalyzerCLI(
         str(firmware_elf),
-        idedata.objdump_path,
-        idedata.readelf_path,
+        objdump_path,
+        readelf_path,
         external_components,
         idedata=idedata,
     )
@@ -1522,7 +1774,7 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
     try:
         ram_analyzer = RamStringsAnalyzer(
             str(firmware_elf),
-            objdump_path=idedata.objdump_path,
+            objdump_path=objdump_path,
             platform=CORE.target_platform,
         )
         ram_analyzer.analyze()
@@ -1538,6 +1790,8 @@ def command_analyze_memory(args: ArgsProtocol, config: ConfigType) -> int:
 
 
 def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
+    from esphome import yaml_util
+
     new_name = args.name
     for c in new_name:
         if c not in ALLOWED_NAME_CHARS:
@@ -1563,11 +1817,32 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
     old_name = yaml[CONF_ESPHOME][CONF_NAME]
     match = re.match(r"^\$\{?([a-zA-Z0-9_]+)\}?$", old_name)
     if match is None:
-        new_raw = re.sub(
-            rf"name:\s+[\"']?{old_name}[\"']?",
-            f'name: "{new_name}"',
-            raw_contents,
+        # Only swap the ``name:`` line that sits directly under the
+        # top-level ``esphome:`` block. A naked ``re.sub`` would
+        # also clobber any other ``name:`` line whose value happens
+        # to match (e.g. a sensor / output / wifi entry sharing the
+        # device's hostname), silently rewriting unrelated user
+        # configuration. The pattern anchors:
+        # - at the start of the line so ``friendly_name:``,
+        #   ``device_name:`` etc. don't match the trailing ``name:``
+        #   substring; and
+        # - at the end of the value (lookahead for whitespace +
+        #   comment + EOL) so ``old_name`` doesn't match as a
+        #   prefix of a longer value (``kitchen`` vs ``kitchen2``).
+        name_pattern = re.compile(
+            rf"^(\s*)name:\s+[\"']?{re.escape(old_name)}[\"']?(?=\s*(?:#|$))"
         )
+        out_lines: list[str] = []
+        in_esphome_block = False
+        for line in raw_contents.splitlines(keepends=True):
+            if line and not line[0].isspace() and line.strip():
+                in_esphome_block = line.lstrip().startswith("esphome:")
+                out_lines.append(line)
+                continue
+            if in_esphome_block:
+                line = name_pattern.sub(rf'\1name: "{new_name}"', line, count=1)
+            out_lines.append(line)
+        new_raw = "".join(out_lines)
     else:
         old_name = yaml[CONF_SUBSTITUTIONS][match.group(1)]
         if (
@@ -1590,7 +1865,40 @@ def command_rename(args: ArgsProtocol, config: ConfigType) -> int | None:
             flags=re.MULTILINE,
         )
 
+    # ``new_name == old_name`` (after substitution resolution) is
+    # a no-op rewrite that would still queue a pointless re-flash.
+    # Catch it before the path-equality check below — covers the
+    # case where the config filename doesn't match the device name
+    # (e.g. ``weird-file.yaml`` whose ``esphome.name`` is
+    # ``kitchen``; running ``esphome rename weird-file.yaml kitchen``
+    # would otherwise just re-flash the same hostname).
+    if new_name == old_name:
+        print(
+            color(
+                AnsiFore.BOLD_RED,
+                f"'{new_name}' is already the device's name.",
+            )
+        )
+        return 1
+
     new_path: Path = CORE.config_dir / (new_name + ".yaml")
+    if new_path.resolve() == CORE.config_path.resolve():
+        print(
+            color(
+                AnsiFore.BOLD_RED,
+                f"'{new_name}' is already the device's name.",
+            )
+        )
+        return 1
+    if new_path.exists():
+        print(
+            color(
+                AnsiFore.BOLD_RED,
+                f"Cannot rename: {new_path} already exists. "
+                "Refusing to overwrite an existing configuration.",
+            )
+        )
+        return 1
     print(
         f"Updating {color(AnsiFore.CYAN, str(CORE.config_path))} to {color(AnsiFore.CYAN, str(new_path))}"
     )
@@ -1711,6 +2019,17 @@ def parse_args(argv):
         action="store_true",
         default=False,
     )
+    options_parser.add_argument(
+        "--toolchain",
+        type=Toolchain,
+        default=None,
+        choices=list(Toolchain),
+        metavar="{" + ",".join(t.value for t in Toolchain) + "}",
+        help=(
+            "Select toolchain for compiling. Overrides '<platform>.toolchain' in YAML. "
+            f"Default: {Toolchain.PLATFORMIO.value}."
+        ),
+    )
 
     parser = argparse.ArgumentParser(
         description=f"ESPHome {const.__version__}", parents=[options_parser]
@@ -1755,11 +2074,6 @@ def parse_args(argv):
         help="Only generate source code, do not compile.",
         action="store_true",
     )
-    parser_compile.add_argument(
-        "--native-idf",
-        help="Build with native ESP-IDF instead of PlatformIO (ESP32 esp-idf framework only).",
-        action="store_true",
-    )
 
     parser_upload = subparsers.add_parser(
         "upload",
@@ -1782,6 +2096,27 @@ def parse_args(argv):
         "--file",
         help="Manually specify the binary file to upload.",
     )
+    parser_upload.add_argument(
+        "--ota-platform",
+        choices=[CONF_ESPHOME, CONF_WEB_SERVER],
+        help=(
+            "OTA platform to use for network uploads. Defaults to "
+            f"'{CONF_ESPHOME}' (native API) when configured because it uses "
+            "challenge-response auth so the password is never sent in "
+            f"cleartext on the wire. Falls back to '{CONF_WEB_SERVER}' "
+            "(HTTP Basic auth) when that is the only configured platform."
+        ),
+    )
+    parser_upload.add_argument(
+        "--partition-table",
+        help="Upload as partition table (OTA).",
+        action="store_true",
+    )
+    parser_upload.add_argument(
+        "--bootloader",
+        help="Upload as bootloader (OTA).",
+        action="store_true",
+    )
 
     parser_logs = subparsers.add_parser(
         "logs",
@@ -1839,6 +2174,13 @@ def parse_args(argv):
     parser_run.add_argument(
         "--no-logs", help="Disable starting logs.", action="store_true"
     )
+
+    parser_run.add_argument(
+        "--no-states",
+        action="store_true",
+        help="Do not show entity state changes in log output.",
+    )
+
     parser_run.add_argument(
         "--reset",
         "-r",
@@ -1847,9 +2189,15 @@ def parse_args(argv):
         default=os.getenv("ESPHOME_SERIAL_LOGGING_RESET"),
     )
     parser_run.add_argument(
-        "--native-idf",
-        help="Build with native ESP-IDF instead of PlatformIO (ESP32 esp-idf framework only).",
-        action="store_true",
+        "--ota-platform",
+        choices=[CONF_ESPHOME, CONF_WEB_SERVER],
+        help=(
+            "OTA platform to use for network uploads. Defaults to "
+            f"'{CONF_ESPHOME}' (native API) when configured because it uses "
+            "challenge-response auth so the password is never sent in "
+            f"cleartext on the wire. Falls back to '{CONF_WEB_SERVER}' "
+            "(HTTP Basic auth) when that is the only configured platform."
+        ),
     )
 
     parser_clean = subparsers.add_parser(
@@ -2062,9 +2410,13 @@ def run_esphome(argv):
 
     CORE.config_path = conf_path
     CORE.dashboard = args.dashboard
+    if args.toolchain is not None:
+        # CLI toolchain wins over esp32.toolchain in YAML.
+        CORE.toolchain = args.toolchain
 
-    # For logs command, skip updating external components
-    skip_external = args.command == "logs"
+    # Commands that don't need fresh external components: logs just connects
+    # to the device, and clean is about to delete the build directory.
+    skip_external = args.command in ("logs", "clean")
     config = read_config(
         dict(args.substitution) if args.substitution else {},
         skip_external_update=skip_external,
@@ -2073,6 +2425,12 @@ def run_esphome(argv):
         return 2
     CORE.config = config
 
+    # Fallback for platforms whose validators didn't set the toolchain
+    # (only the esp32 component reads esp32.framework.toolchain). All
+    # other platforms only support PlatformIO today.
+    if CORE.toolchain is None:
+        CORE.toolchain = Toolchain.PLATFORMIO
+
     if args.command not in POST_CONFIG_ACTIONS:
         safe_print(f"Unknown command {args.command}")
         return 1

esphome/analyze_memory/__init__.py

@@ -24,7 +24,7 @@ from .helpers import (
 from .toolchain import find_tool, resolve_tool_path, run_tool
 
 if TYPE_CHECKING:
-    from esphome.platformio_api import IDEData
+    from esphome.platformio.toolchain import IDEData
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -793,8 +793,11 @@ class MemoryAnalyzer:
         """Scan ESPHome source object files to map extern "C" symbols to components.
 
         When no linker map file is available, this uses ``nm`` to scan ``.o`` files
-        under ``src/esphome/`` and build a symbol-to-component mapping. This catches
-        ``extern "C"`` functions and other symbols that lack C++ namespace prefixes.
+        under ``src/`` (including ``src/main.cpp.o`` and everything beneath
+        ``src/esphome/``) and build a symbol-to-component mapping. This catches
+        ``extern "C"`` functions, the ESPHome-generated ``setup()``/``loop()``
+        entry points in ``main.cpp``, and other symbols that lack C++ namespace
+        prefixes.
 
         Skips scanning if ``_source_symbol_map`` was already populated by
         ``_parse_map_file()``.
@@ -806,12 +809,12 @@ class MemoryAnalyzer:
         if obj_dir is None:
             return
 
-        # Find ESPHome source object files
-        esphome_src_dir = obj_dir / "src" / "esphome"
-        if not esphome_src_dir.is_dir():
+        # Scan all ESPHome-owned source object files: src/main.cpp.o and src/esphome/...
+        src_dir = obj_dir / "src"
+        if not src_dir.is_dir():
             return
 
-        obj_files = sorted(esphome_src_dir.rglob("*.o"))
+        obj_files = sorted(src_dir.rglob("*.o"))
         if not obj_files:
             return
 
@@ -1064,6 +1067,10 @@ class MemoryAnalyzer:
                 if component_name in self.external_components:
                     return f"{_COMPONENT_PREFIX_EXTERNAL}{component_name}"
 
+        # ESPHome-generated entry point: src/main.cpp.o (contains setup()/loop())
+        if len(parts) >= 2 and parts[-2:] == ("src", "main.cpp.o"):
+            return _COMPONENT_CORE
+
         # ESPHome core: src/esphome/core/... or src/esphome/...
         if "core" in parts and "esphome" in parts:
             return _COMPONENT_CORE

esphome/analyze_memory/cli.py

@@ -739,7 +739,7 @@ def main():
     import json
     from pathlib import Path
 
-    from esphome.platformio_api import IDEData
+    from esphome.platformio.toolchain import IDEData
 
     build_path = Path(build_dir)
 

esphome/automation.py

@@ -127,7 +127,7 @@ def validate_potentially_or_condition(value):
     return validate_condition(value)
 
 
-DelayAction = cg.esphome_ns.class_("DelayAction", Action, cg.Component)
+DelayAction = cg.esphome_ns.class_("DelayAction", Action)
 LambdaAction = cg.esphome_ns.class_("LambdaAction", Action)
 StatelessLambdaAction = cg.esphome_ns.class_("StatelessLambdaAction", Action)
 IfAction = cg.esphome_ns.class_("IfAction", Action)
@@ -396,7 +396,6 @@ async def delay_action_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     var = cg.new_Pvariable(action_id, template_arg)
-    await cg.register_component(var, {})
     template_ = await cg.templatable(config, args, cg.uint32)
     cg.add(var.set_delay(template_))
     return var
@@ -597,7 +596,7 @@ async def component_resume_action_to_code(
     comp = await cg.get_variable(config[CONF_ID])
     var = cg.new_Pvariable(action_id, template_arg, comp)
     if CONF_UPDATE_INTERVAL in config:
-        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, int)
+        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, cg.uint32)
         cg.add(var.set_update_interval(template_))
     return var
 

esphome/build_gen/espidf.py

@@ -6,6 +6,7 @@ from pathlib import Path
 from esphome.components.esp32 import get_esp32_variant
 from esphome.core import CORE
 from esphome.helpers import mkdir_p, write_file_if_changed
+from esphome.writer import update_storage_json
 
 
 def get_available_components() -> list[str] | None:
@@ -54,7 +55,7 @@ def get_project_cmakelists() -> str:
     idf_target = variant.lower().replace("-", "")
 
     # Extract compile definitions from build flags (-DXXX -> XXX)
-    compile_defs = [flag for flag in CORE.build_flags if flag.startswith("-D")]
+    compile_defs = [flag for flag in sorted(CORE.build_flags) if flag.startswith("-D")]
     extra_compile_options = "\n".join(
         f'idf_build_set_property(COMPILE_OPTIONS "{compile_def}" APPEND)'
         for compile_def in compile_defs
@@ -64,6 +65,22 @@ def get_project_cmakelists() -> str:
 # Auto-generated by ESPHome
 cmake_minimum_required(VERSION 3.16)
 
+# On Windows, Ninja can fail with:
+#   "CreateProcess: The parameter is incorrect (is the command line too long?)"
+# when compiler/linker command lines exceed the OS length limit.
+#
+# The following settings force CMake/Ninja to use *response files* (@file.rsp)
+# to pass long lists of includes, objects, and other arguments indirectly,
+# avoiding command-line length limits and fixing the build failure.
+#
+# This is especially useful for large ESP-IDF / ESPHome projects with many
+# source files or include directories.
+set(CMAKE_C_USE_RESPONSE_FILE_FOR_INCLUDES 1)
+set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_INCLUDES 1)
+set(CMAKE_C_USE_RESPONSE_FILE_FOR_OBJECTS 1)
+set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_OBJECTS 1)
+set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
+
 set(IDF_TARGET {idf_target})
 set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)
 
@@ -124,6 +141,11 @@ target_link_options(${{COMPONENT_LIB}} PUBLIC
 
 def write_project(minimal: bool = False) -> None:
     """Write ESP-IDF project files."""
+    # Refresh <data_dir>/storage/<name>.yaml.json so the dashboard's
+    # /info and /downloads endpoints can locate the build (they 404
+    # otherwise). This mirrors the PlatformIO build-gen path's call
+    # in build_gen/platformio.py:write_ini().
+    update_storage_json()
     mkdir_p(CORE.build_path)
     mkdir_p(CORE.relative_src_path())
 

esphome/bundle.py

@@ -98,11 +98,13 @@ _KNOWN_FILE_EXTENSIONS = frozenset(
 )
 
 
-# Matches !secret references in YAML text.  This is intentionally a simple
-# regex scan rather than a YAML parse — it may match inside comments or
-# multi-line strings, which is the conservative direction (include more
-# secrets rather than fewer).
-_SECRET_RE = re.compile(r"!secret\s+(\S+)")
+# Matches !secret references in YAML text.  An optional surrounding
+# quote pair around the key is allowed and ignored: YAML treats
+# ``!secret 'foo'`` and ``!secret foo`` as the same key.  This is
+# intentionally a simple regex scan rather than a YAML parse — it may
+# match inside comments or multi-line strings, which is the conservative
+# direction (include more secrets rather than fewer).
+_SECRET_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""")
 
 
 def _find_used_secret_keys(yaml_files: list[Path]) -> set[str]:

esphome/components/a01nyub/a01nyub.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a01nyub {
+namespace esphome::a01nyub {
 
 static const char *const TAG = "a01nyub.sensor";
 
@@ -42,5 +41,4 @@ void A01nyubComponent::check_buffer_() {
 
 void A01nyubComponent::dump_config() { LOG_SENSOR("", "A01nyub Sensor", this); }
 
-}  // namespace a01nyub
-}  // namespace esphome
+}  // namespace esphome::a01nyub

esphome/components/a01nyub/a01nyub.h

@@ -6,8 +6,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome {
-namespace a01nyub {
+namespace esphome::a01nyub {
 
 class A01nyubComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -23,5 +22,4 @@ class A01nyubComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace a01nyub
-}  // namespace esphome
+}  // namespace esphome::a01nyub

esphome/components/a02yyuw/a02yyuw.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a02yyuw {
+namespace esphome::a02yyuw {
 
 static const char *const TAG = "a02yyuw.sensor";
 
@@ -41,5 +40,4 @@ void A02yyuwComponent::check_buffer_() {
 
 void A02yyuwComponent::dump_config() { LOG_SENSOR("", "A02yyuw Sensor", this); }
 
-}  // namespace a02yyuw
-}  // namespace esphome
+}  // namespace esphome::a02yyuw

esphome/components/a02yyuw/a02yyuw.h

@@ -6,8 +6,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome {
-namespace a02yyuw {
+namespace esphome::a02yyuw {
 
 class A02yyuwComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -23,5 +22,4 @@ class A02yyuwComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace a02yyuw
-}  // namespace esphome
+}  // namespace esphome::a02yyuw

esphome/components/a4988/a4988.cpp

@@ -1,8 +1,7 @@
 #include "a4988.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace a4988 {
+namespace esphome::a4988 {
 
 static const char *const TAG = "a4988.stepper";
 
@@ -51,5 +50,4 @@ void A4988::loop() {
   this->step_pin_->digital_write(false);
 }
 
-}  // namespace a4988
-}  // namespace esphome
+}  // namespace esphome::a4988

esphome/components/a4988/a4988.h

@@ -4,8 +4,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/stepper/stepper.h"
 
-namespace esphome {
-namespace a4988 {
+namespace esphome::a4988 {
 
 class A4988 : public stepper::Stepper, public Component {
  public:
@@ -25,5 +24,4 @@ class A4988 : public stepper::Stepper, public Component {
   HighFrequencyLoopRequester high_freq_;
 };
 
-}  // namespace a4988
-}  // namespace esphome
+}  // namespace esphome::a4988

esphome/components/adalight/adalight_light_effect.cpp

@@ -1,8 +1,7 @@
 #include "adalight_light_effect.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adalight {
+namespace esphome::adalight {
 
 static const char *const TAG = "adalight_light_effect";
 
@@ -129,7 +128,7 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   uint8_t *led_data = &frame_[6];
 
   for (int led = 0; led < accepted_led_count; led++, led_data += 3) {
-    auto white = std::min(std::min(led_data[0], led_data[1]), led_data[2]);
+    auto white = std::min({led_data[0], led_data[1], led_data[2]});
 
     it[led].set(Color(led_data[0], led_data[1], led_data[2], white));
   }
@@ -138,5 +137,4 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   return CONSUMED;
 }
 
-}  // namespace adalight
-}  // namespace esphome
+}  // namespace esphome::adalight

esphome/components/adalight/adalight_light_effect.h

@@ -6,8 +6,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace adalight {
+namespace esphome::adalight {
 
 class AdalightLightEffect : public light::AddressableLightEffect, public uart::UARTDevice {
  public:
@@ -35,5 +34,4 @@ class AdalightLightEffect : public light::AddressableLightEffect, public uart::U
   std::vector<uint8_t> frame_;
 };
 
-}  // namespace adalight
-}  // namespace esphome
+}  // namespace esphome::adalight

esphome/components/adc/adc_sensor.h

@@ -17,8 +17,7 @@
 #include <zephyr/drivers/adc.h>
 #endif
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 #ifdef USE_ESP32
 // clang-format off
@@ -162,5 +161,4 @@ class ADCSensor : public sensor::Sensor, public PollingComponent, public voltage
 #endif
 };
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc

esphome/components/adc/adc_sensor_common.cpp

@@ -1,8 +1,7 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.common";
 
@@ -79,5 +78,4 @@ void ADCSensor::set_sample_count(uint8_t sample_count) {
 
 void ADCSensor::set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc

esphome/components/adc/adc_sensor_esp32.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/log.h"
 #include <cinttypes>
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.esp32";
 
@@ -364,7 +363,6 @@ float ADCSensor::sample_autorange_() {
   return final_result;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_ESP32

esphome/components/adc/adc_sensor_esp8266.cpp

@@ -11,8 +11,7 @@ ADC_MODE(ADC_VCC)
 #include <Arduino.h>
 #endif  // USE_ADC_SENSOR_VCC
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.esp8266";
 
@@ -55,7 +54,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1024.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_ESP8266

esphome/components/adc/adc_sensor_libretiny.cpp

@@ -3,8 +3,7 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.libretiny";
 
@@ -48,7 +47,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1000.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_LIBRETINY

esphome/components/adc/adc_sensor_rp2040.cpp

@@ -15,8 +15,7 @@
 #define PICO_VSYS_PIN 29  // NOLINT(cppcoreguidelines-macro-usage)
 #endif
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.rp2040";
 
@@ -98,7 +97,6 @@ float ADCSensor::sample() {
   return aggr.aggregate() * 3.3f / 4096.0f * coeff;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 
 #endif  // USE_RP2040

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -5,8 +5,7 @@
 
 #include "hal/nrf_saadc.h"
 
-namespace esphome {
-namespace adc {
+namespace esphome::adc {
 
 static const char *const TAG = "adc.zephyr";
 
@@ -202,6 +201,5 @@ float ADCSensor::sample() {
   return val_mv / 1000.0f;
 }
 
-}  // namespace adc
-}  // namespace esphome
+}  // namespace esphome::adc
 #endif

esphome/components/adc128s102/adc128s102.cpp

@@ -1,8 +1,7 @@
 #include "adc128s102.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 static const char *const TAG = "adc128s102";
 
@@ -28,5 +27,4 @@ uint16_t ADC128S102::read_data(uint8_t channel) {
   return digital_value;
 }
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/adc128s102.h

@@ -4,8 +4,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/spi/spi.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 class ADC128S102 : public Component,
                    public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW, spi::CLOCK_PHASE_LEADING,
@@ -19,5 +18,4 @@ class ADC128S102 : public Component,
   uint16_t read_data(uint8_t channel);
 };
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/sensor/adc128s102_sensor.cpp

@@ -2,8 +2,7 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 static const char *const TAG = "adc128s102.sensor";
 
@@ -18,5 +17,4 @@ void ADC128S102Sensor::dump_config() {
 float ADC128S102Sensor::sample() { return this->parent_->read_data(this->channel_); }
 void ADC128S102Sensor::update() { this->publish_state(this->sample()); }
 
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/adc128s102/sensor/adc128s102_sensor.h

@@ -7,8 +7,7 @@
 
 #include "../adc128s102.h"
 
-namespace esphome {
-namespace adc128s102 {
+namespace esphome::adc128s102 {
 
 class ADC128S102Sensor : public PollingComponent,
                          public Parented<ADC128S102>,
@@ -24,5 +23,4 @@ class ADC128S102Sensor : public PollingComponent,
  protected:
   uint8_t channel_;
 };
-}  // namespace adc128s102
-}  // namespace esphome
+}  // namespace esphome::adc128s102

esphome/components/addressable_light/addressable_light_display.cpp

@@ -1,8 +1,7 @@
 #include "addressable_light_display.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace addressable_light {
+namespace esphome::addressable_light {
 
 static const char *const TAG = "addressable_light.display";
 
@@ -66,5 +65,4 @@ void HOT AddressableLightDisplay::draw_absolute_pixel_internal(int x, int y, Col
     this->addressable_light_buffer_[y * this->get_width_internal() + x] = color;
   }
 }
-}  // namespace addressable_light
-}  // namespace esphome
+}  // namespace esphome::addressable_light

esphome/components/addressable_light/addressable_light_display.h

@@ -7,8 +7,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace addressable_light {
+namespace esphome::addressable_light {
 
 class AddressableLightDisplay : public display::DisplayBuffer {
  public:
@@ -61,5 +60,4 @@ class AddressableLightDisplay : public display::DisplayBuffer {
   optional<uint32_t> last_effect_index_;
   optional<std::function<int(int, int)>> pixel_mapper_f_;
 };
-}  // namespace addressable_light
-}  // namespace esphome
+}  // namespace esphome::addressable_light

esphome/components/ade7880/ade7880.cpp

@@ -13,8 +13,7 @@
 
 #include <cinttypes>
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 static const char *const TAG = "ade7880";
 
@@ -313,5 +312,4 @@ void ADE7880::reset_device_() {
   this->store_.reset_pending = true;
 }
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880.h

@@ -16,8 +16,7 @@
 
 #include "ade7880_registers.h"
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 struct NeutralChannel {
   void set_current(sensor::Sensor *sens) { this->current = sens; }
@@ -125,5 +124,4 @@ class ADE7880 : public i2c::I2CDevice, public PollingComponent {
   void write_u32_register16_(uint16_t a_register, uint32_t value);
 };
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880_i2c.cpp

@@ -9,8 +9,7 @@
 
 #include "ade7880.h"
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 // adapted from https://stackoverflow.com/a/55912127/1886371
 template<size_t Bits, typename T> inline T sign_extend(const T &v) noexcept {
@@ -97,5 +96,4 @@ void ADE7880::write_u32_register16_(uint16_t a_register, uint32_t value) {
   this->write_register16(a_register, reinterpret_cast<uint8_t *>(&out), sizeof(out));
 }
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7880/ade7880_registers.h

@@ -4,8 +4,7 @@
 
 // Source: https://www.analog.com/media/en/technical-documentation/application-notes/AN-1127.pdf
 
-namespace esphome {
-namespace ade7880 {
+namespace esphome::ade7880 {
 
 // DSP Data Memory RAM registers
 constexpr uint16_t AIGAIN = 0x4380;
@@ -242,5 +241,4 @@ constexpr uint8_t DSPWP_SET_RO = (1 << 7);
 // DSPWP_SEL Register Bits
 constexpr uint8_t DSPWP_SEL_SET = 0xAD;
 
-}  // namespace ade7880
-}  // namespace esphome
+}  // namespace esphome::ade7880

esphome/components/ade7953_base/ade7953_base.cpp

@@ -3,8 +3,7 @@
 
 #include <cinttypes>
 
-namespace esphome {
-namespace ade7953_base {
+namespace esphome::ade7953_base {
 
 static const char *const TAG = "ade7953";
 
@@ -160,5 +159,4 @@ void ADE7953::update() {
   ADE_PUBLISH(frequency, 223750.0f, 1 + val_16);
 }
 
-}  // namespace ade7953_base
-}  // namespace esphome
+}  // namespace esphome::ade7953_base

esphome/components/ade7953_base/ade7953_base.h

@@ -6,8 +6,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_base {
+namespace esphome::ade7953_base {
 
 static constexpr uint8_t PGA_V_8 =
     0x007;  // PGA_V,  (R/W) Default: 0x00, Unsigned, Voltage channel gain configuration (Bits[2:0])
@@ -131,5 +130,4 @@ class ADE7953 : public PollingComponent, public sensor::Sensor {
   virtual bool ade_read_32(uint16_t reg, uint32_t *value) = 0;
 };
 
-}  // namespace ade7953_base
-}  // namespace esphome
+}  // namespace esphome::ade7953_base

esphome/components/ade7953_i2c/ade7953_i2c.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ade7953_i2c {
+namespace esphome::ade7953_i2c {
 
 static const char *const TAG = "ade7953";
 
@@ -76,5 +75,4 @@ bool AdE7953I2c::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace ade7953_i2c
-}  // namespace esphome
+}  // namespace esphome::ade7953_i2c

esphome/components/ade7953_i2c/ade7953_i2c.h

@@ -8,8 +8,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_i2c {
+namespace esphome::ade7953_i2c {
 
 class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
  public:
@@ -24,5 +23,4 @@ class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace ade7953_i2c
-}  // namespace esphome
+}  // namespace esphome::ade7953_i2c

esphome/components/ade7953_spi/ade7953_spi.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ade7953_spi {
+namespace esphome::ade7953_spi {
 
 static const char *const TAG = "ade7953";
 
@@ -83,5 +82,4 @@ bool AdE7953Spi::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace ade7953_spi
-}  // namespace esphome
+}  // namespace esphome::ade7953_spi

esphome/components/ade7953_spi/ade7953_spi.h

@@ -8,8 +8,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ade7953_spi {
+namespace esphome::ade7953_spi {
 
 class AdE7953Spi : public ade7953_base::ADE7953,
                    public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH, spi::CLOCK_PHASE_TRAILING,
@@ -28,5 +27,4 @@ class AdE7953Spi : public ade7953_base::ADE7953,
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace ade7953_spi
-}  // namespace esphome
+}  // namespace esphome::ade7953_spi

esphome/components/ads1115/ads1115.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ads1115 {
+namespace esphome::ads1115 {
 
 static const char *const TAG = "ads1115";
 static const uint8_t ADS1115_REGISTER_CONVERSION = 0x00;
@@ -208,5 +207,4 @@ float ADS1115Component::request_measurement(ADS1115Multiplexer multiplexer, ADS1
   return millivolts / 1e3f;
 }
 
-}  // namespace ads1115
-}  // namespace esphome
+}  // namespace esphome::ads1115

esphome/components/ads1115/ads1115.h

@@ -5,8 +5,7 @@
 
 #include <vector>
 
-namespace esphome {
-namespace ads1115 {
+namespace esphome::ads1115 {
 
 enum ADS1115Multiplexer {
   ADS1115_MULTIPLEXER_P0_N1 = 0b000,
@@ -60,5 +59,4 @@ class ADS1115Component : public Component, public i2c::I2CDevice {
   bool continuous_mode_;
 };
 
-}  // namespace ads1115
-}  // namespace esphome
+}  // namespace esphome::ads1115

esphome/components/ads1115/sensor/ads1115_sensor.cpp

@@ -2,8 +2,7 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ads1115 {
+namespace esphome::ads1115 {
 
 static const char *const TAG = "ads1115.sensor";
 
@@ -29,5 +28,4 @@ void ADS1115Sensor::dump_config() {
                 this->multiplexer_, this->gain_, this->resolution_, this->samplerate_);
 }
 
-}  // namespace ads1115
-}  // namespace esphome
+}  // namespace esphome::ads1115

esphome/components/ads1115/sensor/ads1115_sensor.h

@@ -8,8 +8,7 @@
 
 #include "../ads1115.h"
 
-namespace esphome {
-namespace ads1115 {
+namespace esphome::ads1115 {
 
 /// Internal holder class that is in instance of Sensor so that the hub can create individual sensors.
 class ADS1115Sensor : public sensor::Sensor,
@@ -33,5 +32,4 @@ class ADS1115Sensor : public sensor::Sensor,
   ADS1115Samplerate samplerate_;
 };
 
-}  // namespace ads1115
-}  // namespace esphome
+}  // namespace esphome::ads1115

esphome/components/ads1118/ads1118.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ads1118 {
+namespace esphome::ads1118 {
 
 static const char *const TAG = "ads1118";
 static const uint8_t ADS1118_DATA_RATE_860_SPS = 0b111;
@@ -122,5 +121,4 @@ float ADS1118::request_measurement(ADS1118Multiplexer multiplexer, ADS1118Gain g
   }
 }
 
-}  // namespace ads1118
-}  // namespace esphome
+}  // namespace esphome::ads1118

esphome/components/ads1118/ads1118.h

@@ -4,8 +4,7 @@
 #include "esphome/core/component.h"
 #include "esphome/core/hal.h"
 
-namespace esphome {
-namespace ads1118 {
+namespace esphome::ads1118 {
 
 enum ADS1118Multiplexer {
   ADS1118_MULTIPLEXER_P0_N1 = 0b000,
@@ -41,5 +40,4 @@ class ADS1118 : public Component,
   uint16_t config_{0};
 };
 
-}  // namespace ads1118
-}  // namespace esphome
+}  // namespace esphome::ads1118

esphome/components/ads1118/sensor/ads1118_sensor.cpp

@@ -2,8 +2,7 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace ads1118 {
+namespace esphome::ads1118 {
 
 static const char *const TAG = "ads1118.sensor";
 
@@ -27,5 +26,4 @@ void ADS1118Sensor::update() {
   }
 }
 
-}  // namespace ads1118
-}  // namespace esphome
+}  // namespace esphome::ads1118

esphome/components/ads1118/sensor/ads1118_sensor.h

@@ -8,8 +8,7 @@
 
 #include "../ads1118.h"
 
-namespace esphome {
-namespace ads1118 {
+namespace esphome::ads1118 {
 
 class ADS1118Sensor : public PollingComponent,
                       public sensor::Sensor,
@@ -32,5 +31,4 @@ class ADS1118Sensor : public PollingComponent,
   bool temperature_mode_;
 };
 
-}  // namespace ads1118
-}  // namespace esphome
+}  // namespace esphome::ads1118

esphome/components/ags10/ags10.cpp

@@ -3,8 +3,7 @@
 
 #include <cinttypes>
 
-namespace esphome {
-namespace ags10 {
+namespace esphome::ags10 {
 static const char *const TAG = "ags10";
 
 // Data acquisition.
@@ -192,5 +191,4 @@ template<size_t N> optional<std::array<uint8_t, N>> AGS10Component::read_and_che
 
   return data;
 }
-}  // namespace ags10
-}  // namespace esphome
+}  // namespace esphome::ags10

esphome/components/ags10/ags10.h

@@ -5,8 +5,7 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 
-namespace esphome {
-namespace ags10 {
+namespace esphome::ags10 {
 
 class AGS10Component : public PollingComponent, public i2c::I2CDevice {
  public:
@@ -136,5 +135,4 @@ template<typename... Ts> class AGS10SetZeroPointAction : public Action<Ts...>, p
     }
   }
 };
-}  // namespace ags10
-}  // namespace esphome
+}  // namespace esphome::ags10

esphome/components/aht10/aht10.cpp

@@ -17,8 +17,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace aht10 {
+namespace esphome::aht10 {
 
 static const char *const TAG = "aht10";
 static const uint8_t AHT10_INITIALIZE_CMD[] = {0xE1, 0x08, 0x00};
@@ -160,5 +159,4 @@ void AHT10Component::dump_config() {
   LOG_SENSOR("  ", "Humidity", this->humidity_sensor_);
 }
 
-}  // namespace aht10
-}  // namespace esphome
+}  // namespace esphome::aht10

esphome/components/aht10/aht10.h

@@ -6,8 +6,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/i2c/i2c.h"
 
-namespace esphome {
-namespace aht10 {
+namespace esphome::aht10 {
 
 enum AHT10Variant { AHT10, AHT20 };
 
@@ -31,5 +30,4 @@ class AHT10Component : public PollingComponent, public i2c::I2CDevice {
   uint32_t start_time_{};
 };
 
-}  // namespace aht10
-}  // namespace esphome
+}  // namespace esphome::aht10

esphome/components/aic3204/aic3204.cpp

@@ -4,8 +4,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace aic3204 {
+namespace esphome::aic3204 {
 
 static const char *const TAG = "aic3204";
 
@@ -167,5 +166,4 @@ bool AIC3204::write_volume_() {
   return true;
 }
 
-}  // namespace aic3204
-}  // namespace esphome
+}  // namespace esphome::aic3204

esphome/components/aic3204/aic3204.h

@@ -6,8 +6,7 @@
 #include "esphome/core/defines.h"
 #include "esphome/core/hal.h"
 
-namespace esphome {
-namespace aic3204 {
+namespace esphome::aic3204 {
 
 // TLV320AIC3204 Register Addresses
 // Page 0
@@ -83,5 +82,4 @@ class AIC3204 : public audio_dac::AudioDac, public Component, public i2c::I2CDev
   float volume_{0};
 };
 
-}  // namespace aic3204
-}  // namespace esphome
+}  // namespace esphome::aic3204

esphome/components/aic3204/automation.h

@@ -4,8 +4,7 @@
 #include "esphome/core/component.h"
 #include "aic3204.h"
 
-namespace esphome {
-namespace aic3204 {
+namespace esphome::aic3204 {
 
 template<typename... Ts> class SetAutoMuteAction : public Action<Ts...> {
  public:
@@ -19,5 +18,4 @@ template<typename... Ts> class SetAutoMuteAction : public Action<Ts...> {
   AIC3204 *aic3204_;
 };
 
-}  // namespace aic3204
-}  // namespace esphome
+}  // namespace esphome::aic3204

esphome/components/airthings_ble/airthings_listener.cpp

@@ -4,8 +4,7 @@
 
 #ifdef USE_ESP32
 
-namespace esphome {
-namespace airthings_ble {
+namespace esphome::airthings_ble {
 
 static const char *const TAG = "airthings_ble";
 
@@ -29,7 +28,6 @@ bool AirthingsListener::parse_device(const esp32_ble_tracker::ESPBTDevice &devic
   return false;
 }
 
-}  // namespace airthings_ble
-}  // namespace esphome
+}  // namespace esphome::airthings_ble
 
 #endif

esphome/components/airthings_ble/airthings_listener.h

@@ -5,15 +5,13 @@
 #include "esphome/core/component.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 
-namespace esphome {
-namespace airthings_ble {
+namespace esphome::airthings_ble {
 
 class AirthingsListener : public esp32_ble_tracker::ESPBTDeviceListener {
  public:
   bool parse_device(const esp32_ble_tracker::ESPBTDevice &device) override;
 };
 
-}  // namespace airthings_ble
-}  // namespace esphome
+}  // namespace esphome::airthings_ble
 
 #endif

esphome/components/airthings_wave_base/airthings_wave_base.cpp

@@ -6,8 +6,7 @@
 
 #ifdef USE_ESP32
 
-namespace esphome {
-namespace airthings_wave_base {
+namespace esphome::airthings_wave_base {
 
 static const char *const TAG = "airthings_wave_base";
 
@@ -211,7 +210,6 @@ void AirthingsWaveBase::set_response_timeout_() {
   });
 }
 
-}  // namespace airthings_wave_base
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_base
 
 #endif  // USE_ESP32

esphome/components/airthings_wave_base/airthings_wave_base.h

@@ -14,8 +14,7 @@
 #include "esphome/core/component.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace airthings_wave_base {
+namespace esphome::airthings_wave_base {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
@@ -84,7 +83,6 @@ class AirthingsWaveBase : public PollingComponent, public ble_client::BLEClientN
   };
 };
 
-}  // namespace airthings_wave_base
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_base
 
 #endif  // USE_ESP32

esphome/components/airthings_wave_mini/airthings_wave_mini.cpp

@@ -2,8 +2,7 @@
 
 #ifdef USE_ESP32
 
-namespace esphome {
-namespace airthings_wave_mini {
+namespace esphome::airthings_wave_mini {
 
 static const char *const TAG = "airthings_wave_mini";
 
@@ -49,7 +48,6 @@ AirthingsWaveMini::AirthingsWaveMini() {
       espbt::ESPBTUUID::from_raw(ACCESS_CONTROL_POINT_CHARACTERISTIC_UUID);
 }
 
-}  // namespace airthings_wave_mini
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_mini
 
 #endif  // USE_ESP32

esphome/components/airthings_wave_mini/airthings_wave_mini.h

@@ -4,8 +4,7 @@
 
 #include "esphome/components/airthings_wave_base/airthings_wave_base.h"
 
-namespace esphome {
-namespace airthings_wave_mini {
+namespace esphome::airthings_wave_mini {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
@@ -34,7 +33,6 @@ class AirthingsWaveMini : public airthings_wave_base::AirthingsWaveBase {
   };
 };
 
-}  // namespace airthings_wave_mini
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_mini
 
 #endif  // USE_ESP32

esphome/components/airthings_wave_plus/airthings_wave_plus.cpp

@@ -2,8 +2,7 @@
 
 #ifdef USE_ESP32
 
-namespace esphome {
-namespace airthings_wave_plus {
+namespace esphome::airthings_wave_plus {
 
 static const char *const TAG = "airthings_wave_plus";
 
@@ -98,7 +97,6 @@ void AirthingsWavePlus::setup() {
       espbt::ESPBTUUID::from_raw(access_control_point_characteristic_uuid);
 }
 
-}  // namespace airthings_wave_plus
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_plus
 
 #endif  // USE_ESP32

esphome/components/airthings_wave_plus/airthings_wave_plus.h

@@ -4,8 +4,7 @@
 
 #include "esphome/components/airthings_wave_base/airthings_wave_base.h"
 
-namespace esphome {
-namespace airthings_wave_plus {
+namespace esphome::airthings_wave_plus {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
@@ -58,7 +57,6 @@ class AirthingsWavePlus : public airthings_wave_base::AirthingsWaveBase {
   };
 };
 
-}  // namespace airthings_wave_plus
-}  // namespace esphome
+}  // namespace esphome::airthings_wave_plus
 
 #endif  // USE_ESP32

esphome/components/alarm_control_panel/__init__.py

@@ -13,7 +13,11 @@ from esphome.const import (
     CONF_WEB_SERVER,
 )
 from esphome.core import CORE, CoroPriority, coroutine_with_priority
-from esphome.core.entity_helpers import entity_duplicate_validator, setup_entity
+from esphome.core.entity_helpers import (
+    entity_duplicate_validator,
+    queue_entity_register,
+    setup_entity,
+)
 from esphome.cpp_generator import MockObjClass
 
 CODEOWNERS = ["@grahambrown11", "@hwstar"]
@@ -181,7 +185,7 @@ async def setup_alarm_control_panel_core_(var, config):
 async def register_alarm_control_panel(var, config):
     if not CORE.has_id(config[CONF_ID]):
         var = cg.Pvariable(config[CONF_ID], var)
-    cg.add(cg.App.register_alarm_control_panel(var))
+    queue_entity_register("alarm_control_panel", config)
     CORE.register_platform_component("alarm_control_panel", var)
     await setup_alarm_control_panel_core_(var, config)
 

esphome/components/alpha3/alpha3.cpp

@@ -5,8 +5,7 @@
 
 #ifdef USE_ESP32
 
-namespace esphome {
-namespace alpha3 {
+namespace esphome::alpha3 {
 
 static const char *const TAG = "alpha3";
 
@@ -185,7 +184,6 @@ void Alpha3::update() {
     delay(25);  // need to wait between requests
   }
 }
-}  // namespace alpha3
-}  // namespace esphome
+}  // namespace esphome::alpha3
 
 #endif

esphome/components/alpha3/alpha3.h

@@ -9,8 +9,7 @@
 
 #include <esp_gattc_api.h>
 
-namespace esphome {
-namespace alpha3 {
+namespace esphome::alpha3 {
 
 namespace espbt = esphome::esp32_ble_tracker;
 
@@ -64,7 +63,6 @@ class Alpha3 : public esphome::ble_client::BLEClientNode, public PollingComponen
   void send_request_(uint8_t *request, size_t len);
   bool is_current_response_type_(const uint8_t *response_type);
 };
-}  // namespace alpha3
-}  // namespace esphome
+}  // namespace esphome::alpha3
 
 #endif

esphome/components/am2315c/am2315c.cpp

@@ -24,8 +24,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace am2315c {
+namespace esphome::am2315c {
 
 static const char *const TAG = "am2315c";
 
@@ -176,5 +175,4 @@ void AM2315C::dump_config() {
   LOG_SENSOR("  ", "Humidity", this->humidity_sensor_);
 }
 
-}  // namespace am2315c
-}  // namespace esphome
+}  // namespace esphome::am2315c

esphome/components/am2315c/am2315c.h

@@ -25,8 +25,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/core/component.h"
 
-namespace esphome {
-namespace am2315c {
+namespace esphome::am2315c {
 
 class AM2315C : public PollingComponent, public i2c::I2CDevice {
  public:
@@ -45,5 +44,4 @@ class AM2315C : public PollingComponent, public i2c::I2CDevice {
   sensor::Sensor *humidity_sensor_{nullptr};
 };
 
-}  // namespace am2315c
-}  // namespace esphome
+}  // namespace esphome::am2315c

esphome/components/am2320/am2320.cpp

@@ -8,8 +8,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace am2320 {
+namespace esphome::am2320 {
 
 static const char *const TAG = "am2320";
 
@@ -86,5 +85,4 @@ bool AM2320Component::read_data_(uint8_t *data) {
   return true;
 }
 
-}  // namespace am2320
-}  // namespace esphome
+}  // namespace esphome::am2320

esphome/components/am2320/am2320.h

@@ -4,8 +4,7 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/i2c/i2c.h"
 
-namespace esphome {
-namespace am2320 {
+namespace esphome::am2320 {
 
 class AM2320Component : public PollingComponent, public i2c::I2CDevice {
  public:
@@ -24,5 +23,4 @@ class AM2320Component : public PollingComponent, public i2c::I2CDevice {
   sensor::Sensor *humidity_sensor_{nullptr};
 };
 
-}  // namespace am2320
-}  // namespace esphome
+}  // namespace esphome::am2320

esphome/components/am43/am43_base.cpp

@@ -2,8 +2,7 @@
 #include "esphome/core/helpers.h"
 #include <cstring>
 
-namespace esphome {
-namespace am43 {
+namespace esphome::am43 {
 
 const uint8_t START_PACKET[5] = {0x00, 0xff, 0x00, 0x00, 0x9a};
 
@@ -134,5 +133,4 @@ void Am43Decoder::decode(const uint8_t *data, uint16_t length) {
   }
 };
 
-}  // namespace am43
-}  // namespace esphome
+}  // namespace esphome::am43

esphome/components/am43/am43_base.h

@@ -3,8 +3,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome {
-namespace am43 {
+namespace esphome::am43 {
 
 static const uint16_t AM43_SERVICE_UUID = 0xFE50;
 static const uint16_t AM43_CHARACTERISTIC_UUID = 0xFE51;
@@ -74,5 +73,4 @@ class Am43Decoder {
   bool has_pin_response_;
 };
 
-}  // namespace am43
-}  // namespace esphome
+}  // namespace esphome::am43