Merge branch 'dev' into socket-client-mode

.agents/skills/code-review/SKILL.md

@@ -1,116 +0,0 @@
----
-name: code-review
-description: Review guidance for ESPHome pull requests. Use this when reviewing a pull request that changes ESPHome Python, C++, or component code, to check it against the project's coding conventions, embedded-systems memory rules, testing requirements, and breaking-change policy.
----
-
-# Reviewing ESPHome pull requests
-
-ESPHome parses YAML into C++ firmware for memory-constrained microcontrollers
-(ESP32, ESP8266, RP2040, LibreTiny). Review changes with that in mind: RAM and
-flash are scarce, and code runs unattended for months.
-
-`AGENTS.md` in the repository root is the full contributor guide and the
-authority when it disagrees with this summary. The developer documentation at
-https://developers.esphome.io explains the component lifecycle and the reasoning
-behind these rules. This skill lists the concrete things worth flagging in a
-review; read `AGENTS.md` for the detail behind any item.
-
-Only raise findings that the diff actually introduces or changes. Do not ask for
-drive-by cleanup of pre-existing code the PR did not touch.
-
-## Memory and embedded constraints (highest value)
-
-Heap allocation after `setup()` is treated as a reliability bug, not a
-performance nit, because it fragments a small shared heap. Flag:
-
-- New heap allocation on a hot path or after setup that could be avoided.
-- `std::vector` where the size is known at compile time (use `std::array`, or
-  `StaticVector<T, N>` when a `push_back` API is needed) or fixed at runtime
-  init (use `FixedVector<T>`).
-- Listener / child-entity registration lists stored as `std::vector`; these have
-  a compile-time-known count and should use `cg.slot_counter()` plus
-  `StaticVector`.
-- `std::vector<uint8_t>` for a byte buffer that never grows: prefer
-  `std::unique_ptr<uint8_t[]>` or `std::array`.
-- `std::map` / `std::set` / `std::unordered_map` for small datasets (1-16
-  elements): a `std::vector` of a small struct with linear search is lighter.
-- `std::deque` anywhere: it allocates 512-byte blocks and should be avoided.
-- `std::string` storing a value set once from config: prefer `StringRef` (the
-  literal already lives in flash).
-- `std::string` / `std::to_string` / string-returning helpers on hot paths where
-  a buffer or view API exists.
-
-## C++ conventions
-
-- Include what you use: a file referencing a symbol must include the header that
-  declares it, even if it currently arrives transitively. New or changed uses of
-  a symbol need the matching include.
-- Prefix all member access with `this->`.
-- Naming: `lower_snake_case` for functions/methods/variables, `UpperCamelCase`
-  for classes/structs/enums, `UPPER_SNAKE_CASE` for namespace-scope constants,
-  trailing underscore on protected/private fields.
-- `enum class` values must be prefixed with the enum name in `UPPER_SNAKE_CASE`
-  (e.g. `UARTFlushResult::UART_FLUSH_RESULT_SUCCESS`). Bare names like `SUCCESS`,
-  `FAIL`, or `OK` collide with SDK macros on some platforms and break the build.
-- Prefer `const`/`enum` over `#define`; `#define` is only for conditional
-  compilation and code-generation sizes.
-- Never call `millis()` in a `loop()` body; use
-  `App.get_loop_component_start_time()`. A rate-limit gate below ~16 ms (the loop
-  period) does nothing.
-- Pick the timing primitive by cadence: gated `loop()` under 250 ms,
-  `set_interval` at 500 ms and above.
-- Do not override a base method to return the value it already returns (e.g.
-  `get_setup_priority()` returning `setup_priority::DATA`).
-- Wrap string literals passed as printf `%s` args in `LOG_STR_LITERAL()`.
-- Required, invariant dependencies should be constructor parameters, not setters.
-- Callback registration methods must be templated (`template<typename F>`), not
-  typed as `std::function`, so lightweight forwarders avoid a heap allocation.
-- Two-space indent, `using` over `typedef`, wrap at 120 columns.
-
-## Python conventions
-
-- Type-annotate every new function signature (params and return), new dataclass
-  fields, and new module-level variables. Import `ConfigType` from
-  `esphome.types`.
-- Use the walrus operator to avoid a double lookup, e.g.
-  `if (blah := config.get(CONF_BLAH)) is not None:`.
-- Reuse existing validators from `config_validation.py` (`cv.rename_key`,
-  `cv.has_exactly_one_key`, etc.) via `cv.All(...)` instead of hand-rolling.
-- `esphome/const.py` is frozen: no new `CONF_` constants there. Define them in
-  the component's own `.py`, or in `esphome/components/const/__init__.py` when
-  shared. The same constant defined in three or more component files fails CI.
-- State that must persist during code generation goes in `CORE.data` namespaced
-  under the component `DOMAIN` (a `@dataclass`), not module-level mutable globals.
-- Prefer callback-based triggers via `build_callback_automation()`; only use a
-  `Trigger<Ts...>` subclass when the forwarder needs mutable state.
-
-## Testing and coverage
-
-- New and changed lines and branches need test coverage, including defensive
-  early-returns, error paths, and no-op guards. A mocked-out function is not
-  covered; exercise the real call path too.
-- Component YAML tests live in `tests/components/<component>/`. Never define
-  buses (uart, i2c, spi, modbus) directly in a test file: pull them from
-  `tests/test_build_components/common/` through dict-style `packages:` so CI can
-  group builds. List-style packages or top-level merge keys block grouping.
-- Config-only checks use the `validate.*.yaml` prefix; compiled checks use
-  `test.*.yaml`.
-
-## Breaking changes and public API
-
-- Base classes under `esphome/core/` and documented config options are public
-  API. Undocumented `public` members of a component are internal.
-- A breaking change needs justification, a migration path in the PR description,
-  and a deprecation window where feasible (`ESPDEPRECATED` in C++,
-  `cv.rename_key(..., removed_in=...)` in Python). Changing a codegen-injected
-  lambda signature is not a breaking change.
-
-## Process and PR hygiene
-
-- PR titles start with a `[tag]` prefix: the component name (e.g. `[uart] ...`)
-  or `[core]` for shared code.
-- Prose in docs, comments, and commit messages should be plain English. Keep
-  inline comments short and only where the code is not self-explanatory; do not
-  restate what the code says.
-- Verify the PR fills out `.github/PULL_REQUEST_TEMPLATE.md` and adds
-  `CODEOWNERS` entries for a new component.

.agents/skills/hardware-test/SKILL.md

@@ -1,123 +0,0 @@
----
-name: hardware-test
-description: Test an ESPHome change on real boards over USB. Use this whenever a task asks to test, verify, reproduce, bench, A/B or soak a pull request, a branch or a crash on hardware, or mentions flashing, serial logs, esphome upload, a captive portal or fallback AP test, or results to post on a PR. Covers finding the serial ports, building from the right checkout, flashing each chip family (including the LibreTiny kits that stock tools cannot flash), bounded log capture, proven test flows and how to report results.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep
----
-
-# Hardware testing
-
-The goal of a hardware test is evidence a reviewer can trust: which build ran on which board, what was
-driven, what the logs show, and the same flow on a `dev` build when a quirk could be pre-existing.
-`$SKILL` below is this directory (`.agents/skills/hardware-test`).
-
-## Ground rules
-
-1. **Serial ports cannot be shared.** One bounded capture per port, stopped before any flash on that
-   port, never an open-ended `esphome logs`. Stop a capture with `pkill -f "[s]erial_capture.py <port> "`,
-   naming the port so a capture on another board survives; the bracket keeps the pattern from matching
-   the shell that runs it. Never run `esphome logs` in a
-   `while true` loop: the loop respawns it and holds the port.
-2. **Credentials stay local.** Put a `secrets.yaml` next to the scratch configs and reference it with
-   `!secret`. Never paste a config with credentials into a PR, never commit scratch configs or logs.
-3. **Build from the tree under test.** `python -m esphome` puts the current directory first on
-   `sys.path`, so run it with the checkout or worktree as the working directory and pass the yaml by
-   its absolute path. A venv `esphome` entry point may import an installed snapshot instead of the
-   checkout. Confirm with `python -c 'import esphome; print(esphome.__file__)'`, and for an A/B grep
-   the build's `src/` for the change before trusting any number.
-4. **PR build and baseline build get different `name:` values.** Builds share
-   `.esphome/build/<name>`, so the same name means `esphome upload` can flash the wrong binary. Saved
-   Wi-Fi credentials are keyed by the name too, so a test that must start unprovisioned gets a fresh
-   name every run.
-5. **Flash and RAM deltas are measured against the PR's merge base** (`git merge-base origin/dev HEAD`
-   checked out in a throwaway worktree), with the baseline commit named in the table. When a delta
-   looks odd, diff symbol sizes (`nm -S -C --size-sort` from the matching toolchain) before quoting it.
-6. **Prove a quirk is pre-existing before blaming the PR:** run the identical flow on a `dev` build in
-   the same session and say so in the results.
-7. **Pipe safely.** Set `PYTHONUNBUFFERED=1` on any `esphome run` or `esphome logs` whose output is
-   piped, or lines land minutes late. Bound every long command with `timeout` (coreutils) or
-   `perl -e 'alarm shift; exec @ARGV' <seconds> <command>` on macOS without it.
-
-## Workflow
-
-1. **Find the boards:** `python $SKILL/scripts/ports.py` (any Python with pyserial, for example the
-   ESPHome venv). Port names follow the USB hub port and change on every replug, so never reuse a name
-   from an earlier session. CH340 adapters (D1 mini, BW15 kit, BK7238, CB3S) all look the same; tell
-   them apart with a 10 s capture using `serial_capture.py --reset` (ESP8266 prints its ROM banner at
-   74880 baud, LibreTiny boards print `[LT]` and ESPHome lines, BK7238 prints its bootloader version).
-   `ports.py --wait 2e8a` blocks until a Pico re-enumerates.
-2. **Make a scratch directory** outside the checkout, with `secrets.yaml` and the templates you need.
-   One yaml per board per variant, file name equal to `name:`.
-3. **Compile** in the right tree:
-   `(cd <worktree> && PYTHONUNBUFFERED=1 timeout 1500 python -m esphome compile <abs yaml> > <name>-compile.log 2>&1)`.
-   Keep the RAM and flash lines at the end. Two ESP-IDF or two LibreTiny builds at the same time race
-   over tool caches; run them one at a time.
-4. **Flash** per chip family (table below). Stop the capture on that port first.
-5. **Capture** with `serial_capture.py PORT SECONDS OUT` in the background, then poll the file with
-   `grep` in an `until ... sleep 2` loop with a cap. USB CDC boards (Pico, nRF52, native USB ESP32)
-   drop the port on reboot; the script reopens it until its deadline.
-6. **Drive** the test: a second board running a client config, `curl`, an aioesphomeapi script that
-   presses a template button and subscribes to logs, MQTT publishes, or `interval:` and `on_boot:`
-   automations in the config itself.
-7. **Analyze** with `grep -a -c` counts over the capture and keep an `-events.txt` extract of the lines
-   that matter. Decode crashes with the platform's `addr2line` (see `reference/boards.md`).
-8. **Report** on the PR as a table: build SHA, board and framework, what was driven, counts, result,
-   plus the `dev` control row and the exact flow in a `<details>` block. No credentials, no port names,
-   no IP addresses.
-
-## Flashing by chip family
-
-| Board | Flash | Log |
-|---|---|---|
-| ESP8266 D1 mini (CH340) | `python -m esphome upload <yaml> --device <port>` | `serial_capture.py` at 115200; `esphome logs` on some CH340s emits garbage after the RTS reset. A failed esptool write can wedge the adapter until the board is replugged. `esptool erase_flash` before a test that needs an unprovisioned device: the preference sector survives a reflash |
-| ESP32 devkit (CP2102 or CH340) | `esphome upload --device <port>`, ESP-IDF or Arduino | `serial_capture.py`. Default Wi-Fi light sleep delays API driven actions by seconds; judge timing from device logs. `power_save_mode: none` for OTA overlap tests |
-| ESP32-S3, C3, C6, H2 native USB | `esphome upload --device /dev/cu.usbmodem*` | `logger: hardware_uart: USB_SERIAL_JTAG`. The USB console can wedge when the app takes over the console (0 bytes, esptool `No serial data received`); replug, or watch through `esphome logs --device <name>.local` |
-| Pico W / Pico 2 W | `esphome upload --device <port>` (1200 baud touch); first flash ever via BOOTSEL and `--device /Volumes/RPI-RP2` or `RP2350` | port re-enumerates after upload: `ports.py --wait 2e8a` then capture |
-| BW15 kit (RTL8720CF, rtl87xx) | `~/.platformio/penv/.libretiny/bin/python $SKILL/scripts/flash_rtl87xx_kit.py flash write -d <port> <build>/.pioenvs/<name>/*.uf2`. Plain `esphome upload` and plain ltchiptool time out because opening the port asserts DTR/RTS and holds the chip in reset | `serial_capture.py --released`, never `esphome logs` |
-| BK7238 / CB3S (bk72xx, RTS on CEN) | `~/.platformio/penv/.libretiny/bin/python $SKILL/scripts/flash_bk72xx.py flash write -d <port> <uf2>` (about 75 s) | logs are on UART2 by default; `logger: hardware_uart: UART1` puts them on the flashing adapter. Opening the port resets the chip, so keep one capture open for the whole test |
-| LN882H | ltchiptool forces 1 Mbaud for writes; weak adapters need `LN882H_YM_BAUDRATE` patched to 115200 in the penv's `ln882htool.py`; short BOOT to GND while the tool connects | OTA after the first flash |
-| nRF52840 Dongle (PCA10059) | Nordic `nrfutil nrf5sdk-tools dfu usb-serial` on the bootloader port, or `dfu: true` in the config so the 1200 baud touch pin-resets into the bootloader; adafruit-nrfutil is refused | app has two CDC ports, ESPHome log on the second |
-| Adafruit-style nRF52 (UF2 bootloader) | `UF2BOOT` volume or adafruit-nrfutil; `dfu: true` works through GPREGRET | single CDC port |
-| Any reachable device | `esphome upload <yaml> --device <ip or name.local>`; `--file <bin>` for a prebuilt image | `esphome logs --device <ip>` bounded with `timeout` |
-
-ESP-IDF OTA image: `.esphome/build/<name>/build/firmware.ota.bin`. LibreTiny OTA port is 8892.
-
-## Scripts in `$SKILL/scripts`
-
-- `ports.py`: list ports with VID:PID, product, serial and a board guess; `--wait VID[:PID]`,
-  `--product NAME`, `--serial SN` (one specific board, whatever path it comes back under) and
-  `--serial-of PORT` (the serial number behind a path).
-- `serial_capture.py PORT SECONDS OUT [--baud] [--released] [--reset] [--append]`: bounded timestamped
-  capture, ANSI stripped, `LOG_SECRET` text written as `<secret>`, reopens a vanished port, exits at the
-  deadline. OUT is truncated unless `--append` is given, so counts over it cover one run.
-- `flash_rtl87xx_kit.py`: ltchiptool wrapper for the BW15 kit whose CH340 drives CEN (RTS) and the boot
-  strap (DTR). `flash read` needs the family `realtek-ambz2`; `flash write` does not.
-- `flash_bk72xx.py`: ltchiptool wrapper for BK72xx boards whose RTS drives CEN.
-- `wifisave_hammer.sh KIND DUT_PORT DUT_YAML DUT_TREE CLIENT_PORT CLIENT_YAML CLIENT_TREE [SETTLE]`:
-  the fallback AP plus captive portal hammer end to end (compile, flash, capture, counts) with the
-  templates below. KIND is `esp`, `pico`, `bw15` or `bk`. It ends with `RESULT PASS` (exit 0),
-  `RESULT FAIL` (exit 3: a crash, a reboot after the AP came up, or the device never joined the network),
-  `RESULT INVALID`
-  (exit 2: a precondition was missed, the stimulus was insufficient, or a capture did not last the run)
-  or exits 1 when a build, flash or port step failed.
-
-## Templates in `$SKILL/templates`
-
-- `dut-fallback-ap.yaml` (package): a device that never finds its network, falls back to its AP and
-  serves the captive portal. `example-dut.yaml` is the per-run file with the platform block.
-- `client-wifisave.yaml` (package): joins that AP, posts N bogus `/wifisave` requests, then the real
-  credentials from `!secret`. `example-client.yaml` is the per-run file. `bogus_saves: "1"` gives a
-  plain provisioning check.
-
-## When something looks wrong
-
-- A capture stopped early or a line is missing: check the timestamps before trusting it.
-- The client never joins the AP: another board may still run an AP with the same SSID, or the device
-  booted with saved credentials because the name was reused. One AP device at a time on the bench.
-- Builds come out byte-identical between branches: the wrong tree was imported (rule 3).
-- Multicast from the host never arrives on some access points: test it device to device. Broadcast
-  is lossy under Wi-Fi power save, unicast is not. Throttle UDP floods to a fixed packet rate.
-- `api:` reboots a board after 15 min without a client: `reboot_timeout: 0s` on `api:` and `mqtt:` for
-  soak tests.
-
-`reference/boards.md` has per-chip facts and crash decoding; `reference/recipes.md` has the proven
-flows. Add new findings there.

.agents/skills/hardware-test/reference/boards.md

@@ -1,138 +0,0 @@
-# Board facts
-
-Ports are not listed on purpose: they follow the USB hub port and change on every replug. Run
-`scripts/ports.py`.
-
-## ESP8266 (D1 mini, NodeMCU, CH340 or CP2102)
-
-- Opening the port usually resets the board through DTR, but not always; `serial_capture.py --reset`
-  pulses RTS to capture from boot. 74880 baud shows the ROM boot messages (`rst cause`, `boot mode`).
-- `esphome logs` on some CH340s emits thousands of duplicated garbage lines right after the RTS reset;
-  a plain pyserial capture at 115200 is reliable.
-- A failed esptool write can wedge the adapter (`termios` error 22, or an open that hangs) until replug.
-- The preference sector survives a reflash: a provisioned API key or saved Wi-Fi credentials stay
-  active. `esptool erase_flash` gives a clean device.
-- `Panic core_esp8266_main.cpp:191 __yield` with `ctx: sys` means a yield from lwIP context (a web
-  handler, an lwIP callback). Decode stacks with
-  `xtensa-lx106-elf-addr2line -e <build>/.pioenvs/<name>/firmware.elf -f -C -i <addr...>` from the
-  toolchain under `~/.platformio/packages/toolchain-xtensa/bin/` (PlatformIO builds) or the ESPHome
-  cache directory (native toolchain builds).
-- Constant data lives in RAM unless marked `PROGMEM`; with 80 KB of RAM a few hundred bytes are worth a
-  row in the PR.
-- AsyncMqttClient drops inbound topics over 128 characters; topics of 255 or more wrap a counter and
-  stall the link until the broker drops TCP.
-
-## ESP32 classic devkit
-
-- Takes ESP-IDF and Arduino. Default Wi-Fi light sleep delays API driven actions by up to 6 s; judge
-  timings from device logs, not from the host. `power_save_mode: none` for OTA overlap tests (an IDF web
-  upload of 739 KB took 107 s with power save and 45 s without).
-- Receives only a few percent of IPv6 multicast on some access points with power save on; a raw lwIP
-  socket loses the same, so that is the AP or driver, not a PR.
-- Decode with `xtensa-esp32-elf-addr2line` from the IDF tools directory against
-  `<build>/.pioenvs/<name>/firmware.elf` (PlatformIO) or `<build>/build/<name>.elf` (IDF native).
-- Clean reboot between runs with the capture stopped: `esptool --after hard_reset chip_id`.
-- Trigger a forced crash only after the app is marked valid (45 s after boot is plenty), never on an
-  image still pending OTA rollback.
-- Signed OTA testing: build with `esp32.framework.advanced.signed_ota_verification.verification_keys`
-  under a different name, sign with `python -m espsecure sign_data --version 2 --keyfile
-  tests/components/esp32/dummy_signing_key.pem`, upload with `esphome upload --file`. The verifier
-  refuses unsigned images afterwards, so restore with a signed plain build.
-
-## ESP32-S3, C3, C6, H2 with native USB
-
-- `/dev/cu.usbmodem*`, esptool works, `logger: hardware_uart: USB_SERIAL_JTAG`.
-- The USB console can die at the moment the app takes over the console during a reboot (log stops after
-  `Disabling RNG early entropy source`, then 0 bytes, esptool reports `No serial data received`). Only a
-  USB replug fixes it. Fallback: `esphome logs --device <name>.local` (API log stream, which drops lines
-  while Wi-Fi is off).
-- The ESP32-P4 before silicon revision 3 is bricked by rev3-only firmware (boot loop at bootloader entry).
-
-## RP2040 / RP2350 (Pico W, Pico 2 W)
-
-- The CDC port re-enumerates after every reboot and after `esphome upload` (1200 baud touch). Re-detect
-  with `ports.py --wait 2e8a` before capturing; `serial_capture.py` reopens on its own if the port
-  vanishes mid-capture.
-- First flash ever: BOOTSEL, then `esphome upload --device /Volumes/RPI-RP2` (or `RP2350`).
-- arduino-pico creates the lwIP netif in `WiFi.begin()`, so any IGMP join during component setup fails;
-  joins must wait for `network::is_connected()`.
-- Parallel Pico builds race on package extraction after a PlatformIO package wipe; one at a time.
-- An RTS pulse from pyserial does not reset the board; reboot with `App.safe_reboot()` or the touch.
-
-## BW15 kit (RTL8720CF, LibreTiny rtl87xx)
-
-- The kit's CH340 wires RTS to CEN and DTR to PA00 (boot strap). A plain pyserial open asserts both and
-  holds the chip in reset, which is why `esphome upload`, plain `ltchiptool` and `esphome logs` all fail
-  ("Timeout while linking", or silence). `scripts/flash_rtl87xx_kit.py` sets DTR high and RTS released
-  on every open, pulses RTS once so the ROM answers `ping`, and after the command drops DTR and pulses
-  RTS to boot the app. Run it with the PlatformIO LibreTiny penv Python.
-- `flash write -d <port> <uf2>` takes no family argument; `flash read -d <port> -s 0 -l <len>
-  realtek-ambz2 <out>` does.
-- Capture with `serial_capture.py --released`. The ESPHome log is on the flashing UART already.
-- The macOS CH340 driver only pushes DTR/RTS to the wire once a session has driven them, so the first
-  plain open after a replug streams logs and the second is silent; always open with the lines released.
-- Driver quirks seen on `dev`: `WiFi.begin` can refuse the real network on the first try after bogus
-  credentials (it connects after two cooldowns); right after connecting while the AP is still up the
-  driver can bus-fault in `rtw_is_adapter_up` (`R0 = 0xdeadbeef`) and reboot; the AP restarts on every
-  STA retry, so stations cannot stay joined; `WiFi.begin` fails synchronously for an absent network and
-  lands in a cooldown at once; connecting blocks the loop 2.5 to 4.1 s.
-- Decode faults with `arm-none-eabi-addr2line -e <build>/.pioenvs/<name>/raw_firmware.elf -f -C -i <PC>`
-  from `~/.platformio/packages/toolchain-gccarmnoneeabi/bin/` (`raw_firmware.elf`, not `firmware.elf`).
-  Fault dumps print PC, LR and R0 to R3.
-- The AmebaZ2 SDK sets `LWIP_TCPIP_CORE_LOCKING 0`.
-
-## BK7238, WB3S, CB3S (BK7231N) (LibreTiny bk72xx, CH340, RTS on CEN)
-
-- Stock ltchiptool closes and reopens the port after its reset, and pyserial raises both lines on open,
-  holding CEN low through the BootROM window. `scripts/flash_bk72xx.py` opens with both released and
-  pulses the reset right before the link checks. A write takes about 75 s. Only a CEN or power reset
-  reaches the downloader; no software reboot does.
-- ESPHome logs on UART2 by default; `logger: hardware_uart: UART1` puts them on the flashing adapter.
-- Opening the port resets the chip (bootloader banner on every open, even with DTR/RTS low), so keep one
-  capture open for the whole test and never reopen mid-phase.
-- Callbacks run on the `async_tcp` task and log lines can lose a byte. Wi-Fi connect takes tens of ms;
-  radio enable 160 to 278 ms, disable about 200 ms.
-
-## BW16 kit (RTL8720DN, AmebaD)
-
-- The kit's own USB-C (CH340) is on LOG_UART and flashes fine. Its two-transistor circuit resets while
-  RTS alone is asserted and straps BURN while DTR alone is; both asserted does nothing. ROM entry is
-  esptool's classic sequence (`dtr:false,rts:true` 100 ms, `dtr:true,rts:false` 400 ms, both false); the
-  first pulse after a replug can be lost, retry up to three times.
-- Any reopen resets the chip, 460800 is flaky, 115200 is solid: one open per session, in-place baud
-  changes only. The ROM and the loader NAK continuously while idle, so ACK scans must drain first.
-- The AmebaD core has no mDNS responder (`mdns: disabled: true`).
-
-## LN882H
-
-- ltchiptool forces 1 Mbaud for writes; adapters that cannot hold it fail with "Timeout while linking"
-  or die mid-write. Patch `LN882H_YM_BAUDRATE` in the penv's `ltchiptool/soc/ln882h/util/ln882htool.py`
-  to 115200 (lost on reprovision). Weak 3.3 V from the adapter: feed the module's 5 V pad instead. Short
-  BOOT to GND while the tool connects. OTA afterwards.
-- `USE_WIFI_AP_EXCLUSIVE` (one radio mode at a time) exists only on LN882x; compile-check changes there.
-
-## nRF52840
-
-- Nordic PCA10059 dongle: the factory Open DFU bootloader enumerates as `1915:521F` on its own port
-  name; the app as `2FE3:0100` with two CDC ports, ESPHome log on the second. Only Nordic
-  `nrfutil nrf5sdk-tools` works (`pkg generate --hw-version 52 --sd-req 0x00 --application-version 1
-  --application zephyr.hex app.zip`, then `dfu usb-serial -pkg app.zip -p <port>`); ESPHome downloads
-  it on the first build. GPREGRET does not enter the bootloader; a pin reset through P0.19 does, which
-  `dfu: true` wires up on this board. A pulsing red LED means bootloader; the side RESET button
-  re-enters it.
-- Makerdiary MDK USB dongle: UF2 bootloader without SoftDevice, app at 0x1000, `UF2BOOT` volume,
-  adafruit-nrfutil, GPREGRET 0x57 works. RGB LED active low (red P0.23, green P0.22, blue P0.24),
-  button P0.18.
-
-## ESP Thread Border Router board v1.2 (S3 host + H2 RCP)
-
-- S3 host on USB JTAG serial, H2 RCP on its own USB. Spinel UART1 from the host: `rx_pin: GPIO17`,
-  `tx_pin: GPIO18`, RCP reset `GPIO7` active low, 460800. The config needs `network: enable_ipv6: true`.
-- The shipped H2 firmware fails `CheckRadioCapabilities` with IDF 5.5; build `examples/openthread/ot_rcp`
-  for esp32h2 with ESPHome's own IDF (`IDF_PATH` at the cached framework, its penv and tools,
-  `IDF_PYTHON_CHECK_CONSTRAINTS=no`) and flash with esptool at 0x0, 0x8000 and 0x10000.
-- A crash-looping S3 pulses the H2 reset every boot, so the H2 cannot be flashed and the S3 will not
-  enter its bootloader over USB. Hold S3 BOOT, tap S3 RST, flash the H2, release, then replug both.
-- `dns-sd -L <name> _meshcop._udp local.` shows the `omr` prefix; it disappears when routing is dead.
-  Keep one capture per chip; never reset the H2 over USB mid-test unless that is the test (the host
-  logs `Unexpected RCP reset: RESET_OTHER` and recovers).

.agents/skills/hardware-test/reference/recipes.md

@@ -1,117 +0,0 @@
-# Proven test flows
-
-Each flow names the pull requests it was used on, so their result tables show what to post.
-
-## Captive portal `/wifisave` hammer (#20802, #20784)
-
-Reproduces a `/wifisave` arriving during the STA cooldown, and proves a fix on every board.
-Device under test: `templates/example-dut.yaml` (bogus network, `ap:` with `ap_timeout: 15s`,
-`captive_portal:`). Client: `templates/example-client.yaml` on an ESP32 or a D1 mini; it joins the
-device's AP, posts 15 bogus saves 3 s apart, then the real credentials. With the portal up the cooldown
-is 30 s, so nearly every save lands inside one. Driver: `scripts/wifisave_hammer.sh`. Settle 40 s on
-ESP boards, 90 s on the BW15 (its first attempt on the real network fails, see boards.md).
-
-Counts that matter: `Requested WiFi Settings Change` (saves received), `Exiting cooldown early`, crash
-markers, boots (`Log initialized`), and the client's `bogus save status 200` and `real save status 200`.
-A healthy run: every save answered 200, one cooldown exit per save (two on the BW15, whose retry enters
-the adapter restart), no panic, and the real credentials connect the device within about 10 s.
-
-Fault injection for AP start failures: wrap `this->ap_setup_ = this->wifi_start_ap_(this->ap_)` in
-`setup_ap_config_()` with an `HWTEST_AP_FAIL_COUNT` build flag
-(`esphome: platformio_options: build_flags: -DHWTEST_AP_FAIL_COUNT=2`), raise the portal's "Captive
-portal started" from LOGV to LOGI, and after provisioning curl the device's STA address: connection
-refused proves the portal's server is gone.
-
-## `reboot_timeout` with a fallback AP (#9958)
-
-Only one board runs the AP at a time, or stations join the wrong one. AP probe: bogus network,
-`ap: {ssid, password, ap_timeout: 5s}`, `reboot_timeout: 60s`, `logger: level: VERBOSE` (ESP32 and
-ESP8266 log `AP client connected MAC=` at verbose), `on_boot: logger.log: BOOT`. Station probes:
-`reboot_timeout: 0s`, `interval: 150s` running `wifi.disable`, `delay: 20s`, `wifi.enable` (60 s cycles
-are too short to cover the due moment). Pass pattern: "Can't connect; rebooting" exactly 60 s after boot
-with no station joined, no reboot for minutes while one is, then a reboot within a second of the last
-disconnect. The BW15 restarts its AP on every STA retry and cannot be tested this way.
-
-## MQTT (#20433, #17935, #20762, #20767, #20768)
-
-A local mosquitto with `allow_anonymous true`, `log_type all` and `log_dest file`: the broker log gives
-each subscription's QoS, the device address (`New client connected from <ip> as <name>-<mac>`) and exact
-subscribe counts. Kill and restart mosquitto to exercise `on_disconnect` (reason 0) and resubscription.
-Keep `reboot_timeout: 0s` on `api:` and `mqtt:`. The ESP-IDF outbox swings free heap about 2 kB right
-after bulk subscribe and unsubscribe; read the heap seconds later over several rounds before calling a
-leak. Spawned subscriptions need about 2.5 s to reach the broker before the next publish.
-`esphome logs --device MQTT` only uses the MQTT transport when the config has no `api:`. Driver pattern: a
-paho script publishes and polls the serial capture file.
-
-## UDP, multicast, sockets (#20556 to #20559, #20585, #20590)
-
-A listener on port 9 needs no privileges on macOS. Test multicast device to device; host to device
-multicast never arrives on some access points, and `239.255.x.x` groups are unreliable even to a stock
-listener. Broadcast to boards is lossy under power save, unicast is not. Flood at a fixed packet rate
-(the host hits `ENOBUFS` unthrottled); 1500 packets per second survived on every board. A forced Wi-Fi
-reconnect on the Pico keeps IGMP membership. Set a long loop interval from `wifi.on_connect`
-(`App.set_loop_interval(20000)`), not `on_boot`, or Wi-Fi connect crawls. The `logger.log` action
-rejects `%.*s`; use a lambda.
-
-## OTA overlap and lock (#20588), OTA timeouts (#19041), deflate (#19037)
-
-All overlap orders (a web upload during a native OTA and the reverse) must be refused; the lock release
-after an interrupted web upload waits about 14 s (ESP8266) or 7 s (ESP-IDF) for disconnect detection. A
-refused web client on `web_server_idf` never gets the busy reply; the connection drops at reboot.
-`pkill -f "a\|b"` does not alternate; use two pkills.
-
-## DHCP lease cache (#17767)
-
-Cycle 20 s awake, `deep_sleep.enter 30s`, wake, 20 s, `App.safe_reboot()`, logging `millis()` at the
-`wifi.connected` condition. An RTS hardware reset must fall back to DHCP; a software reboot and a deep
-sleep wake must apply the cache. `esphome run --no-logs` silently skipped the upload on one board; use
-`upload` then `logs`.
-
-## HDMI-CEC two-board wire (#9189)
-
-Two boards on one wire: promiscuous mode, a 0x8F request answered with 0x90 0x00, a `destination:`
-filter on the reply handler, template buttons for each target plus lambdas calling
-`send(source, dest, span)` as another initiator. Healthy numbers: device-side turnaround 15 to 22 ms,
-round trip 144 to 156 ms. Press buttons over the API; judge timings from device logs (ESP32 light sleep
-lags the press).
-
-## LD2450 polygon zones (#20154)
-
-To make a target "leave" without anyone moving, set the radar's Zone-1 numbers over the target and
-switch the zone type to `Filter` (the count drops to 0 within 0.5 s); set it back to `Disabled` after.
-Writing those numbers blocks the ld2450 loop about 50 ms.
-
-## Scheduler and loop wake A/B (#20356)
-
-An external component whose template button arms an SDK `os_timer` (50 ms, one shot) on the ESP8266;
-the callback runs in SYS context, records `millis()` and calls `set_timeout` or `defer`; the timeout
-logs the elapsed time and loop count delta. Drive with an aioesphomeapi script (`subscribe_logs` plus
-`button_command`). Build the same yaml twice with different names, one per tree.
-
-## Noise handshake and OTA encryption on the ESP8266 (#19062, #19233)
-
-Host side timing is useless on a weak link; use an on-device bench with the minimum of five runs over
-two boots. Provision a key with `noise_encryption_set_key` through aioesphomeapi and upload with
-`espota2.run_ota(host, 8266, None, bin, noise_psk=key)` when the key is not in the yaml.
-
-## ESP-NOW on the ESP8266 (#14407)
-
-The NONOS SDK only delivers broadcast ESP-NOW frames while the station is associated or a soft-AP is
-up; a hidden, open, client-less soft-AP (60 s beacon, DHCP stopped) makes broadcasts arrive. In AP-only
-mode the device transmits from the soft-AP MAC.
-
-## Wi-Fi Easy Connect (DPP) enrollee (#17934)
-
-Only an Android phone configures: Settings, network details, Add device, Share Wi-Fi (the Wi-Fi list's
-QR scanner makes the phone an enrollee). Render the URI with the `qrcode` module and open the PNG.
-`esp32: framework: log_level: DEBUG` plus `sdkconfig_options: CONFIG_WPA_DEBUG_PRINT: y` prints the
-supplicant state machine.
-
-## Thread border router (#18104)
-
-See boards.md for the ESP Thread BR board. Check that the H2 answers Spinel before blaming a PR.
-
-## nRF52840 dongle boards (#19009, #20814)
-
-Test config: the two LEDs as inverted GPIO outputs, the button as an inverted pull-up binary sensor, a
-10 s alive interval. To retest the nrfutil download path, move the cached `sdk-nrf/nrfutil` aside first.

.agents/skills/hardware-test/scripts/flash_bk72xx.py

@@ -1,51 +0,0 @@
-"""ltchiptool for boards whose RTS drives CEN: reset and link on one open port.
-
-Stock ltchiptool closes and reopens the port after its DTR/RTS reset, and
-pyserial raises both lines on open, holding CEN low through the BootROM's
-listen window. Open with both lines released and pulse the reset right
-before the LinkChecks instead.
-"""
-
-import sys
-
-import bk7231tools.serial.main as bk_main
-from ltchiptool.__main__ import cli
-from ltchiptool.soc.bk72xx.flash import BK72XXFlash
-from serial import Serial
-
-
-class ReleasedSerial(Serial):
-    def __init__(self, port=None, **kwargs):
-        super().__init__(None, **kwargs)
-        self.dtr = False
-        self.rts = False
-        self.port = port
-        self.open()
-
-
-bk_main.Serial = ReleasedSerial
-
-_connect = BK72XXFlash.flash_connect
-
-
-def flash_hw_reset(self) -> None:
-    self._reset_pending = True
-
-
-def flash_connect(self) -> None:
-    pending = getattr(self, "_reset_pending", False)
-    if self.bk and self.conn.linked and not pending:
-        return
-    self.flash_build_protocol()
-    if pending:
-        self._reset_pending = False
-        self.bk.hw_reset()
-        self.conn.linked = False  # the chip rebooted, so link again below
-    _connect(self)
-
-
-BK72XXFlash.flash_hw_reset = flash_hw_reset
-BK72XXFlash.flash_connect = flash_connect
-
-sys.argv = ["ltchiptool", *sys.argv[1:]]
-cli()

.agents/skills/hardware-test/scripts/flash_rtl87xx_kit.py

@@ -1,87 +0,0 @@
-"""ltchiptool for the BW15 kit whose CH340 drives CEN (RTS) and PA00 (DTR).
-
-A plain open asserts both lines and holds the chip in reset. Here every open keeps DTR high and RTS
-released; the first open pulses RTS so the ROM comes up; after the command DTR low plus an RTS pulse
-boots the app. The exit status is ltchiptool's; 2 means the flash succeeded but the app was not
-booted (boot pulse failed, or no -d PORT to send it to), so the board sits in the ROM until reset.
-
-Usage: python flash_rtl87xx_kit.py flash write -d <port> firmware.uf2
-"""
-
-import sys
-import time
-
-import serial
-
-_first = [True]
-_orig_open = serial.Serial.open
-
-
-def _open(self):
-    self.dtr = True  # PA00 high: ROM download mode on the next reset
-    self.rts = False  # CEN released
-    _orig_open(self)
-    if _first[0]:
-        _first[0] = False
-        self.rts = True
-        time.sleep(0.1)
-        self.rts = False
-        time.sleep(0.3)  # reset into the ROM
-        self.reset_input_buffer()
-
-
-serial.Serial.open = _open
-
-from ltchiptool.__main__ import cli_entrypoint  # noqa: E402
-
-
-def port_argument(argv: list[str]) -> str | None:
-    for i, a in enumerate(argv):
-        if a in ("-d", "--device") and i + 1 < len(argv):
-            return argv[i + 1]
-        if a.startswith(("-d=", "--device=")):
-            return a.split("=", 1)[1]
-        if a.startswith("-d") and len(a) > 2:
-            return a[2:]
-    return None
-
-
-def boot_app(port: str) -> None:
-    s = serial.Serial(port=None)
-    s.port = port
-    s.dtr = False
-    s.rts = False
-    _orig_open(s)
-    s.rts = True
-    time.sleep(0.1)
-    s.rts = False
-    s.close()
-
-
-def main() -> int:
-    rc = 1
-    try:
-        result = cli_entrypoint.main(args=sys.argv[1:], standalone_mode=False)
-        rc = int(result) if isinstance(result, int) else 0
-    finally:
-        port = port_argument(sys.argv)
-        if not port:
-            print(
-                "[flash_rtl87xx_kit] no -d PORT given, the application was not booted",
-                file=sys.stderr,
-            )
-            if rc == 0:
-                rc = 2
-        else:
-            try:
-                boot_app(port)
-                print("[flash_rtl87xx_kit] application booted")
-            except (serial.SerialException, OSError) as err:
-                print(f"[flash_rtl87xx_kit] boot pulse failed: {err}", file=sys.stderr)
-                if rc == 0:
-                    rc = 2  # flashed, but the board is still in the ROM: press reset
-    return rc
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.agents/skills/hardware-test/scripts/ports.py

@@ -1,123 +0,0 @@
-"""List the boards on USB, or wait for one to enumerate.
-
-  ports.py                          table: port, vid:pid, product, serial number, guess
-  ports.py --wait 2e8a              print the first port with VID 0x2e8a once it appears (default 60 s)
-  ports.py --wait 1a86:7523 --timeout 30
-  ports.py --product "USB Serial"   first port whose USB product string matches (case-insensitive)
-  ports.py --wait 2e8a --serial SN  the port of one specific board, whatever name it comes back under
-  ports.py --serial-of PORT         print the USB serial number behind a port name
-
-Run with a Python that has pyserial (any ESPHome venv). Port names follow the hub port on macOS, so
-re-run this after every replug instead of trusting a name from an earlier session.
-"""
-
-import argparse
-import sys
-import time
-
-from serial.tools import list_ports
-
-GUESS = [
-    (
-        (0x1A86, 0x7523),
-        "CH340: D1 mini, BW15 kit, BK7238/CB3S or LN882H adapter; identify by the boot banner",
-    ),
-    ((0x1A86, 0x55D3), "CH343: ESP32-P4 devkit console"),
-    ((0x1A86, 0x55D4), "CH343: ESP32 devkit"),
-    ((0x1A86, None), "WCH CH34x USB serial bridge"),
-    ((0x10C4, 0xEA60), "CP2102: classic ESP32 devkit (esp32dev)"),
-    (
-        (0x303A, 0x1001),
-        "Espressif USB JTAG serial: S3/C3/C6/H2 native USB (logger hardware_uart USB_SERIAL_JTAG)",
-    ),
-    (
-        (0x2E8A, None),
-        "Raspberry Pi Pico W / Pico 2 W CDC; the port vanishes and comes back on every reboot",
-    ),
-    ((0x1915, 0x521F), "nRF52840 Dongle (PCA10059) in the Open DFU bootloader"),
-    (
-        (0x2FE3, 0x0100),
-        "nRF52840 Dongle running a Zephyr app; two CDC ports, ESPHome log on the second",
-    ),
-    ((0x1915, 0xCAFE), "Makerdiary nRF52840 MDK dongle running a Zephyr app"),
-    ((0x239A, None), "Adafruit style nRF52 board (UF2 bootloader family)"),
-]
-
-
-def guess(vid: int, pid: int) -> str:
-    for (gv, gp), text in GUESS:
-        if vid == gv and (gp is None or pid == gp):
-            return text
-    return ""
-
-
-def parse_id(text: str) -> tuple[int, int | None]:
-    vid, _, pid = text.partition(":")
-    return int(vid, 16), (int(pid, 16) if pid else None)
-
-
-def matches(
-    port, vid: int | None, pid: int | None, product: str | None, serial: str | None
-) -> bool:
-    if vid is not None and (port.vid != vid or (pid is not None and port.pid != pid)):
-        return False
-    if product and (port.product or "").lower() != product.lower():
-        return False
-    return not serial or (port.serial_number or "") == serial
-
-
-def main() -> int:
-    ap = argparse.ArgumentParser(
-        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
-    )
-    ap.add_argument(
-        "--wait",
-        metavar="VID[:PID]",
-        help="block until a matching port appears, print it",
-    )
-    ap.add_argument("--product", help="USB product string to match")
-    ap.add_argument("--serial", help="USB serial number to match")
-    ap.add_argument(
-        "--serial-of", metavar="PORT", help="print the USB serial number of PORT"
-    )
-    ap.add_argument("--timeout", type=float, default=60)
-    args = ap.parse_args()
-
-    if args.serial_of:
-        for p in list_ports.comports():
-            if p.device == args.serial_of and p.serial_number:
-                print(p.serial_number)
-                return 0
-        print(f"no USB serial number for {args.serial_of}", file=sys.stderr)
-        return 1
-
-    vid = pid = None
-    if args.wait:
-        vid, pid = parse_id(args.wait)
-
-    if args.wait or args.product or args.serial:
-        deadline = time.time() + args.timeout
-        while True:
-            for p in sorted(list_ports.comports(), key=lambda p: p.device):
-                if p.vid and matches(p, vid, pid, args.product, args.serial):
-                    print(p.device)
-                    return 0
-            if time.time() >= deadline:
-                print("no matching port", file=sys.stderr)
-                return 1
-            time.sleep(1)
-
-    rows = [p for p in list_ports.comports() if p.vid]
-    if not rows:
-        print("no USB serial ports")
-        return 1
-    for p in sorted(rows, key=lambda p: p.device):
-        print(
-            f"{p.device:32} {p.vid:04x}:{p.pid:04x}  {p.product or '?':34} "
-            f"{p.serial_number or '':18} {guess(p.vid, p.pid)}"
-        )
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.agents/skills/hardware-test/scripts/serial_capture.py

@@ -1,157 +0,0 @@
-"""Bounded, timestamped serial capture that always exits and closes the port.
-
-  serial_capture.py PORT SECONDS OUTFILE [--baud 115200] [--released] [--reset] [--append]
-
-  default      open with DTR/RTS as pyserial leaves them (asserted); fine for ESP devkits and the Pico.
-  --released   drive DTR and RTS low before opening: the BW15 and BK7238 CH340 kits strap the boot pin
-               (DTR) and reset (RTS), so a plain open holds the chip in reset.
-  --reset      pulse reset after opening (DTR low, RTS high 100 ms, RTS low) to capture a fresh boot.
-  --baud       115200 by default; 74880 shows the ESP8266 ROM boot messages.
-  --append     keep what OUTFILE already holds; by default it is truncated so counts cover this run only.
-
-Exit status 1 when nothing was received (wrong port name, or a port another capture still holds).
-Text ESPHome marks as secret (LOG_SECRET, the Wi-Fi password) is written as <secret>.
-Lines are written as [HH:MM:SS]text with ANSI colour stripped and flushed one by one, so a shell
-loop can grep the file while the capture runs. If the port is missing or disappears (USB CDC boards
-re-enumerate on reboot) the script retries until the deadline, and follows the board by its USB serial
-number when it comes back under another device path.
-
-Never run an open-ended serial session: every capture has a deadline, and a flash on the same port
-needs the capture stopped first (pkill -f "[s]erial_capture.py" does not match the killing shell).
-"""
-
-import argparse
-import contextlib
-import pathlib
-import re
-import sys
-import time
-
-import serial
-from serial.tools import list_ports
-
-ANSI = re.compile(rb"\x1b\[[0-9;]*[A-Za-z]")
-# ESPHome's LOG_SECRET span (a Wi-Fi password); a span cut off before its end marker is secret to the end
-SECRET = re.compile(rb"\x1b\[8m.*?(?:\x1b\[28m|$)", re.DOTALL)
-PORT_ERRORS = (serial.SerialException, OSError)
-
-
-def identify(port: str) -> tuple[str | None, int]:
-    """USB serial number of the port and its position among that device's ports (a dongle has two)."""
-    ports = sorted(list_ports.comports(), key=lambda p: p.device)
-    serial_number = next((p.serial_number for p in ports if p.device == port), None)
-    siblings = [
-        p.device for p in ports if serial_number and p.serial_number == serial_number
-    ]
-    return serial_number, siblings.index(port) if port in siblings else 0
-
-
-def current_path(port: str, serial_number: str | None, index: int) -> str:
-    """The port's current device path: a USB CDC board can come back under a new name after a reboot."""
-    if serial_number:
-        ports = sorted(list_ports.comports(), key=lambda p: p.device)
-        siblings = [p.device for p in ports if p.serial_number == serial_number]
-        if index < len(siblings):
-            return siblings[index]
-    return port
-
-
-def open_port(args: argparse.Namespace, path: str) -> serial.Serial:
-    s = serial.Serial(port=None, baudrate=args.baud, timeout=0.2)
-    s.port = path
-    if args.released:
-        s.dtr = False
-        s.rts = False
-    s.open()
-    if args.reset:
-        try:
-            s.dtr = False
-            s.rts = True
-            time.sleep(0.1)
-            s.rts = False
-            s.reset_input_buffer()
-        except PORT_ERRORS:
-            s.close()
-            raise
-    return s
-
-
-def write_line(out, tag: bytes, data: bytes) -> None:
-    stamp = time.strftime("[%H:%M:%S]").encode()
-    out.write(stamp + tag + ANSI.sub(b"", SECRET.sub(b"<secret>", data)) + b"\n")
-    out.flush()
-
-
-def note(out, text: str) -> None:
-    write_line(out, b"[capture] ", text.encode())
-
-
-def capture(args: argparse.Namespace, out) -> int:
-    """Returns the number of bytes received."""
-    deadline = time.time() + args.seconds
-    buf = b""
-    s = None
-    received = 0
-    serial_number, index = None, 0
-    while time.time() < deadline:
-        if s is None:
-            path = current_path(args.port, serial_number, index)
-            try:
-                s = open_port(args, path)
-                args.reset = False  # only reset on the first open
-                if serial_number is None:
-                    serial_number, index = identify(path)
-                if path != args.port:
-                    note(out, f"reopened as {path}")
-            except PORT_ERRORS as err:
-                note(out, f"open failed: {err}")
-                time.sleep(1)
-                continue
-        try:
-            data = s.read(4096)
-        except PORT_ERRORS as err:
-            if buf:  # keep the cut-off line apart from the next boot's first line
-                write_line(out, b"[partial]", buf)
-                buf = b""
-            note(out, f"port lost: {err}")
-            with contextlib.suppress(*PORT_ERRORS):
-                s.close()
-            s = None
-            time.sleep(1)
-            continue
-        if not data:
-            continue
-        received += len(data)
-        buf += data
-        while b"\n" in buf:
-            line, buf = buf.split(b"\n", 1)
-            write_line(out, b"", line.rstrip(b"\r"))
-    if buf:
-        write_line(out, b"[partial]", buf)
-    if s is not None:
-        s.close()
-    return received
-
-
-def main() -> int:
-    ap = argparse.ArgumentParser(
-        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
-    )
-    ap.add_argument("port")
-    ap.add_argument("seconds", type=float)
-    ap.add_argument("outfile")
-    ap.add_argument("--baud", type=int, default=115200)
-    ap.add_argument("--released", action="store_true")
-    ap.add_argument("--reset", action="store_true")
-    ap.add_argument("--append", action="store_true")
-    args = ap.parse_args()
-    with pathlib.Path(args.outfile).open("ab" if args.append else "wb") as out:
-        received = capture(args, out)
-    if received == 0:
-        print(f"[capture] nothing received from {args.port}", file=sys.stderr)
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.agents/skills/hardware-test/scripts/wifisave_hammer.sh

@@ -1,133 +0,0 @@
-#!/bin/bash
-# wifisave_hammer.sh: the device under test (DUT) falls back to its AP; a client board joins it and posts
-# /wifisave repeatedly, then the real credentials. Compiles, flashes, captures both serial logs and
-# prints counts. Configs come from templates/example-dut.yaml and templates/example-client.yaml.
-#
-# Usage: wifisave_hammer.sh DUT_KIND DUT_PORT DUT_YAML DUT_TREE CLIENT_PORT CLIENT_YAML CLIENT_TREE [SETTLE_S]
-#   DUT_KIND    esp (esphome upload), pico (upload, then re-find the CDC port by USB serial number),
-#               bw15 (flash_rtl87xx_kit.py) or bk (flash_bk72xx.py)
-#   *_YAML      absolute path; the file name without .yaml must equal the config's `name`
-#   *_TREE      checkout or worktree whose esphome code must build that yaml (cwd for python -m esphome)
-#   SETTLE_S    seconds to keep capturing after the client reports the real save (default 40; BW15 wants 90)
-# Env: PY (python with esphome; default DUT_TREE/venv/bin/python, else python3 on PATH; an explicit PY must exist), LTPY
-#      (LibreTiny penv python with ltchiptool; default ~/.platformio/penv/.libretiny/bin/python)
-# Output next to each yaml: NAME-compile.log, NAME-upload.log, NAME-serial.log, NAME-capture.err, and DUT NAME-events.txt
-# (addresses redacted so the extract can go on a PR; the serial logs themselves stay local).
-# Exit status: 0 RESULT PASS (no crash marker or reboot after the AP came up, the device joined the network,
-# and real stimulus: saves answered and a cooldown exit); 3 RESULT FAIL (the counts show
-# a failure); 2 RESULT INVALID (a precondition or the stimulus was missed, or a capture did not last the run);
-# 1 when a build, flash or port step fails (nothing is reported).
-set -u
-SKILL=$(cd "$(dirname "$0")/.." && pwd)
-KIND=$1; DPORT=$2; DYAML=$3; DTREE=$4; CPORT=$5; CYAML=$6; CTREE=$7; SETTLE=${8:-40}
-if [ -n "${PY:-}" ]; then [ -x "$PY" ] || { echo "[hammer] FAILED: PY=$PY is not executable"; exit 1; }
-else PY=$DTREE/venv/bin/python; [ -x "$PY" ] || PY=$(command -v python3) || { echo "[hammer] FAILED: no python found, set PY"; exit 1; }; fi
-LTPY=${LTPY:-$HOME/.platformio/penv/.libretiny/bin/python}
-DDIR=$(dirname "$DYAML"); DNAME=$(basename "$DYAML" .yaml)
-CDIR=$(dirname "$CYAML"); CNAME=$(basename "$CYAML" .yaml)
-DLOG=$DDIR/$DNAME-serial.log; CLOG=$CDIR/$CNAME-serial.log
-INVALID=""
-AP_WAIT=120; UPLOAD_WAIT=300; SAVE_WAIT=240
-# Crash signatures (extended regex), not bare words: "aborting connection attempt" is a normal Wi-Fi retry line
-CRASH_RE='Panic |abort\(\)|Fatal exception|Exception \(|Guru Meditation|HardFault|Bus Fault|Backtrace:|Soft WDT reset|wdt reset|Brownout|rst cause:[24]'
-# Boot banners and port losses are counted apart: a Pico reboot shows as a port loss (and maybe a banner too),
-# while on a UART board a port loss comes from the adapter or the hub, not the chip
-BANNER_RE='Log initialized'; LOSS_RE='\[capture\] port lost'
-DUT_CAPTURE=$((AP_WAIT + UPLOAD_WAIT + SAVE_WAIT + SETTLE + 60)); CLIENT_CAPTURE=$((SAVE_WAIT + SETTLE + 60))
-
-bound() { local t=$1; shift; if command -v timeout >/dev/null; then timeout "$t" "$@"; else perl -e 'alarm shift; exec @ARGV' "$t" "$@"; fi; }
-count() { LC_ALL=C grep -a -c "$1" "$2"; }
-wait_for() { # wait_for FILE PATTERN SECONDS -> prints elapsed, status 1 on timeout
-  local n=0; until LC_ALL=C grep -a -q "$2" "$1"; do sleep 2; n=$((n+2)); [ $n -ge "$3" ] && { echo "$n"; return 1; }; done; echo "$n"; }
-# Only this run's captures: another capture on the host (a soak on a third board) must survive
-stop_tails() { pkill -f "[s]erial_capture.py $DPORT " 2>/dev/null; pkill -f "[s]erial_capture.py $CPORT " 2>/dev/null; sleep 1; }
-fail() { echo "[hammer] FAILED: $1"; stop_tails; exit 1; }
-port_never_opened() { # an open failure and no line that is not a capture note: the port, not the firmware
-  LC_ALL=C grep -a -q '\[capture\] open failed' "$1" && ! LC_ALL=C grep -a -q -v '^\[[0-9:]*\]\[capture\]' "$1"; }
-compile() { # compile YAML TREE
-  (cd "$2" && PYTHONUNBUFFERED=1 bound 1500 "$PY" -m esphome compile "$1" > "${1%.yaml}-compile.log" 2>&1); local rc=$?
-  echo "[hammer] compile $(basename "$1"): rc=$rc"; return $rc; }
-esp_upload() { # esp_upload YAML PORT TREE
-  (cd "$3" && bound $UPLOAD_WAIT "$PY" -m esphome upload "$1" --device "$2" > "${1%.yaml}-upload.log" 2>&1)
-  local ok; ok=$(count 'Successfully uploaded' "${1%.yaml}-upload.log"); echo "[hammer] upload $(basename "$1"): ok=$ok"; [ "$ok" -ge 1 ]; }
-
-stop_tails
-compile "$DYAML" "$DTREE" || fail "DUT build failed, see $DDIR/$DNAME-compile.log"
-compile "$CYAML" "$CTREE" || fail "client build failed, see $CDIR/$CNAME-compile.log"
-
-TAILOPT=""
-case $KIND in
-  esp) esp_upload "$DYAML" "$DPORT" "$DTREE" || fail "DUT upload failed" ;;
-  pico)
-    SN=$("$PY" "$SKILL/scripts/ports.py" --serial-of "$DPORT") || fail "no USB serial number for $DPORT"
-    esp_upload "$DYAML" "$DPORT" "$DTREE" || fail "DUT upload failed"
-    # The Pico drops its CDC port on reboot and may already be back: take whatever path this board has now;
-    # the capture follows the serial number if the path changes again
-    DPORT=$("$PY" "$SKILL/scripts/ports.py" --wait 2e8a --serial "$SN" --timeout 60) || fail "pico did not re-enumerate"
-    echo "[hammer] pico port after upload: $DPORT"; sleep 2 ;;
-  bw15|bk)
-    UF2=$(ls "$DDIR/.esphome/build/$DNAME/.pioenvs/$DNAME/"*.uf2 2>/dev/null | head -1)
-    [ -n "$UF2" ] || fail "no uf2 under $DDIR/.esphome/build/$DNAME"
-    echo "[hammer] uf2: ${UF2##*/}"
-    W=$SKILL/scripts/flash_rtl87xx_kit.py; [ "$KIND" = bk ] && W=$SKILL/scripts/flash_bk72xx.py
-    (cd "$DDIR" && bound 400 "$LTPY" "$W" flash write -d "$DPORT" "$UF2" > "$DDIR/$DNAME-upload.log" 2>&1); rc=$?
-    echo "[hammer] $KIND flash: rc=$rc"; [ $rc -eq 0 ] || fail "DUT flash failed, see $DDIR/$DNAME-upload.log"
-    TAILOPT="--released" ;;
-  *) echo "unknown DUT_KIND $KIND"; exit 1 ;;
-esac
-
-: > "$DLOG"; ("$PY" "$SKILL/scripts/serial_capture.py" "$DPORT" $DUT_CAPTURE "$DLOG" $TAILOPT 2> "${DLOG%-serial.log}-capture.err" &)
-if ! n=$(wait_for "$DLOG" "Captive portal\|Starting fallback AP" $AP_WAIT); then
-  [ -s "$DLOG" ] || fail "the DUT capture produced nothing (the capture itself failed), see ${DLOG%-serial.log}-capture.err"
-  port_never_opened "$DLOG" && fail "could not open $DPORT (held by another process, or the wrong port), see $DLOG"
-  fail "DUT never raised its AP within ${n}s, see $DLOG"
-fi
-echo "[hammer] DUT fallback AP after ${n}s"; sleep 2
-# reboots are counted from here; the first banner may predate the capture
-BANNER_BASE=$(count "$BANNER_RE" "$DLOG"); LOSS_BASE=$(count "$LOSS_RE" "$DLOG")
-
-esp_upload "$CYAML" "$CPORT" "$CTREE" || fail "client upload failed"
-: > "$CLOG"; ("$PY" "$SKILL/scripts/serial_capture.py" "$CPORT" $CLIENT_CAPTURE "$CLOG" 2> "${CLOG%-serial.log}-capture.err" &)
-if n=$(wait_for "$CLOG" "real save status\|posting the real" $SAVE_WAIT); then
-  echo "[hammer] client posted the real credentials after ${n}s; settling ${SETTLE}s"; sleep "$SETTLE"
-else
-  [ -s "$CLOG" ] || fail "the client capture produced nothing (the capture itself failed), see ${CLOG%-serial.log}-capture.err"
-  port_never_opened "$CLOG" && fail "could not open $CPORT (held by another process, or the wrong port), see $CLOG"
-  INVALID="client never reached the real save within ${n}s"; echo "[hammer] WARNING: $INVALID"
-fi
-
-# A verdict needs complete evidence: both captures must have lasted the run and logged no error of their own
-for spec in "$DPORT:${DLOG%-serial.log}-capture.err" "$CPORT:${CLOG%-serial.log}-capture.err"; do
-  port=${spec%%:*}; err=${spec#*:}
-  pgrep -f "[s]erial_capture.py $port " >/dev/null || INVALID="${INVALID:+$INVALID; }the capture on $port ended before the run did, see $err"
-  [ -s "$err" ] && INVALID="${INVALID:+$INVALID; }the capture on $port reported an error, see $err"
-done
-CRASHES=$(LC_ALL=C grep -a -c -E "$CRASH_RE" "$DLOG")
-BANNERS=$(( $(count "$BANNER_RE" "$DLOG") - BANNER_BASE )); LOSSES=$(( $(count "$LOSS_RE" "$DLOG") - LOSS_BASE ))
-if [ "$KIND" = pico ]; then
-  REBOOTS=$BANNERS; [ "$LOSSES" -gt "$REBOOTS" ] && REBOOTS=$LOSSES  # one reboot can show as both, so take the larger
-else
-  REBOOTS=$BANNERS; [ "$LOSSES" -gt 0 ] && INVALID="${INVALID:+$INVALID; }the DUT port dropped $LOSSES time(s) mid-run (adapter or hub, not the chip)"
-fi
-STA=$(LC_ALL=C grep -a 'IP Address:' "$DLOG" | grep -v -c '192\.168\.4\.'); REAL=$(LC_ALL=C grep -a -o 'real save status [-0-9]*' "$CLOG" | tail -1 | awk '{print $4}')
-SAVES=$(count 'Requested WiFi Settings Change' "$DLOG"); EXITS=$(count 'cooldown early' "$DLOG"); ANSWERED=$(count 'bogus save status 200' "$CLOG")
-echo "[hammer] $DNAME: saves requested $SAVES, cooldown exits $EXITS, crash markers $CRASHES, after the AP came up: boot banners $BANNERS, port losses $LOSSES, reboots $REBOOTS; STA addresses $STA"
-FAILED=$(count 'bogus save status -1' "$CLOG")
-echo "[hammer] $CNAME: bogus saves answered $ANSWERED, failed $FAILED, real save status ${REAL:-none}"
-# Only whole messages, matched where the message starts, so a credential line or an odd SSID never gets in
-LC_ALL=C grep -a -E "^\[[0-9:]+\](\[[A-Z]\]\[[a-z_]+:[0-9]+\]: *(Exiting cooldown early|Starting fallback AP|Captive portal|Requested WiFi Settings Change|Retry phase|Connected\$|IP Address: )|\[capture\] port lost|($CRASH_RE))" "$DLOG" | LC_ALL=C tr -cd '\11\12\15\40-\176' | sed -E 's/(IP Address: )[^ ]+/\1<redacted>/' | cut -c1-110 | head -80 > "$DDIR/$DNAME-events.txt"
-echo "[hammer] events: $DDIR/$DNAME-events.txt"
-stop_tails
-[ -z "$INVALID" ] || { echo "[hammer] RESULT INVALID: $INVALID"; exit 2; }
-# Provisioning is proven by the device joining the network; the client's answer to the real save can time
-# out because the device leaves the AP before replying, so its status is information only
-if [ "$CRASHES" -gt 0 ] || [ "$REBOOTS" -gt 0 ] || [ "$STA" -lt 1 ]; then
-  echo "[hammer] RESULT FAIL: crash markers $CRASHES, reboots $REBOOTS, STA addresses $STA, real save status ${REAL:-none}"; exit 3
-fi
-# A pass needs the stimulus the flow is about: at least half the configured bogus saves answered and one cooldown exit
-CONFIGURED=$(LC_ALL=C grep -a -E '^[[:space:]]*bogus_saves:' "$CYAML" | head -1 | tr -dc '0-9'); CONFIGURED=${CONFIGURED:-15}
-if [ "$EXITS" -lt 1 ] || [ $((ANSWERED * 2)) -lt "$CONFIGURED" ]; then
-  echo "[hammer] RESULT INVALID: insufficient stimulus (bogus saves answered $ANSWERED of $CONFIGURED, cooldown exits $EXITS)"; exit 2
-fi
-[ "$FAILED" -eq 0 ] || echo "[hammer] WARNING: $FAILED of $CONFIGURED bogus saves got no answer"
-echo "[hammer] RESULT PASS"; exit 0

.agents/skills/hardware-test/templates/client-wifisave.yaml

@@ -1,77 +0,0 @@
-# Package for the client board: it joins the device under test's AP (priority 10), posts
-# `bogus_saves` bogus /wifisave requests `save_interval` apart, then posts the real credentials once.
-# Include from a per-run yaml that holds the platform block and the substitutions (example-client.yaml);
-# real_ssid and real_psk come from the scratch directory's secrets.yaml and must be URL safe.
-# Set bogus_saves to 1 for a plain provisioning check. Log lines the driver script counts:
-#   "bogus save N", "bogus save status 200", "posting the real credentials", "real save status 200"
-# The hammer is a single-mode script, so a reconnect to the AP (the device under test rebooted) does not
-# start a second series on top of the first.
-substitutions:
-  ap_password: hwtestpass
-  bogus_saves: "15"
-  save_interval: 3s
-  bogus_ssid: hwtest-no-such-network
-  bogus_psk: nosuchpassword
-
-esphome:
-  name: ${name}
-
-logger:
-  level: DEBUG
-
-http_request:
-  id: http
-  verify_ssl: false
-  timeout: 10s
-
-wifi:
-  id: wifi_id
-  networks:
-    - ssid: ${ap_ssid}
-      password: ${ap_password}
-      priority: 10
-    - ssid: ${real_ssid}
-      password: ${real_psk}
-  on_connect:
-    - lambda: |-
-        char b[40];
-        ESP_LOGI("test", "connected, ip %s", id(wifi_id).get_ip_addresses()[0].str_to(b));
-    - if:
-        condition:
-          lambda: |-
-            char b[40];
-            return strncmp(id(wifi_id).get_ip_addresses()[0].str_to(b), "192.168.4.", 10) == 0;
-        then:
-          - script.execute: hammer
-
-script:
-  - id: hammer
-    mode: single
-    then:
-      - delay: 3s
-      - logger.log: "hammering /wifisave with bogus credentials"
-      - repeat:
-          count: ${bogus_saves}
-          then:
-            - lambda: ESP_LOGI("test", "bogus save %u", (unsigned) iteration + 1);
-            - http_request.get:
-                url: "http://192.168.4.1/wifisave?ssid=${bogus_ssid}&psk=${bogus_psk}"
-                capture_response: true
-                on_response:
-                  - lambda: ESP_LOGI("test", "bogus save status %d", response->status_code);
-                on_error:
-                  - lambda: ESP_LOGW("test", "bogus save status -1");
-            - delay: ${save_interval}
-      - logger.log: "posting the real credentials"
-      - http_request.get:
-          url: "http://192.168.4.1/wifisave?ssid=${real_ssid}&psk=${real_psk}"
-          capture_response: true
-          on_response:
-            - lambda: ESP_LOGI("test", "real save status %d", response->status_code);
-          on_error:
-            - lambda: ESP_LOGW("test", "real save status -1");
-
-interval:
-  - interval: 5s
-    then:
-      - lambda: ESP_LOGI("test", "alive %u s", (unsigned) (millis() / 1000));

.agents/skills/hardware-test/templates/dut-fallback-ap.yaml

@@ -1,31 +0,0 @@
-# Package for a device under test that never finds its network, falls back to its AP and serves the
-# captive portal. Include it from a per-run yaml that holds the platform block and the substitutions
-# (see example-dut.yaml). Bump `name` on every run: saved credentials are keyed by it, and a reused
-# name boots straight onto the real network and never raises the AP.
-substitutions:
-  ap_password: hwtestpass
-  ap_timeout: 15s
-  bogus_ssid: hwtest-no-such-network
-  bogus_psk: nosuchpassword
-
-esphome:
-  name: ${name}
-
-logger:
-  level: DEBUG
-
-wifi:
-  networks:
-    - ssid: ${bogus_ssid}
-      password: ${bogus_psk}
-  ap:
-    ssid: ${ap_ssid}
-    password: ${ap_password}
-    ap_timeout: ${ap_timeout}
-
-captive_portal:
-
-interval:
-  - interval: 5s
-    then:
-      - lambda: ESP_LOGI("test", "alive %u s", (unsigned) (millis() / 1000));

.agents/skills/hardware-test/templates/example-client.yaml

@@ -1,18 +0,0 @@
-# Client board for the /wifisave hammer. Copy into a scratch directory next to a secrets.yaml;
-# ap_ssid must match the device under test, real_ssid and real_psk must be URL safe.
-substitutions:
-  name: hwtest-client-1
-  ap_ssid: hwtest-ap
-  real_ssid: !secret wifi_ssid
-  real_psk: !secret wifi_password
-  bogus_saves: "15"
-
-esp32:
-  board: esp32dev
-  framework:
-    type: esp-idf
-
-# esp8266: {board: d1_mini}
-
-packages:
-  hwtest: !include client-wifisave.yaml

.agents/skills/hardware-test/templates/example-dut.yaml

@@ -1,16 +0,0 @@
-# Device under test for the /wifisave hammer. Copy into a scratch directory, keep the file name equal
-# to `name`, pick one platform block, bump `name` every run.
-substitutions:
-  name: hwtest-dut-1
-  ap_ssid: hwtest-ap
-
-esp8266:
-  board: d1_mini
-
-# esp32: {board: esp32dev, framework: {type: esp-idf}}
-# rtl87xx: {board: bw15}
-# bk72xx: {board: generic-bk7238}   # plus logger: {hardware_uart: UART1}, BK72xx logs on UART2 by default
-# rp2040: {board: rpipico2w}
-
-packages:
-  hwtest: !include dut-fallback-ap.yaml

.agents/skills/pr-workflow/SKILL.md

@@ -1,96 +0,0 @@
----
-name: pr-workflow
-description: Create pull requests for esphome. Use when creating PRs, submitting changes, or preparing contributions.
-allowed-tools: Read, Bash, Glob, Grep
----
-
-# ESPHome PR Workflow
-
-When creating a pull request for esphome, follow these steps:
-
-## 1. Create Branch from Upstream
-
-Always base your branch on **upstream** (not origin/fork) to ensure you have the latest code:
-
-```bash
-git fetch upstream
-git checkout -b <branch-name> upstream/dev
-```
-
-## 2. Read the PR Template
-
-Before creating a PR, read `.github/PULL_REQUEST_TEMPLATE.md` to understand required fields.
-
-## 3. Create the PR
-
-Use `gh pr create` with the **full template** filled in. Never skip or abbreviate sections.
-
-Required fields:
-- **What does this implement/fix?**: Brief description of changes
-- **Types of changes**: Check ONE appropriate box (Bugfix, New feature, Breaking change, etc.)
-- **Related issue**: Use `fixes <link>` syntax if applicable
-- **Pull request in esphome.io**: Link if docs are needed
-- **Test Environment**: Check platforms you tested on
-- **Example config.yaml**: Include working example YAML
-- **Checklist**: Verify code is tested and tests added
-
-## 4. Example PR Body
-
-```markdown
-# What does this implement/fix?
-
-<describe your changes here>
-
-## Types of changes
-
-- [ ] Bugfix (non-breaking change which fixes an issue)
-- [x] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Developer breaking change (an API change that could break external components)
-- [ ] Code quality improvements to existing code or addition of tests
-- [ ] Other
-
-**Related issue or feature (if applicable):**
-
-- fixes https://github.com/esphome/esphome/issues/XXX
-
-**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**
-
-- esphome/esphome.io#XXX
-
-## Test Environment
-
-- [x] ESP32
-- [x] ESP32 IDF
-- [ ] ESP8266
-- [ ] RP2040
-- [ ] BK72xx
-- [ ] RTL87xx
-- [ ] LN882x
-- [ ] nRF52840
-
-## Example entry for `config.yaml`:
-
-```yaml
-# Example config.yaml
-component_name:
-  id: my_component
-  option: value
-```
-
-## Checklist:
-  - [x] The code change is tested and works locally.
-  - [x] Tests have been added to verify that the new code works (under `tests/` folder).
-
-If user exposed functionality or configuration variables are added/changed:
-  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
-```
-
-## 5. Push and Create PR
-
-```bash
-git push -u origin <branch-name>
-gh pr create --repo esphome/esphome --base dev --title "[component] Brief description"
-```
-
-Title should be prefixed with the component name in brackets, e.g. `[safe_mode] Add feature`.

.clang-tidy

@@ -5,50 +5,27 @@ Checks: >-
   -altera-*,
   -android-*,
   -boost-*,
-  -bugprone-derived-method-shadowing-base-method,
-  -bugprone-easily-swappable-parameters,
-  -bugprone-implicit-widening-of-multiplication-result,
-  -bugprone-invalid-enum-default-initialization,
-  -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
-  -bugprone-tagged-union-member-count,
   -bugprone-signed-char-misuse,
-  -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
-  -cert-err33-c,
   -cert-err58-cpp,
-  -cert-int09-c,
   -cert-oop57-cpp,
   -cert-str34-c,
-  -clang-analyzer-optin.core.EnumCastOutOfRange,
   -clang-analyzer-optin.cplusplus.UninitializedObject,
   -clang-analyzer-osx.*,
-  -clang-analyzer-security.ArrayBound,
   -clang-diagnostic-delete-abstract-non-virtual-dtor,
   -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
-  -clang-diagnostic-deprecated-declarations,
-  -clang-diagnostic-ignored-optimization-argument,
-  -clang-diagnostic-missing-designated-field-initializers,
-  -clang-diagnostic-missing-field-initializers,
   -clang-diagnostic-shadow-field,
   -clang-diagnostic-unused-const-variable,
   -clang-diagnostic-unused-parameter,
-  -clang-diagnostic-vla-cxx-extension,
   -concurrency-*,
   -cppcoreguidelines-avoid-c-arrays,
-  -cppcoreguidelines-avoid-const-or-ref-data-members,
-  -cppcoreguidelines-avoid-do-while,
   -cppcoreguidelines-avoid-magic-numbers,
   -cppcoreguidelines-init-variables,
-  -cppcoreguidelines-macro-to-enum,
   -cppcoreguidelines-macro-usage,
-  -cppcoreguidelines-missing-std-forward,
   -cppcoreguidelines-narrowing-conversions,
   -cppcoreguidelines-non-private-member-variables-in-classes,
-  -cppcoreguidelines-owning-memory,
-  -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
-  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -cppcoreguidelines-pro-type-const-cast,
@@ -58,16 +35,12 @@ Checks: >-
   -cppcoreguidelines-pro-type-static-cast-downcast,
   -cppcoreguidelines-pro-type-union-access,
   -cppcoreguidelines-pro-type-vararg,
-  -cppcoreguidelines-rvalue-reference-param-not-moved,
   -cppcoreguidelines-special-member-functions,
-  -cppcoreguidelines-use-default-member-init,
-  -cppcoreguidelines-use-enum-class,
-  -cppcoreguidelines-virtual-class-destructor,
-  -fuchsia-default-arguments-calls,
-  -fuchsia-default-arguments-declarations,
   -fuchsia-multiple-inheritance,
   -fuchsia-overloaded-operator,
   -fuchsia-statically-constructed-objects,
+  -fuchsia-default-arguments-declarations,
+  -fuchsia-default-arguments-calls,
   -google-build-using-namespace,
   -google-explicit-constructor,
   -google-readability-braces-around-statements,
@@ -79,66 +52,38 @@ Checks: >-
   -llvm-else-after-return,
   -llvm-header-guard,
   -llvm-include-order,
-  -llvm-prefer-static-over-anonymous-namespace,
   -llvm-qualified-auto,
-  -llvm-use-ranges,
   -llvmlibc-*,
-  -misc-const-correctness,
-  -misc-include-cleaner,
-  -misc-multiple-inheritance,
-  -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
-  -misc-override-with-different-visibility,
+  -misc-no-recursion,
   -misc-unused-parameters,
-  -misc-use-anonymous-namespace,
-  -misc-use-internal-linkage,
-  -modernize-avoid-bind,
-  -modernize-avoid-variadic-functions,
   -modernize-avoid-c-arrays,
-  -modernize-avoid-c-style-cast,
-  -modernize-macro-to-enum,
+  -modernize-avoid-bind,
+  -modernize-concat-nested-namespaces,
   -modernize-return-braced-init-list,
-  -modernize-type-traits,
   -modernize-use-auto,
-  -modernize-use-constraints,
   -modernize-use-default-member-init,
-  -modernize-use-designated-initializers,
   -modernize-use-equals-default,
-  -modernize-use-integer-sign-comparison,
-  -modernize-use-nodiscard,
-  -modernize-use-nullptr,
-  -modernize-use-ranges,
   -modernize-use-trailing-return-type,
+  -modernize-use-nodiscard,
   -mpi-*,
   -objc-*,
-  -performance-enum-size,
-  -portability-avoid-pragma-once,
-  -portability-template-virtual-member-function,
-  -readability-ambiguous-smartptr-reset-call,
-  -readability-avoid-nested-conditional-operator,
-  -readability-container-data-pointer,
   -readability-convert-member-functions-to-static,
   -readability-else-after-return,
-  -readability-enum-initial-value,
   -readability-function-cognitive-complexity,
   -readability-implicit-bool-conversion,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
-  -readability-math-missing-parentheses,
-  -readability-named-parameter,
-  -readability-redundant-casting,
-  -readability-redundant-inline-specifier,
-  -readability-redundant-member-init,
-  -readability-redundant-parentheses,
-  -readability-redundant-typename,
+  -readability-redundant-string-init,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
-  -readability-use-std-min-max,
-  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
+AnalyzeTemporaryDtors: false
 FormatStyle:     google
 CheckOptions:
+  - key:             google-readability-braces-around-statements.ShortStatementLines
+    value:           '1'
   - key:             google-readability-function-size.StatementThreshold
     value:           '800'
   - key:             google-runtime-int.TypeSuffix
@@ -213,9 +158,3 @@ CheckOptions:
     value:           ''
   - key:             readability-qualified-auto.AddConstToQualified
     value:           0
-  - key:             readability-identifier-length.MinimumVariableNameLength
-    value:           0
-  - key:             readability-identifier-length.MinimumParameterNameLength
-    value:           0
-  - key:             readability-identifier-length.MinimumLoopCounterNameLength
-    value:           0

.claude/settings.json

@@ -1,16 +0,0 @@
-{
-  "hooks": {
-    "SessionStart": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "d=\"${CLAUDE_PROJECT_DIR:-.}\"; [ -x \"$d/venv/bin/python\" ] || { mkdir -p \"$d/.temp\"; env -u VIRTUAL_ENV \"$d/script/setup\" >\"$d/.temp/setup.log\" 2>&1 || echo '{\"systemMessage\":\"script/setup failed; see .temp/setup.log\"}'; }",
-            "statusMessage": "Setting up dev environment (script/setup)...",
-            "timeout": 900
-          }
-        ]
-      }
-    ]
-  }
-}

.claude/skills

@@ -1 +0,0 @@
-../.agents/skills

.coveragerc

@@ -1,5 +1,2 @@
 [run]
-omit =
-    esphome/components/*
-    esphome/analyze_memory/*
-    tests/integration/*
+omit = esphome/components/*

.devcontainer/Dockerfile

@@ -1,34 +0,0 @@
-ARG BUILD_BASE_VERSION=2026.06.1
-
-
-FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base
-
-RUN git config --system --add safe.directory "*"
-
-RUN apt update \
-    && apt install -y \
-      protobuf-compiler
-
-RUN pip install uv
-
-RUN useradd esphome -m
-
-USER esphome
-ENV VIRTUAL_ENV=/home/esphome/.local/esphome-venv
-RUN uv venv $VIRTUAL_ENV
-ENV PATH="$VIRTUAL_ENV/bin:$PATH"
-# Override this set to true in the docker-base image
-ENV UV_SYSTEM_PYTHON=false
-
-WORKDIR /tmp
-
-COPY requirements.txt ./
-RUN uv pip install -r requirements.txt
-COPY requirements_dev.txt requirements_test.txt ./
-RUN uv pip install -r requirements_dev.txt -r requirements_test.txt
-
-RUN \
-    platformio settings set enable_telemetry No \
-    && platformio settings set check_platformio_interval 1000000
-
-WORKDIR /workspaces

.devcontainer/devcontainer.json

@@ -1,62 +1,37 @@
 {
   "name": "ESPHome Dev",
-  "context": "..",
-  "dockerFile": "Dockerfile",
+  "image": "ghcr.io/esphome/esphome-lint:dev",
   "postCreateCommand": [
     "script/devcontainer-post-create"
   ],
-  "features": {
-    "ghcr.io/devcontainers/features/github-cli:1": {}
+  "containerEnv": {
+    "DEVCONTAINER": "1"
   },
   "runArgs": [
     "--privileged",
     "-e",
-    "GIT_EDITOR=code --wait"
-    // uncomment and edit the path in order to pass through local USB serial to the container
-    // , "--device=/dev/ttyACM0"
+    "ESPHOME_DASHBOARD_USE_PING=1"
   ],
-  // if you are using avahi in the host device, uncomment these to allow the
-  // devcontainer to find devices via mdns
-  //"mounts": [
-  //  "type=bind,source=/dev/bus/usb,target=/dev/bus/usb",
-  //  "type=bind,source=/var/run/dbus,target=/var/run/dbus",
-  //  "type=bind,source=/var/run/avahi-daemon/socket,target=/var/run/avahi-daemon/socket"
-  //],
+  "appPort": 6052,
   "customizations": {
     "vscode": {
       "extensions": [
         // python
         "ms-python.python",
-        "ms-python.pylint",
-        "ms-python.flake8",
-        "charliermarsh.ruff",
         "visualstudioexptteam.vscodeintellicode",
         // yaml
         "redhat.vscode-yaml",
         // cpp
         "ms-vscode.cpptools",
         // editorconfig
-        "editorconfig.editorconfig"
+        "editorconfig.editorconfig",
       ],
       "settings": {
         "python.languageServer": "Pylance",
-        // Use the container's pre-provisioned venv (built by the Dockerfile, outside the
-        // bind-mounted workspace) rather than a ./venv that may leak in from the host and
-        // mismatch the container's Python. See .devcontainer/Dockerfile (esphome-venv).
-        "python.defaultInterpreterPath": "/home/esphome/.local/esphome-venv/bin/python",
-        "python.terminal.activateEnvironment": true,
-        "pylint.args": [
-          "--rcfile=${workspaceFolder}/pyproject.toml"
-        ],
-        "flake8.args": [
-          "--config=${workspaceFolder}/.flake8"
-        ],
-        "ruff.configuration": "${workspaceFolder}/pyproject.toml",
-        "[python]": {
-          // VS will say "Value is not accepted" before building the devcontainer, but the warning
-          // should go away after build is completed.
-          "editor.defaultFormatter": "charliermarsh.ruff"
-        },
+        "python.pythonPath": "/usr/bin/python3",
+        "python.linting.pylintEnabled": true,
+        "python.linting.enabled": true,
+        "python.formatting.provider": "black",
         "editor.formatOnPaste": false,
         "editor.formatOnSave": true,
         "editor.formatOnType": true,
@@ -66,7 +41,6 @@
           "!secret scalar",
           "!lambda scalar",
           "!extend scalar",
-          "!remove scalar",
           "!include_dir_named scalar",
           "!include_dir_list scalar",
           "!include_dir_merge_list scalar",

.dockerignore

@@ -75,9 +75,6 @@ target/
 # pyenv
 .python-version
 
-# asdf
-.tool-versions
-
 # celery beat schedule file
 celerybeat-schedule
 
@@ -114,5 +111,4 @@ config/
 examples/
 Dockerfile
 .git/
-tests/
-.?*
+tests/build/

.flake8

@@ -1,42 +0,0 @@
-[flake8]
-max-line-length = 120
-# Following 4 for black compatibility
-# E501: line too long
-# W503: Line break occurred before a binary operator
-# E203: Whitespace before ':'
-# D202 No blank lines allowed after function docstring
-
-# TODO fix flake8
-# D100 Missing docstring in public module
-# D101 Missing docstring in public class
-# D102 Missing docstring in public method
-# D103 Missing docstring in public function
-# D104 Missing docstring in public package
-# D105 Missing docstring in magic method
-# D107 Missing docstring in __init__
-# D200 One-line docstring should fit on one line with quotes
-# D205 1 blank line required between summary line and description
-# D209 Multi-line docstring closing quotes should be on a separate line
-# D400 First line should end with a period
-# D401 First line should be in imperative mood
-
-ignore =
-  E501,
-  W503,
-  E203,
-  D202,
-
-  D100,
-  D101,
-  D102,
-  D103,
-  D104,
-  D105,
-  D107,
-  D200,
-  D205,
-  D209,
-  D400,
-  D401,
-
-exclude = api_pb2.py

.gitattributes

@@ -1,5 +1,3 @@
 # Normalize line endings to LF in the repository
 * text eol=lf
 *.png binary
-*.gif binary
-*.apng binary

.github/FUNDING.yml

@@ -0,0 +1,4 @@
+---
+# These are supported funding model platforms
+
+custom: https://www.nabucasa.com

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,115 +0,0 @@
-name: Report an issue with ESPHome
-description: Report an issue with ESPHome.
-body:
-  - type: markdown
-    attributes:
-      value: |
-        This issue form is for reporting bugs only!
-
-        If you have a feature request or enhancement, please [request them here instead][fr].
-
-        [fr]: https://github.com/orgs/esphome/discussions
-  - type: markdown
-    attributes:
-      value: |
-        ## Use of AI in bug reports
-
-        AI tools are good at carrying out well-defined tasks, but they are not good at troubleshooting.
-        Please do NOT paste an AI-generated wall of text into the issue template - if the AI hasn't solved
-        your problem, its wild guesses are not likely to help.
-
-        Please DO include your own words and observations, compile/boot logs, and
-        especially a minimal reproducible example of your YAML configuration that demonstrates the problem.
-
-        It is however quite acceptable to use AI to translate your *own* report,
-        if you aren't a competent English speaker.
-
-        If you really think it will be useful to include an AI's analysis, preferably wrap it in a `<details>` block which will be collapsed by default.
-
-        If you are using AI to help solve a problem, rather than asking it to speculate about what the problem is,
-        it can be more useful to ask it to create a step-by-step troubleshooting procedure.
-        AI is also useful for generating boilerplate code, such as a minimal reproducible example of your YAML
-        configuration that demonstrates the problem.
-
-        Used properly, AI can be a useful tool to help you solve your problem, but don't let it get in the way.
-  - type: textarea
-    validations:
-      required: true
-    id: problem
-    attributes:
-      label: The problem
-      description: >-
-        Describe the issue you are experiencing here to communicate to the
-        maintainers. Tell us what you were trying to do and what happened.
-
-        Provide a clear and concise description of what the problem is.
-
-  - type: markdown
-    attributes:
-      value: |
-        ## Environment
-  - type: input
-    id: version
-    validations:
-      required: true
-    attributes:
-      label: Which version of ESPHome has the issue?
-      description: >
-        ESPHome version like 1.19, 2025.6.0 or 2025.XX.X-dev.
-  - type: dropdown
-    validations:
-      required: true
-    id: installation
-    attributes:
-      label: What type of installation are you using?
-      options:
-        - Home Assistant Add-on
-        - Docker
-        - pip
-  - type: dropdown
-    validations:
-      required: true
-    id: platform
-    attributes:
-      label: What platform are you using?
-      options:
-        - ESP8266
-        - ESP32
-        - RP2040
-        - BK72XX
-        - RTL87XX
-        - LN882X
-        - Host
-        - Other
-  - type: input
-    id: component_name
-    attributes:
-      label: Component causing the issue
-      description: >
-        The name of the component or platform. For example, api/i2c or ultrasonic.
-
-  - type: markdown
-    attributes:
-      value: |
-        # Details
-  - type: textarea
-    id: config
-    attributes:
-      label: YAML Config
-      description: |
-        Include a complete YAML configuration file demonstrating the problem here. Preferably post the *entire* file - don't make assumptions about what is unimportant. However, if it's a large or complicated config then you will need to reduce it to the smallest possible file *that still demonstrates the problem*. If you don't provide enough information to *easily* reproduce the problem, it's unlikely your bug report will get any attention. Logs do not belong here, attach them below.
-      render: yaml
-  - type: textarea
-    id: logs
-    attributes:
-      label: Anything in the logs that might be useful for us?
-      description: For example, error message, or stack traces. Serial or USB logs are much more useful than WiFi logs.
-      render: txt
-  - type: textarea
-    id: additional
-    attributes:
-      label: Additional information
-      description: >
-        If you have any additional information for us, use the field below.
-        Please note, you can attach screenshots or screen recordings here, by
-        dragging and dropping files in the field below.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,21 +1,15 @@
 ---
 blank_issues_enabled: false
 contact_links:
-  - name: Report an issue with the ESPHome documentation
-    url: https://github.com/esphome/esphome.io/issues/new/choose
-    about: Report an issue with the ESPHome documentation.
-  - name: Report an issue with the ESPHome web server
-    url: https://github.com/esphome/esphome-webserver/issues/new/choose
-    about: Report an issue with the ESPHome web server.
-  - name: Report an issue with the ESPHome Builder / Dashboard
-    url: https://github.com/esphome/device-builder/issues/new/choose
-    about: Report an issue with the ESPHome Builder / Dashboard.
-  - name: Report an issue with the ESPHome API client
-    url: https://github.com/esphome/aioesphomeapi/issues/new/choose
-    about: Report an issue with the ESPHome API client.
-  - name: Make a Feature Request
-    url: https://github.com/orgs/esphome/discussions
-    about: Please create feature requests in the dedicated feature request tracker.
+  - name: Issue Tracker
+    url: https://github.com/esphome/issues
+    about: Please create bug reports in the dedicated issue tracker.
+  - name: Feature Request Tracker
+    url: https://github.com/esphome/feature-requests
+    about: |
+      Please create feature requests in the dedicated feature request tracker.
   - name: Frequently Asked Question
     url: https://esphome.io/guides/faq.html
-    about: Please view the FAQ for common questions and what to include in a bug report.
+    about: |
+      Please view the FAQ for common questions and what
+      to include in a bug report.

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,37 +6,27 @@
 
 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
-- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — [policy](https://developers.esphome.io/contributing/code/#what-constitutes-a-c-breaking-change)
-- [ ] Developer breaking change (an API change that could break external components) — [policy](https://developers.esphome.io/contributing/code/#what-is-considered-public-c-api)
-- [ ] Undocumented C++ API change (removal or change of undocumented public methods that lambda users may depend on) — [policy](https://developers.esphome.io/contributing/code/#c-user-expectations)
-- [ ] Code quality improvements to existing code or addition of tests
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
 - [ ] Other
 
-**Related issue or feature (if applicable):**
+**Related issue or feature (if applicable):** fixes <link to issue>
 
-- fixes <link to issue>
-
-**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**
-
-- esphome/esphome.io#<esphome.io PR number goes here>
-
-**Pull request in [developers.esphome.io](https://github.com/esphome/developers.esphome.io) with developer documentation (if applicable):**
-
-- esphome/developers.esphome.io#<developers.esphome.io PR number goes here>
+**Pull request in [esphome-docs](https://github.com/esphome/esphome-docs) with documentation (if applicable):** esphome/esphome-docs#<esphome-docs PR number goes here>
 
 ## Test Environment
 
 - [ ] ESP32
 - [ ] ESP32 IDF
 - [ ] ESP8266
-- [ ] RP2040/RP2350
-- [ ] BK72xx
-- [ ] RTL87xx
-- [ ] LN882x
-- [ ] nRF52840
+- [ ] RP2040
 
 ## Example entry for `config.yaml`:
+<!--
+  Supplying a configuration snippet, makes it easier for a maintainer to test
+  your PR. Furthermore, for new integrations, it gives an impression of how
+  the configuration would look like.
+  Note: Remove this section if this PR does not have an example entry.
+-->
 
 ```yaml
 # Example config.yaml
@@ -48,4 +38,4 @@
   - [ ] Tests have been added to verify that the new code works (under `tests/` folder).
 
 If user exposed functionality or configuration variables are added/changed:
-  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
+  - [ ] Documentation added/updated in [esphome-docs](https://github.com/esphome/esphome-docs).

.github/actions/build-image/action.yaml

@@ -1,91 +0,0 @@
-name: Build Image
-inputs:
-  target:
-    description: "Target to build"
-    required: true
-    example: "docker"
-  build_type:
-    description: "Build type"
-    required: true
-    example: "docker"
-  suffix:
-    description: "Suffix to add to tags"
-    required: true
-  version:
-    description: "Version to build"
-    required: true
-    example: "2023.12.0"
-runs:
-  using: "composite"
-  steps:
-    - name: Generate short tags
-      id: tags
-      shell: bash
-      run: |
-        output=$(docker/generate_tags.py \
-          --tag "${{ inputs.version }}" \
-          --suffix "${{ inputs.suffix }}")
-        echo $output
-        for l in $output; do
-          echo $l >> $GITHUB_OUTPUT
-        done
-
-    # set cache-to only if dev branch
-    - id: cache-to
-      shell: bash
-      run: |-
-        if [[ "${{ github.ref }}" == "refs/heads/dev" ]]; then
-          echo "value=type=gha,mode=max" >> $GITHUB_OUTPUT
-        else
-          echo "value=" >> $GITHUB_OUTPUT
-        fi
-
-    - name: Build and push to ghcr by digest
-      id: build-ghcr
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-      env:
-        DOCKER_BUILD_SUMMARY: false
-        DOCKER_BUILD_RECORD_UPLOAD: false
-      with:
-        context: .
-        file: ./docker/Dockerfile
-        target: ${{ inputs.target }}
-        cache-from: type=gha
-        cache-to: ${{ steps.cache-to.outputs.value }}
-        build-args: |
-          BUILD_TYPE=${{ inputs.build_type }}
-          BUILD_VERSION=${{ inputs.version }}
-        outputs: |
-          type=image,name=ghcr.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
-
-    - name: Export ghcr digests
-      shell: bash
-      run: |
-        mkdir -p /tmp/digests/${{ inputs.build_type }}/ghcr
-        digest="${{ steps.build-ghcr.outputs.digest }}"
-        touch "/tmp/digests/${{ inputs.build_type }}/ghcr/${digest#sha256:}"
-
-    - name: Build and push to dockerhub by digest
-      id: build-dockerhub
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
-      env:
-        DOCKER_BUILD_SUMMARY: false
-        DOCKER_BUILD_RECORD_UPLOAD: false
-      with:
-        context: .
-        file: ./docker/Dockerfile
-        target: ${{ inputs.target }}
-        cache-from: type=gha
-        cache-to: ${{ steps.cache-to.outputs.value }}
-        build-args: |
-          BUILD_TYPE=${{ inputs.build_type }}
-          BUILD_VERSION=${{ inputs.version }}
-        outputs: |
-          type=image,name=docker.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
-
-    - name: Export dockerhub digests
-      shell: bash
-      run: |
-        mkdir -p /tmp/digests/${{ inputs.build_type }}/dockerhub
-        digest="${{ steps.build-dockerhub.outputs.digest }}"
-        touch "/tmp/digests/${{ inputs.build_type }}/dockerhub/${digest#sha256:}"

.github/actions/cache-arduino8266/action.yml

@@ -1,39 +0,0 @@
-name: Cache Arduino ESP8266
-description: >
-  Resolve the pinned Arduino core and xtensa toolchain versions and cache the
-  native ESP8266 install (~110 MB framework + toolchain; no ccache store, the
-  seed job saves before any compile runs). Exports
-  ESPHOME_ARDUINO8266_PREFIX to the job so every later step installs into
-  the cached path; the Python venv must already be restored. Mirrors
-  cache-esp-idf: only dev-branch pushes write the shared cache, everything
-  else restores.
-runs:
-  using: composite
-  steps:
-    - name: Resolve the native toolchain cache key
-      # Versions are pinned in code, not a hashable file; resolve them so a
-      # bump changes the cache key. Assignment form so errexit catches a
-      # resolver failure.
-      id: version
-      shell: bash
-      run: |
-        # One owner for the install prefix: exported here and referenced by
-        # the cache steps below via env, so the caller's install and the
-        # cached path cannot diverge.
-        echo "ESPHOME_ARDUINO8266_PREFIX=$HOME/.esphome-arduino8266" >> "$GITHUB_ENV"
-        . venv/bin/activate
-        key=$(python -c 'from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION as f; from esphome.arduino8266.framework import FRAMEWORK_RELEASES, TOOLCHAIN_VERSION as t; print(f"{FRAMEWORK_RELEASES[f].tag}-{t}")')
-        [ -n "$key" ] || exit 1
-        echo "key=$key" >> "$GITHUB_OUTPUT"
-    - name: Cache the native toolchain (write on dev)
-      if: github.ref == 'refs/heads/dev'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}
-    - name: Restore the native toolchain (off dev)
-      if: github.ref != 'refs/heads/dev'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}

.github/actions/cache-clang-tidy-idedata/action.yml

@@ -1,50 +0,0 @@
-name: Cache clang-tidy idedata
-description: >
-  Cache the clang-tidy idedata and the headers it references under .temp
-  (headers only, about 30MB per env). Run after restore-python and cache-esp-idf.
-inputs:
-  environment:
-    description: 'clang-tidy environment (e.g. esp32-idf-tidy).'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Compute cache key
-      id: key
-      shell: bash
-      run: |
-        . venv/bin/activate
-        [ -n "${{ inputs.environment }}" ] || { echo "::error::cache-clang-tidy-idedata: 'environment' input is empty"; exit 1; }
-        hash=$(python -c 'import sys; sys.path.insert(0, "script"); from clang_tidy_hash import idedata_cache_hash; print(idedata_cache_hash("${{ inputs.environment }}"))')
-        pyver=$(python -c 'import platform; print(platform.python_version())')
-        # Generating idedata is what installs ESP-IDF; never skip it over a missing
-        # install. This also skips the save, so a dev run that installs ESP-IDF
-        # warms the idedata cache on the next run.
-        if [ -d ~/.esphome-idf/frameworks ]; then
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-        else
-          echo "ESP-IDF install missing, not using the clang-tidy idedata cache"
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-        fi
-        echo "key=${{ runner.os }}-tidy-idedata-${{ inputs.environment }}-$hash-py$pyver" >> "$GITHUB_OUTPUT"
-        {
-          echo "path<<EOF"
-          printf '%s\n' '.temp/idedata-*.json' '.temp/idedata-*.hash'
-          printf '.temp/**/*.%s\n' h hpp hh hxx inc inl ipp tpp
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
-    # Mirror cache-esp-idf: write on dev, restore-only on PRs. The post-step
-    # save only runs when the job succeeded, so a failed generation is never saved.
-    # Extend the extension list if a component ships extensionless headers.
-    - name: Cache clang-tidy idedata (write on dev)
-      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && steps.key.outputs.skip != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ steps.key.outputs.path }}
-        key: ${{ steps.key.outputs.key }}
-    - name: Cache clang-tidy idedata (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') && steps.key.outputs.skip != 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ steps.key.outputs.path }}
-        key: ${{ steps.key.outputs.key }}

.github/actions/cache-esp-idf/action.yml

@@ -1,70 +0,0 @@
-name: Cache ESP-IDF
-description: >
-  Resolve the pinned ESP-IDF version and cache the native ESP-IDF install
-  (toolchains + source) at ~/.esphome-idf. Every job that installs ESP-IDF
-  natively (clang-tidy for IDF/Arduino and the component test batches) shares
-  one cache, since the install is identical: ESPHOME_IDF_DEFAULT_TARGETS
-  defaults to "all", and _get_configured_targets() in espidf/toolchain.py
-  skips per-variant narrowing whenever CI is set, so all toolchains are
-  present regardless of the chip a job builds.
-  Callers must set env ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf and have the
-  Python venv already restored.
-inputs:
-  framework:
-    description: 'Which pinned IDF version to key on: "espidf" (recommended) or "arduino".'
-    default: espidf
-  restore-only:
-    description: >
-      When "true", only restore -- never save the cache, even on dev. Use from
-      jobs that may not produce an ESP-IDF install (e.g. a component batch with
-      no esp32 target), so a partial/empty install is never written to the key.
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Resolve ESP-IDF version for cache key
-      # The native-IDF version is pinned in code, not in any file that feeds the
-      # other cache keys, so resolve it explicitly. Keying on it means the cache
-      # invalidates on a version bump (actions/cache never overwrites a key).
-      # Also key on the Python version: the cached IDF venv links to the
-      # runner's toolcache interpreter and is reinstalled every run after a
-      # runner image bump.
-      id: version
-      shell: bash
-      run: |
-        . venv/bin/activate
-        if [ "${{ inputs.framework }}" = "arduino" ]; then
-          version=$(python -c 'from esphome.components.esp32 import ARDUINO_FRAMEWORK_VERSION_LOOKUP as A, ARDUINO_IDF_VERSION_LOOKUP as L; print(L[A["recommended"]])')
-        else
-          version=$(python -c 'from esphome.components.esp32 import ESP_IDF_FRAMEWORK_VERSION_LOOKUP as L; print(L["recommended"])')
-        fi
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-        echo "python-version=$(python -c 'import platform; print(platform.python_version())')" >> "$GITHUB_OUTPUT"
-    # Mirror the adjacent PlatformIO cache: only dev-branch runs write the
-    # shared cache (so it lives in the default-branch scope readable by all
-    # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
-    # their own scope / the repo quota (e.g. on a version-bump PR). The
-    # ci-cache-write label lets a PR write into its own scope to test the hit path;
-    # that costs about 1GB of the repo cache quota per run, so remove it when done.
-    # -slim: bump when prune-esp-idf changes what it removes; a key is never overwritten.
-    - name: Cache ESP-IDF install (write on dev)
-      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && inputs.restore-only != 'true'
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
-    - name: Cache ESP-IDF install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') || inputs.restore-only == 'true'
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
-    # Install explicitly so the prune below sees the toolchains on a cache miss
-    # too, instead of the install happening inside the first build step.
-    - name: Install ESP-IDF
-      shell: bash
-      run: |
-        . venv/bin/activate
-        python -c 'from esphome.espidf.framework import check_esp_idf_install; check_esp_idf_install("${{ steps.version.outputs.version }}")'
-    - name: Prune ESP-IDF install
-      uses: ./.github/actions/prune-esp-idf

.github/actions/cache-sdk-nrf/action.yml

@@ -1,49 +0,0 @@
-name: Cache nRF Connect SDK
-description: >
-  Resolve the pinned sdk-nrf version and cache the native sdk-nrf install
-  (west workspace, Zephyr SDK toolchain, python env) at ~/.esphome-sdk-nrf.
-  Every job that installs sdk-nrf natively (the nrf52 clang-tidy job and,
-  once the component tests build natively, their batches) shares one cache.
-  Callers must set env ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf and have
-  the Python venv already restored.
-inputs:
-  restore-only:
-    description: >
-      When "true", only restore -- never save the cache, even on dev. Use from
-      jobs that may not produce a complete install (e.g. a component batch
-      that fails mid-install), so a partial install is never written.
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Resolve sdk-nrf and toolchain versions for cache key
-      # Both versions are pinned in code, not in any file that feeds the
-      # other cache keys, so resolve them explicitly. Keying on them means
-      # the cache invalidates when either is bumped (actions/cache never
-      # overwrites a key).
-      id: version
-      shell: bash
-      run: |
-        . venv/bin/activate
-        version=$(python -c '
-        from esphome.components.nrf52 import RECOMMENDED_SDK_NRF_VERSION
-        from esphome.components.nrf52.framework import TOOLCHAIN_VERSION
-        print(f"{RECOMMENDED_SDK_NRF_VERSION}-{TOOLCHAIN_VERSION}")')
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-    # Mirror cache-esp-idf: only dev-branch runs write the shared cache (so it
-    # lives in the default-branch scope readable by all PRs); PRs are
-    # restore-only and never push multi-GB artifacts into their own scope.
-    - name: Cache nRF Connect SDK install (write on dev)
-      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}
-    - name: Cache nRF Connect SDK install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}

.github/actions/prune-esp-idf/action.yml

@@ -1,34 +0,0 @@
-name: Prune ESP-IDF install
-description: >
-  Remove the picolibc sysroots (1.1GB of the 3.9GB install) from the native
-  ESP-IDF toolchains; IDF 5.x links newlib. Skipped when an IDF 6 install is
-  present, which links picolibc (see esp32/__init__.py).
-runs:
-  using: composite
-  steps:
-    - name: Prune picolibc
-      shell: bash
-      run: |
-        shopt -s nullglob
-        prefix="${ESPHOME_ESP_IDF_PREFIX:-$HOME/.esphome-idf}"
-        prefix="${prefix/#\~/$HOME}"
-        for fw in "$prefix"/frameworks/*/; do
-          case "$(basename "$fw")" in
-            [6-9].*) echo "IDF $(basename "$fw") installed, keeping picolibc"; exit 0 ;;
-          esac
-        done
-        n=0
-        for dir in "$prefix"/tools/*-esp-elf/*/*-esp-elf/picolibc; do
-          echo "Removing $dir ($(du -sh "$dir" | cut -f1))"
-          rm -rf "$dir"
-          n=$((n + 1))
-        done
-        # The marker rides along in the cache entry so a restored slim tree stays quiet.
-        if [ "$n" -gt 0 ]; then
-          touch "$prefix/.picolibc-pruned"
-        elif [ -d "$prefix/tools" ] && [ ! -f "$prefix/.picolibc-pruned" ]; then
-          echo "::warning::no picolibc sysroots matched under $prefix/tools"
-        fi
-        if [ -d "$prefix" ]; then
-          du -sh "$prefix"
-        fi

.github/actions/restore-python/action.yml

@@ -17,46 +17,22 @@ runs:
   steps:
     - name: Set up Python ${{ inputs.python-version }}
       id: python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v4.6.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@v3.3.1
       with:
         path: venv
         # yamllint disable-line rule:line-length
         key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ inputs.cache-key }}
-    - name: Set up uv
-      # Only needed on cache miss to populate the venv. ``uv pip install``
-      # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
-      # downstream jobs rely on is preserved.
+    - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-      with:
-        enable-cache: true
-        # Pull request saves land in per-PR scopes nothing else can
-        # reuse; dev pushes seed the shared copy instead.
-        save-cache: ${{ github.event_name != 'pull_request' }}
-        # Pin uv version so the action does not have to fetch the
-        # manifest from raw.githubusercontent.com on every cache
-        # miss; that fetch flakes on Windows runners.
-        version: "0.11.15"
-    - name: Create Python virtual environment
-      if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os != 'Windows'
       shell: bash
       run: |
         python -m venv venv
-        source venv/bin/activate
+        . venv/bin/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
-        uv pip install -e .
-    - name: Create Python virtual environment
-      if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
-      shell: bash
-      run: |
-        python -m venv venv
-        source ./venv/Scripts/activate
-        python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
-        uv pip install -e .
+        pip install -r requirements.txt -r requirements_optional.txt -r requirements_test.txt
+        pip install -e .

.github/copilot-instructions.md

@@ -1 +0,0 @@
-../AGENTS.md

.github/dependabot.yml

@@ -5,37 +5,11 @@ updates:
     directory: "/"
     schedule:
       interval: daily
-    open-pull-requests-limit: 10
     ignore:
       # Hypotehsis is only used for testing and is updated quite often
       - dependency-name: hypothesis
   - package-ecosystem: github-actions
-    labels:
-      - "dependencies"
-      - "github-actions"
     directory: "/"
     schedule:
       interval: daily
     open-pull-requests-limit: 10
-    groups:
-      docker-actions:
-        applies-to: version-updates
-        patterns:
-          - "docker/login-action"
-          - "docker/setup-buildx-action"
-  - package-ecosystem: github-actions
-    labels:
-      - "dependencies"
-      - "github-actions"
-    directory: "/.github/actions/build-image"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10
-  - package-ecosystem: github-actions
-    labels:
-      - "dependencies"
-      - "github-actions"
-    directory: "/.github/actions/restore-python"
-    schedule:
-      interval: daily
-    open-pull-requests-limit: 10

.github/scripts/auto-label-pr/constants.js

@@ -1,59 +0,0 @@
-// Constants and markers for PR auto-labeling
-module.exports = {
-  BOT_COMMENT_MARKER: '<!-- auto-label-pr-bot -->',
-  CODEOWNERS_MARKER: '<!-- codeowners-request -->',
-  TOO_BIG_MARKER: '<!-- too-big-request -->',
-  DEPRECATED_COMPONENT_MARKER: '<!-- deprecated-component-request -->',
-  ORG_FORK_MARKER: '<!-- maintainer-access-warning -->',
-
-  MANAGED_LABELS: [
-    'new-component',
-    'new-platform',
-    'new-target-platform',
-    'merging-to-release',
-    'merging-to-beta',
-    'chained-pr',
-    'stacked-pr',
-    'core',
-    'small-pr',
-    'medium-pr',
-    'dashboard',
-    'github-actions',
-    'by-code-owner',
-    'has-tests',
-    'needs-tests',
-    'needs-docs',
-    'needs-developer-docs',
-    'needs-codeowners',
-    'too-big',
-    'labeller-recheck',
-    'bugfix',
-    'new-feature',
-    'new-feature-developer',
-    'breaking-change',
-    'developer-breaking-change',
-    'undocumented-api-change',
-    'code-quality',
-    'deprecated-component'
-  ],
-
-  DOCS_PR_PATTERNS: [
-    /https:\/\/github\.com\/esphome\/esphome\.io\/pull\/\d+/,
-    /esphome\/esphome\.io#\d+/,
-    // Keep matching the old esphome-docs name during the transition period
-    /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
-    /esphome\/esphome-docs#\d+/
-  ],
-
-  DEVELOPER_DOCS_PR_PATTERNS: [
-    /https:\/\/github\.com\/esphome\/developers\.esphome\.io\/pull\/\d+/,
-    /esphome\/developers\.esphome\.io#\d+/
-  ],
-
-  // Files whose developer-facing changes are documented via Python docstrings
-  // only - developers.esphome.io has no reference page for them yet, so PRs
-  // touching nothing but these files (and tests/) skip needs-developer-docs.
-  DEV_DOCS_EXEMPT_FILES: [
-    'esphome/config_validation.py'
-  ]
-};

.github/scripts/auto-label-pr/detectors.js

@@ -1,467 +0,0 @@
-const { DOCS_PR_PATTERNS, DEVELOPER_DOCS_PR_PATTERNS, DEV_DOCS_EXEMPT_FILES } = require('./constants');
-const {
-  COMPONENT_REGEX,
-  detectComponents,
-  hasCoreChanges,
-  hasDashboardChanges,
-  hasGitHubActionsChanges,
-} = require('../detect-tags');
-const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
-
-// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
-// Ruff/Black enforce exactly one space around `=` and no space before `:`,
-// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
-const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
-
-// Fetch a file's contents from the PR head SHA via the GitHub API.
-// The auto-label workflow runs on `pull_request_target`, which checks out the
-// base branch — files added by the PR don't exist in the workspace, so we have
-// to fetch them from the head SHA. Returns null if the file can't be fetched.
-async function fetchPrFileContent(github, context, path) {
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.repos.getContent({
-      owner,
-      repo,
-      path,
-      ref: context.payload.pull_request.head.sha,
-    });
-    return Buffer.from(data.content, 'base64').toString('utf8');
-  } catch (error) {
-    console.log(`Failed to fetch ${path} from PR head:`, error.message);
-    return null;
-  }
-}
-
-// Check whether a pull request is part of a GitHub stack.
-//
-// GitHub's stacked pull request feature adds a `stack` object to the pull
-// request resource. It is present on every pull request in the stack -
-// including the bottom one, whose base is already `dev` - and is absent
-// entirely on standalone pull requests.
-//
-// The `pull_request_target` webhook payload is not guaranteed to carry this
-// field, so fall back to asking the API when it is missing. Guessing wrong
-// here is costly: a stacked pull request mistaken for a manually chained one
-// gets a label that blocks merging.
-async function isStackedPr(github, context) {
-  const pr = context.payload.pull_request;
-  if (pr.stack != null) {
-    return true;
-  }
-
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.pulls.get({
-      owner,
-      repo,
-      pull_number: pr.number,
-    });
-    return data.stack != null;
-  } catch (error) {
-    // Treat an API failure as "not stacked" so a chained pull request still
-    // gets its blocking label rather than silently slipping through.
-    console.log('Failed to check stack membership:', error.message);
-    return false;
-  }
-}
-
-// Strategy: Merge branch detection
-async function detectMergeBranch(github, context) {
-  const labels = new Set();
-  const baseRef = context.payload.pull_request.base.ref;
-  const defaultBranch = context.payload.repository.default_branch;
-
-  if (baseRef === 'release') {
-    labels.add('merging-to-release');
-  } else if (baseRef === 'beta') {
-    labels.add('merging-to-beta');
-  } else if (await isStackedPr(github, context)) {
-    // GitHub manages the merge order for a stack, so these are not blocked.
-    labels.add('stacked-pr');
-  } else if (baseRef !== defaultBranch) {
-    // A chain built by hand: it must not merge until its base branch does.
-    labels.add('chained-pr');
-  }
-
-  return labels;
-}
-
-// Strategy: Component and platform labeling
-async function detectComponentPlatforms(changedFiles, apiData) {
-  const labels = new Set();
-  const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
-
-  for (const comp of detectComponents(changedFiles)) {
-    labels.add(`component: ${comp}`);
-  }
-
-  for (const file of changedFiles) {
-    const platformMatch = file.match(targetPlatformRegex);
-    if (platformMatch) {
-      labels.add(`platform: ${platformMatch[1]}`);
-    }
-  }
-
-  return labels;
-}
-
-// Strategy: New component detection
-async function detectNewComponents(github, context, prFiles) {
-  const labels = new Set();
-  let hasYamlLoadable = false;
-  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-  for (const file of addedFiles) {
-    const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
-    if (!componentMatch) continue;
-
-    labels.add('new-component');
-    const content = await fetchPrFileContent(github, context, file);
-    if (content === null) {
-      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-      hasYamlLoadable = true;
-      continue;
-    }
-    if (content.includes('IS_TARGET_PLATFORM = True')) {
-      labels.add('new-target-platform');
-    }
-    if (CONFIG_SCHEMA_REGEX.test(content)) {
-      hasYamlLoadable = true;
-    }
-  }
-
-  return { labels, hasYamlLoadable };
-}
-
-// Strategy: New platform detection
-async function detectNewPlatforms(github, context, prFiles, apiData) {
-  const labels = new Set();
-  let hasYamlLoadable = false;
-  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-  const platformPathPatterns = [
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
-  ];
-
-  const removedFiles = new Set(prFiles.filter(file => file.status === 'removed').map(file => file.filename));
-
-  for (const file of addedFiles) {
-    for (const re of platformPathPatterns) {
-      const match = file.match(re);
-      if (!match) continue;
-      const platform = match[2];
-      if (!apiData.platformComponents.includes(platform)) break;
-
-      // Skip if this is a restructure between flat and subdirectory forms (either direction):
-      //   <component>/<platform>.py  <->  <component>/<platform>/__init__.py
-      const flatEquivalent = `esphome/components/${match[1]}/${platform}.py`;
-      const subdirEquivalent = `esphome/components/${match[1]}/${platform}/__init__.py`;
-      if (removedFiles.has(flatEquivalent) || removedFiles.has(subdirEquivalent)) break;
-
-      labels.add('new-platform');
-      const content = await fetchPrFileContent(github, context, file);
-      if (content === null) {
-        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-        hasYamlLoadable = true;
-      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
-        hasYamlLoadable = true;
-      }
-      break;
-    }
-  }
-
-  return { labels, hasYamlLoadable };
-}
-
-// Strategy: Core files detection
-async function detectCoreChanges(changedFiles) {
-  const labels = new Set();
-  if (hasCoreChanges(changedFiles)) {
-    labels.add('core');
-  }
-  return labels;
-}
-
-// Strategy: PR size detection
-async function detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD) {
-  const labels = new Set();
-
-  const testAdditions = prFiles
-    .filter(file => file.filename.startsWith('tests/'))
-    .reduce((sum, file) => sum + (file.additions || 0), 0);
-  const testDeletions = prFiles
-    .filter(file => file.filename.startsWith('tests/'))
-    .reduce((sum, file) => sum + (file.deletions || 0), 0);
-
-  const nonTestAdditions = totalAdditions - testAdditions;
-  const nonTestDeletions = totalDeletions - testDeletions;
-
-  // small/medium count churn (additions + deletions) so a balanced refactor isn't undersized.
-  const nonTestChurn = nonTestAdditions + nonTestDeletions;
-
-  if (nonTestChurn <= SMALL_PR_THRESHOLD) {
-    labels.add('small-pr');
-    return labels;
-  }
-
-  if (nonTestChurn <= MEDIUM_PR_THRESHOLD) {
-    labels.add('medium-pr');
-    return labels;
-  }
-
-  // too-big uses net line delta (additions - deletions), matching the review message in reviews.js.
-  const nonTestChanges = nonTestAdditions - nonTestDeletions;
-
-  // Don't add too-big if mega-pr label is already present
-  if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
-    labels.add('too-big');
-  }
-
-  return labels;
-}
-
-// Strategy: Dashboard changes
-async function detectDashboardChanges(changedFiles) {
-  const labels = new Set();
-  if (hasDashboardChanges(changedFiles)) {
-    labels.add('dashboard');
-  }
-  return labels;
-}
-
-// Strategy: GitHub Actions changes
-async function detectGitHubActionsChanges(changedFiles) {
-  const labels = new Set();
-  if (hasGitHubActionsChanges(changedFiles)) {
-    labels.add('github-actions');
-  }
-  return labels;
-}
-
-// Strategy: Code owner detection
-async function detectCodeOwner(github, context, changedFiles) {
-  const labels = new Set();
-
-  try {
-    const codeownersPatterns = loadCodeowners();
-    const prAuthor = context.payload.pull_request.user.login;
-
-    // Check if PR author is a codeowner of any changed file
-    const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-    if (effective.users.has(prAuthor)) {
-      labels.add('by-code-owner');
-    }
-  } catch (error) {
-    console.log('Failed to read or parse CODEOWNERS file:', error.message);
-  }
-
-  return labels;
-}
-
-// Strategy: Test detection
-async function detectTests(changedFiles) {
-  const labels = new Set();
-  const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
-
-  if (testFiles.length > 0) {
-    labels.add('has-tests');
-  }
-
-  return labels;
-}
-
-// Strategy: PR Template Checkbox detection
-async function detectPRTemplateCheckboxes(context) {
-  const labels = new Set();
-  const prBody = context.payload.pull_request.body || '';
-
-  console.log('Checking PR template checkboxes...');
-
-  // Check for checked checkboxes in the "Types of changes" section
-  const checkboxPatterns = [
-    { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
-    { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
-    { pattern: /- \[x\] New developer-facing feature \(adds functionality for component developers; no end-user configuration change\)/i, label: 'new-feature-developer' },
-    { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
-    { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
-    { pattern: /- \[x\] Undocumented C\+\+ API change \(removal or change of undocumented public methods that lambda users may depend on\)/i, label: 'undocumented-api-change' },
-    { pattern: /- \[x\] Code quality improvements to existing code or addition of tests/i, label: 'code-quality' }
-  ];
-
-  for (const { pattern, label } of checkboxPatterns) {
-    if (pattern.test(prBody)) {
-      console.log(`Found checked checkbox for: ${label}`);
-      labels.add(label);
-    }
-  }
-
-  return labels;
-}
-
-// Strategy: Deprecated component detection
-async function detectDeprecatedComponents(github, context, changedFiles) {
-  const labels = new Set();
-  const deprecatedInfo = [];
-  const { owner, repo } = context.repo;
-
-  // Compile regex once for better performance
-  const componentFileRegex = COMPONENT_REGEX;
-
-  // Get files that are modified or added in components directory
-  const componentFiles = changedFiles.filter(file => componentFileRegex.test(file));
-
-  if (componentFiles.length === 0) {
-    return { labels, deprecatedInfo };
-  }
-
-  // Extract unique component names using the same regex
-  const components = new Set();
-  for (const file of componentFiles) {
-    const match = file.match(componentFileRegex);
-    if (match) {
-      components.add(match[1]);
-    }
-  }
-
-  // Get base branch ref to check if deprecation already exists for the component
-  // This prevents flagging a PR that simply adds deprecation
-  const baseRef = context.payload.pull_request.base.ref;
-
-  // Check each component's __init__.py for DEPRECATED_COMPONENT constant
-  for (const component of components) {
-    const initFile = `esphome/components/${component}/__init__.py`;
-    try {
-      // Fetch file content from base branch using GitHub API
-      const { data: fileData } = await github.rest.repos.getContent({
-        owner,
-        repo,
-        path: initFile,
-        ref: baseRef
-      });
-
-      // Decode base64 content
-      const content = Buffer.from(fileData.content, 'base64').toString('utf8');
-
-      // Look for DEPRECATED_COMPONENT = "message" or DEPRECATED_COMPONENT = 'message'
-      // Support single quotes, double quotes, and triple quotes (for multiline)
-      const doubleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*"""([\s\S]*?)"""/s) ||
-                              content.match(/DEPRECATED_COMPONENT\s*=\s*"((?:[^"\\]|\\.)*)"/);
-      const singleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*'''([\s\S]*?)'''/s) ||
-                              content.match(/DEPRECATED_COMPONENT\s*=\s*'((?:[^'\\]|\\.)*)'/);
-      const deprecatedMatch = doubleQuoteMatch || singleQuoteMatch;
-
-      if (deprecatedMatch) {
-        labels.add('deprecated-component');
-        deprecatedInfo.push({
-          component: component,
-          message: deprecatedMatch[1].trim()
-        });
-        console.log(`Found deprecated component: ${component}`);
-      }
-    } catch (error) {
-      // Only log if it's not a simple "file not found" error (404)
-      if (error.status !== 404) {
-        console.log(`Error reading ${initFile}:`, error.message);
-      }
-    }
-  }
-
-  return { labels, deprecatedInfo };
-}
-
-// Strategy: Detect when maintainers cannot modify the PR branch
-function detectMaintainerAccess(context) {
-  const pr = context.payload.pull_request;
-
-  // Only relevant for cross-repo PRs (forks)
-  if (!pr.head.repo || pr.head.repo.full_name === pr.base.repo.full_name) {
-    return null;
-  }
-
-  if (pr.maintainer_can_modify) {
-    return null;
-  }
-
-  const isOrgFork = pr.head.repo.owner.type === 'Organization';
-  console.log(`Maintainer cannot modify PR branch (${isOrgFork ? 'org fork: ' + pr.head.repo.owner.login : 'user disabled'})`);
-  return { isOrgFork, orgName: pr.head.repo.owner.login };
-}
-
-// Strategy: Requirements detection
-async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
-  const labels = new Set();
-
-  // Check for missing tests
-  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature') || allLabels.has('new-feature-developer')) && !allLabels.has('has-tests')) {
-    labels.add('needs-tests');
-  }
-
-  // Check for missing docs.
-  // `new-feature` (PR-body checkbox) always counts. `new-feature-developer` is
-  // deliberately excluded here: its docs live on developers.esphome.io and are
-  // checked separately below. `new-component` / `new-platform`
-  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
-  // i.e. the new component/platform is actually loadable from YAML.
-  const docsEligible =
-    allLabels.has('new-feature') ||
-    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
-
-  if (docsEligible) {
-    const prBody = context.payload.pull_request.body || '';
-    const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-    if (!hasDocsLink) {
-      labels.add('needs-docs');
-    }
-  }
-
-  // Check for missing developer docs. `new-feature-developer` requires a
-  // developers.esphome.io PR link, unless every changed file outside tests/ is
-  // in DEV_DOCS_EXEMPT_FILES (core validators documented via docstrings only).
-  if (allLabels.has('new-feature-developer')) {
-    const prBody = context.payload.pull_request.body || '';
-    const nonTestFiles = prFiles
-      .map(file => file.filename)
-      .filter(file => !file.startsWith('tests/'));
-    const onlyExemptFiles = nonTestFiles.every(file => DEV_DOCS_EXEMPT_FILES.includes(file));
-    const hasDevDocsLink = DEVELOPER_DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-    if (!onlyExemptFiles && !hasDevDocsLink) {
-      labels.add('needs-developer-docs');
-    }
-  }
-
-  // Check for missing CODEOWNERS
-  if (allLabels.has('new-component')) {
-    const codeownersModified = prFiles.some(file =>
-      file.filename === 'CODEOWNERS' &&
-      (file.status === 'modified' || file.status === 'added') &&
-      (file.additions || 0) > 0
-    );
-
-    if (!codeownersModified) {
-      labels.add('needs-codeowners');
-    }
-  }
-
-  return labels;
-}
-
-module.exports = {
-  detectMergeBranch,
-  detectComponentPlatforms,
-  detectNewComponents,
-  detectNewPlatforms,
-  detectCoreChanges,
-  detectPRSize,
-  detectDashboardChanges,
-  detectGitHubActionsChanges,
-  detectCodeOwner,
-  detectTests,
-  detectPRTemplateCheckboxes,
-  detectDeprecatedComponents,
-  detectMaintainerAccess,
-  detectRequirements
-};

.github/scripts/auto-label-pr/index.js

@@ -1,201 +0,0 @@
-const { MANAGED_LABELS } = require('./constants');
-const {
-  detectMergeBranch,
-  detectComponentPlatforms,
-  detectNewComponents,
-  detectNewPlatforms,
-  detectCoreChanges,
-  detectPRSize,
-  detectDashboardChanges,
-  detectGitHubActionsChanges,
-  detectCodeOwner,
-  detectTests,
-  detectPRTemplateCheckboxes,
-  detectDeprecatedComponents,
-  detectMaintainerAccess,
-  detectRequirements
-} = require('./detectors');
-const { handleReviews, handleMaintainerAccessComment } = require('./reviews');
-const { applyLabels, removeOldLabels } = require('./labels');
-
-// Fetch API data
-async function fetchApiData() {
-  try {
-    const response = await fetch('https://data.esphome.io/components.json');
-    const componentsData = await response.json();
-    return {
-      targetPlatforms: componentsData.target_platforms || [],
-      platformComponents: componentsData.platform_components || []
-    };
-  } catch (error) {
-    console.log('Failed to fetch components data from API:', error.message);
-    return { targetPlatforms: [], platformComponents: [] };
-  }
-}
-
-module.exports = async ({ github, context }) => {
-  // Environment variables
-  const SMALL_PR_THRESHOLD = parseInt(process.env.SMALL_PR_THRESHOLD);
-  const MEDIUM_PR_THRESHOLD = parseInt(process.env.MEDIUM_PR_THRESHOLD);
-  const MAX_LABELS = parseInt(process.env.MAX_LABELS);
-  const TOO_BIG_THRESHOLD = parseInt(process.env.TOO_BIG_THRESHOLD);
-  const COMPONENT_LABEL_THRESHOLD = parseInt(process.env.COMPONENT_LABEL_THRESHOLD);
-
-  // Global state
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  // Get current labels and PR data
-  const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
-    owner,
-    repo,
-    issue_number: pr_number
-  });
-  const currentLabels = currentLabelsData.map(label => label.name);
-  const managedLabels = currentLabels.filter(label =>
-    label.startsWith('component: ') || label.startsWith('platform: ') || MANAGED_LABELS.includes(label)
-  );
-
-  // Check for mega-PR early - if present, skip most automatic labeling
-  const isMegaPR = currentLabels.includes('mega-pr');
-
-  // Get all PR files with automatic pagination
-  const prFiles = await github.paginate(
-    github.rest.pulls.listFiles,
-    {
-      owner,
-      repo,
-      pull_number: pr_number
-    }
-  );
-
-  // Calculate data from PR files
-  const changedFiles = prFiles.map(file => file.filename);
-  const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
-  const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
-  const totalChanges = totalAdditions + totalDeletions;
-
-  console.log('Current labels:', currentLabels.join(', '));
-  console.log('Changed files:', changedFiles.length);
-  console.log('Total changes:', totalChanges);
-  if (isMegaPR) {
-    console.log('Mega-PR detected - applying limited labeling logic');
-  }
-
-  // Fetch API data
-  const apiData = await fetchApiData();
-  const baseRef = context.payload.pull_request.base.ref;
-
-  // Early exit for release and beta branches only
-  if (baseRef === 'release' || baseRef === 'beta') {
-    const branchLabels = await detectMergeBranch(github, context);
-    const finalLabels = Array.from(branchLabels);
-
-    console.log('Computed labels (merge branch only):', finalLabels.join(', '));
-
-    // Apply labels
-    await applyLabels(github, context, finalLabels);
-
-    // Remove old managed labels
-    await removeOldLabels(github, context, managedLabels, finalLabels);
-
-    return;
-  }
-
-  // Run all strategies
-  const [
-    branchLabels,
-    componentLabels,
-    newComponentResult,
-    newPlatformResult,
-    coreLabels,
-    sizeLabels,
-    dashboardLabels,
-    actionsLabels,
-    codeOwnerLabels,
-    testLabels,
-    checkboxLabels,
-    deprecatedResult,
-    maintainerAccess
-  ] = await Promise.all([
-    detectMergeBranch(github, context),
-    detectComponentPlatforms(changedFiles, apiData),
-    detectNewComponents(github, context, prFiles),
-    detectNewPlatforms(github, context, prFiles, apiData),
-    detectCoreChanges(changedFiles),
-    detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
-    detectDashboardChanges(changedFiles),
-    detectGitHubActionsChanges(changedFiles),
-    detectCodeOwner(github, context, changedFiles),
-    detectTests(changedFiles),
-    detectPRTemplateCheckboxes(context),
-    detectDeprecatedComponents(github, context, changedFiles),
-    detectMaintainerAccess(context)
-  ]);
-
-  // Extract new-component / new-platform results
-  const newComponentLabels = newComponentResult.labels;
-  const newPlatformLabels = newPlatformResult.labels;
-  // Eligible for needs-docs only if any newly added component or platform file
-  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
-  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
-
-  // Extract deprecated component info
-  const deprecatedLabels = deprecatedResult.labels;
-  const deprecatedInfo = deprecatedResult.deprecatedInfo;
-
-  // Combine all labels
-  const allLabels = new Set([
-    ...branchLabels,
-    ...componentLabels,
-    ...newComponentLabels,
-    ...newPlatformLabels,
-    ...coreLabels,
-    ...sizeLabels,
-    ...dashboardLabels,
-    ...actionsLabels,
-    ...codeOwnerLabels,
-    ...testLabels,
-    ...checkboxLabels,
-    ...deprecatedLabels
-  ]);
-
-  // Detect requirements based on all other labels
-  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
-  for (const label of requirementLabels) {
-    allLabels.add(label);
-  }
-
-  let finalLabels = Array.from(allLabels);
-
-  // For mega-PRs, exclude component labels if there are too many
-  if (isMegaPR) {
-    const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
-    if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
-      finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
-      console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
-    }
-  }
-
-  // Handle too many labels (only for non-mega PRs)
-  const tooManyLabels = finalLabels.length > MAX_LABELS;
-  const originalLabelCount = finalLabels.length;
-
-  if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
-    finalLabels = ['too-big'];
-  }
-
-  console.log('Computed labels:', finalLabels.join(', '));
-
-  // Handle reviews and org fork comment
-  await Promise.all([
-    handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD),
-    handleMaintainerAccessComment(github, context, maintainerAccess)
-  ]);
-
-  // Apply labels
-  await applyLabels(github, context, finalLabels);
-
-  // Remove old managed labels
-  await removeOldLabels(github, context, managedLabels, finalLabels);
-};

.github/scripts/auto-label-pr/labels.js

@@ -1,41 +0,0 @@
-// Apply labels to PR
-async function applyLabels(github, context, finalLabels) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  if (finalLabels.length > 0) {
-    console.log(`Adding labels: ${finalLabels.join(', ')}`);
-    await github.rest.issues.addLabels({
-      owner,
-      repo,
-      issue_number: pr_number,
-      labels: finalLabels
-    });
-  }
-}
-
-// Remove old managed labels
-async function removeOldLabels(github, context, managedLabels, finalLabels) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
-  for (const label of labelsToRemove) {
-    console.log(`Removing label: ${label}`);
-    try {
-      await github.rest.issues.removeLabel({
-        owner,
-        repo,
-        issue_number: pr_number,
-        name: label
-      });
-    } catch (error) {
-      console.log(`Failed to remove label ${label}:`, error.message);
-    }
-  }
-}
-
-module.exports = {
-  applyLabels,
-  removeOldLabels
-};

.github/scripts/auto-label-pr/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "auto-label-pr",
-  "private": true,
-  "scripts": {
-    "test": "node --test tests/*.test.js"
-  }
-}

.github/scripts/auto-label-pr/reviews.js

@@ -1,235 +0,0 @@
-const {
-  BOT_COMMENT_MARKER,
-  CODEOWNERS_MARKER,
-  TOO_BIG_MARKER,
-  DEPRECATED_COMPONENT_MARKER,
-  ORG_FORK_MARKER
-} = require('./constants');
-
-// Generate review messages
-function generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD) {
-  const messages = [];
-
-  // Deprecated component message
-  if (finalLabels.includes('deprecated-component') && deprecatedInfo && deprecatedInfo.length > 0) {
-    let message = `${DEPRECATED_COMPONENT_MARKER}\n### ⚠️ Deprecated Component\n\n`;
-    message += `Hey there @${prAuthor},\n`;
-    message += `This PR modifies one or more deprecated components. Please be aware:\n\n`;
-
-    for (const info of deprecatedInfo) {
-      message += `#### Component: \`${info.component}\`\n`;
-      message += `${info.message}\n\n`;
-    }
-
-    message += `Consider migrating to the recommended alternative if applicable.`;
-
-    messages.push(message);
-  }
-
-  // Too big message
-  if (finalLabels.includes('too-big')) {
-    const testAdditions = prFiles
-      .filter(file => file.filename.startsWith('tests/'))
-      .reduce((sum, file) => sum + (file.additions || 0), 0);
-    const testDeletions = prFiles
-      .filter(file => file.filename.startsWith('tests/'))
-      .reduce((sum, file) => sum + (file.deletions || 0), 0);
-    const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
-
-    const tooManyLabels = originalLabelCount > MAX_LABELS;
-    const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
-
-    let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
-
-    message +=
-      `Hey @${prAuthor}, thanks for the contribution. This PR is on the ` +
-      `large side `;
-
-    if (tooManyLabels && tooManyChanges) {
-      message +=
-        `(${nonTestChanges} line changes excluding tests, across ` +
-        `${originalLabelCount} different components/areas)`;
-    } else if (tooManyLabels) {
-      message +=
-        `(it touches ${originalLabelCount} different components/areas)`;
-    } else {
-      message += `(${nonTestChanges} line changes excluding tests)`;
-    }
-
-    message += `, which makes it harder for maintainers to review.\n\n`;
-    let condition;
-    if (tooManyLabels && tooManyChanges) {
-      condition =
-        `is at most ${TOO_BIG_THRESHOLD} lines (excluding tests) and touches ` +
-        `at most ${MAX_LABELS} components/areas`;
-    } else if (tooManyLabels) {
-      condition = `touches at most ${MAX_LABELS} components/areas`;
-    } else {
-      condition = `is at most ${TOO_BIG_THRESHOLD} lines (excluding tests)`;
-    }
-    message +=
-      `**This PR will not be reviewed until it ${condition}.** We know ` +
-      `that is not what you want to hear after this much work, and we want ` +
-      `to be upfront so you do not wait for a review that is not coming: ` +
-      `please split the change. The label is removed automatically once ` +
-      `the PR ${condition}.\n\n`;
-    message +=
-      `There is no exception you can request. Rarely, a maintainer agrees in ` +
-      `\`#devs\` on [Discord](https://esphome.io/chat) to review a change that ` +
-      `genuinely cannot be split as one piece and adds the \`mega-pr\` label, ` +
-      `but that is rare enough that you should plan on splitting rather than ` +
-      `wait for it. Smaller, focused PRs are picked up much faster because ` +
-      `they fit into the short gaps between other maintainer work. For a new ` +
-      `component, the first PR brings the hub and a single platform (for ` +
-      `example \`sensor\`); each further platform is its own PR on top of it.\n\n`;
-    message +=
-      `For more details (including how to split the work up), see: ` +
-      `https://developers.esphome.io/contributing/submitting-your-work/` +
-      `#how-to-approach-large-submissions`;
-
-    messages.push(message);
-  }
-
-  // CODEOWNERS message
-  if (finalLabels.includes('needs-codeowners')) {
-    const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
-      `This way we can notify you if a bug report for this integration is reported.\n\n` +
-      `In \`__init__.py\` of the integration, please add:\n\n` +
-      `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
-      `And run \`script/build_codeowners.py\``;
-
-    messages.push(message);
-  }
-
-  return messages;
-}
-
-// Handle reviews
-async function handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-  const prAuthor = context.payload.pull_request.user.login;
-
-  const reviewMessages = generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD);
-  const hasReviewableLabels = finalLabels.some(label =>
-    ['too-big', 'needs-codeowners', 'deprecated-component'].includes(label)
-  );
-
-  const { data: reviews } = await github.rest.pulls.listReviews({
-    owner,
-    repo,
-    pull_number: pr_number
-  });
-
-  const botReviews = reviews.filter(review =>
-    review.user.type === 'Bot' &&
-    review.state === 'CHANGES_REQUESTED' &&
-    review.body && review.body.includes(BOT_COMMENT_MARKER)
-  );
-
-  if (hasReviewableLabels) {
-    const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
-
-    if (botReviews.length > 0) {
-      // Update existing review
-      await github.rest.pulls.updateReview({
-        owner,
-        repo,
-        pull_number: pr_number,
-        review_id: botReviews[0].id,
-        body: reviewBody
-      });
-      console.log('Updated existing bot review');
-    } else {
-      // Create new review
-      await github.rest.pulls.createReview({
-        owner,
-        repo,
-        pull_number: pr_number,
-        body: reviewBody,
-        event: 'REQUEST_CHANGES'
-      });
-      console.log('Created new bot review');
-    }
-  } else if (botReviews.length > 0) {
-    // Dismiss existing reviews
-    for (const review of botReviews) {
-      try {
-        await github.rest.pulls.dismissReview({
-          owner,
-          repo,
-          pull_number: pr_number,
-          review_id: review.id,
-          message: 'Review dismissed: All requirements have been met'
-        });
-        console.log(`Dismissed bot review ${review.id}`);
-      } catch (error) {
-        console.log(`Failed to dismiss review ${review.id}:`, error.message);
-      }
-    }
-  }
-}
-
-// Handle maintainer access warning comment
-async function handleMaintainerAccessComment(github, context, maintainerAccess) {
-  if (!maintainerAccess) {
-    return;
-  }
-
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-  const prAuthor = context.payload.pull_request.user.login;
-
-  // Check if we already posted the warning (iterate pages to exit early)
-  let existingComment;
-  for await (const { data: comments } of github.paginate.iterator(
-    github.rest.issues.listComments,
-    { owner, repo, issue_number: pr_number }
-  )) {
-    existingComment = comments.find(comment =>
-      comment.user.type === 'Bot' &&
-      comment.body && comment.body.includes(ORG_FORK_MARKER)
-    );
-    if (existingComment) {
-      break;
-    }
-  }
-
-  if (existingComment) {
-    console.log('Maintainer access warning comment already exists, skipping');
-    return;
-  }
-
-  let body;
-  if (maintainerAccess.isOrgFork) {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Organization Fork Detected\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR was submitted from a fork owned by the **${maintainerAccess.orgName}** organization. ` +
-      `GitHub does not allow maintainers to push changes to pull request branches when the fork is owned by an organization. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `To allow maintainer collaboration, please re-submit this PR from a personal fork instead.\n\n` +
-      `See: [Setting up the local repository](https://developers.esphome.io/contributing/development-environment/?h=org#set-up-the-local-repository) for more details.`;
-  } else {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Maintainer Access Disabled\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR does not have the "Allow edits from maintainers" option enabled. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `Please enable this option in the PR sidebar to allow maintainer collaboration.`;
-  }
-
-  await github.rest.issues.createComment({
-    owner,
-    repo,
-    issue_number: pr_number,
-    body
-  });
-  console.log('Created maintainer access warning comment');
-}
-
-module.exports = {
-  generateReviewMessages,
-  handleReviews,
-  handleMaintainerAccessComment
-};

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,466 +0,0 @@
-const { describe, it } = require('node:test');
-const assert = require('node:assert/strict');
-const {
-  detectMergeBranch,
-  detectNewPlatforms,
-  detectNewComponents,
-  detectPRSize,
-  detectPRTemplateCheckboxes,
-  detectRequirements,
-} = require('../detectors');
-const { MANAGED_LABELS } = require('../constants');
-
-// Minimal GitHub API mock — only repos.getContent is called by detectNewPlatforms/detectNewComponents
-// to check for CONFIG_SCHEMA in newly added files.
-function makeGithub(content = '') {
-  return {
-    rest: {
-      repos: {
-        getContent: async () => ({
-          data: { content: Buffer.from(content).toString('base64') }
-        })
-      }
-    }
-  };
-}
-
-const CONTEXT = {
-  repo: { owner: 'esphome', repo: 'esphome' },
-  payload: { pull_request: { head: { sha: 'abc123' }, base: { ref: 'dev' } } }
-};
-
-const API_DATA = {
-  targetPlatforms: ['esp32', 'esp8266', 'rp2040'],
-  platformComponents: ['cover', 'sensor', 'binary_sensor', 'switch', 'light', 'fan', 'climate', 'valve']
-};
-
-const WITH_SCHEMA = 'CONFIG_SCHEMA = cv.Schema({})';
-const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';
-
-// ---------------------------------------------------------------------------
-// detectMergeBranch
-// ---------------------------------------------------------------------------
-
-// Builds a fresh context for detectMergeBranch tests instead of mutating the
-// shared CONTEXT fixture above (which other describe blocks rely on).
-function makeMergeContext(baseRef, { stack, defaultBranch = 'dev' } = {}) {
-  const pull_request = { number: 1, base: { ref: baseRef } };
-  if (stack !== undefined) {
-    pull_request.stack = stack;
-  }
-  return {
-    repo: { owner: 'esphome', repo: 'esphome' },
-    payload: { pull_request, repository: { default_branch: defaultBranch } }
-  };
-}
-
-// A GitHub API mock exposing only rest.pulls.get, with a call counter so
-// tests can assert whether the API fallback was actually invoked.
-function makeStackGithub({ stack = null, error = null } = {}) {
-  const state = { calls: 0 };
-  const github = {
-    rest: {
-      pulls: {
-        get: async () => {
-          state.calls++;
-          if (error) throw error;
-          return { data: { stack } };
-        }
-      }
-    }
-  };
-  return { github, state };
-}
-
-const STACK_INFO = { base: { ref: 'dev' }, id: 71540, number: 17978, position: 3, size: 3 };
-
-describe('detectMergeBranch', () => {
-  it('base ref release adds merging-to-release only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('release', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-release']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('base ref beta adds merging-to-beta only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('beta', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-beta']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack present on the webhook payload adds stacked-pr without calling the API', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('feature-branch', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack absent from payload falls back to the API and adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('bottom of a stack (base ref dev, stack present) still adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('dev', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('not stacked, base ref not dev adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-  it('not stacked, base ref dev adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('a failed stack lookup falls back to not-stacked, so a feature-branch base adds chained-pr', async () => {
-    const { github, state } = makeStackGithub({ error: new Error('API unavailable') });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('base ref matches default branch adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('other', { defaultBranch: 'other' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('base ref dev when the default branch is main adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev', { defaultBranch: 'main' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-});
-
-// ---------------------------------------------------------------------------
-// detectNewPlatforms
-// ---------------------------------------------------------------------------
-
-describe('detectNewPlatforms', () => {
-  describe('restructure detection (no false positives)', () => {
-    it('flat .py -> subdir __init__.py is not a new platform', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/endstop/cover.py', status: 'removed' },
-        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-
-    it('subdir __init__.py -> flat .py is not a new platform', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'removed' },
-        { filename: 'esphome/components/endstop/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-  });
-
-  describe('genuine new platforms', () => {
-    it('new subdir platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover/__init__.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, true);
-    });
-
-    it('new flat platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, true);
-    });
-
-    it('new platform without CONFIG_SCHEMA sets new-platform but not hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, false);
-    });
-
-    it('non-platform file addition produces no labels', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/sensor.py', status: 'added' },
-      ];
-      // Override platformComponents so 'sensor' is not a recognized platform -> no label expected.
-      const nonPlatformApiData = { ...API_DATA, platformComponents: ['cover'] };
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, nonPlatformApiData);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectNewComponents
-// ---------------------------------------------------------------------------
-
-describe('detectNewComponents', () => {
-  it('new top-level __init__.py sets new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/actuator/__init__.py', status: 'added', },
-    ];
-    const result = await detectNewComponents(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.equal(result.hasYamlLoadable, false);
-  });
-
-  it('new top-level __init__.py with CONFIG_SCHEMA sets hasYamlLoadable', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/my_component/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.equal(result.hasYamlLoadable, true);
-  });
-
-  it('new top-level __init__.py with IS_TARGET_PLATFORM sets new-target-platform', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/my_platform/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub('IS_TARGET_PLATFORM = True'), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.ok(result.labels.has('new-target-platform'));
-  });
-
-  it('modified __init__.py does not set new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/existing/__init__.py', status: 'modified' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.equal(result.labels.size, 0);
-  });
-
-  it('nested __init__.py does not set new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.equal(result.labels.size, 0);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectPRTemplateCheckboxes
-// ---------------------------------------------------------------------------
-
-const NEW_FEATURE_LINE = '- [x] New feature (non-breaking change which adds functionality)';
-const DEV_FEATURE_LINE = '- [x] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-const DEV_FEATURE_LINE_UNTICKED = '- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-
-function makeBodyContext(body) {
-  return { payload: { pull_request: { body } } };
-}
-
-describe('detectPRTemplateCheckboxes', () => {
-  it('ticked developer-facing feature checkbox adds new-feature-developer only', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE));
-    assert.ok(labels.has('new-feature-developer'));
-    assert.ok(!labels.has('new-feature'));
-  });
-
-  it('unticked developer-facing feature checkbox adds no label', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE_UNTICKED));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-
-  it('ticked new feature checkbox does not add new-feature-developer', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(NEW_FEATURE_LINE));
-    assert.ok(labels.has('new-feature'));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectRequirements
-// ---------------------------------------------------------------------------
-
-describe('detectRequirements', () => {
-  // PR body without any docs-PR link.
-  const NO_DOCS_CONTEXT = makeBodyContext('Just a description, no docs link.');
-  const USER_DOCS_CONTEXT = makeBodyContext('Docs: esphome/esphome.io#1234');
-  const DEV_DOCS_CONTEXT = makeBodyContext('Docs: esphome/developers.esphome.io#1234');
-  const DEV_DOCS_URL_CONTEXT = makeBodyContext('Docs: https://github.com/esphome/developers.esphome.io/pull/1234');
-
-  // File sets: a normal source change vs. one confined to the exempt core validators.
-  const SOURCE_FILES = [
-    { filename: 'esphome/components/foo/foo.py' },
-    { filename: 'tests/components/foo/common.yaml' },
-  ];
-  const VALIDATOR_FILES = [
-    { filename: 'esphome/config_validation.py' },
-    { filename: 'tests/unit_tests/test_config_validation.py' },
-  ];
-
-  it('new-feature-developer without has-tests adds needs-tests but not needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-tests'));
-    assert.ok(!labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer with has-tests does not add needs-tests', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-tests'));
-  });
-
-  it('new-feature without a docs link still adds needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer without a developer docs link adds needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io shorthand link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io URL link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_URL_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a user docs (esphome.io) link does not satisfy needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, USER_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developer docs link does not satisfy needs-docs for new-feature', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], DEV_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('changes confined to core validator files are exempt from needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), VALIDATOR_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('validator changes mixed with other source files are not exempt', async () => {
-    const prFiles = [...VALIDATOR_FILES, { filename: 'esphome/components/foo/foo.py' }];
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), prFiles, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// MANAGED_LABELS
-// ---------------------------------------------------------------------------
-
-describe('MANAGED_LABELS', () => {
-  it('includes new-feature-developer so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('new-feature-developer'));
-  });
-
-  it('includes needs-developer-docs so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectPRSize
-// ---------------------------------------------------------------------------
-
-describe('detectPRSize', () => {
-  const SMALL = 30;
-  const MEDIUM = 100;
-  const TOO_BIG = 1000;
-
-  function size(prFiles, isMegaPR = false) {
-    const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
-    const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
-    return detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL, MEDIUM, TOO_BIG);
-  }
-
-  it('counts only non-test changes toward small-pr', async () => {
-    // 10 source + 5000 test lines -> non-test churn of 10 is still small.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 10, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('small-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('counts additions and deletions as churn (not net delta)', async () => {
-    // A balanced refactor (40 added, 40 removed) is 80 lines of churn -> medium, not small.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 40, deletions: 40 },
-    ]);
-    assert.ok(labels.has('medium-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('labels medium-pr when non-test changes exceed small threshold', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 60, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('medium-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('uses net delta (not churn) for too-big', async () => {
-    // 600 added + 600 removed: 1200 churn (above too-big) but 0 net delta -> not too-big.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 600, deletions: 600 },
-    ]);
-    assert.equal(labels.size, 0);
-  });
-
-  it('labels too-big when non-test changes exceed the big threshold', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 2000, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('too-big'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('does not label too-big when mega-pr is set', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 2000, deletions: 0 },
-    ], true);
-    assert.equal(labels.size, 0);
-  });
-
-  it('produces no size label for a large mega-pr in the gap above medium', async () => {
-    // Non-test changes land between MEDIUM and TOO_BIG: not small/medium, and mega-pr suppresses too-big.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 500, deletions: 0 },
-    ], true);
-    assert.equal(labels.size, 0);
-  });
-});

.github/scripts/auto-label-pr/tests/reviews.test.js

@@ -1,38 +0,0 @@
-const { describe, it } = require('node:test');
-const assert = require('node:assert/strict');
-const { generateReviewMessages } = require('../reviews');
-
-const MAX_LABELS = 15;
-const TOO_BIG_THRESHOLD = 1000;
-
-function tooBigMessage(labelCount, additions) {
-  const files = [{ filename: 'esphome/components/a/a.cpp', additions, deletions: 0 }];
-  const messages = generateReviewMessages(['too-big'], labelCount, null, files, additions, 0, 'someone', MAX_LABELS, TOO_BIG_THRESHOLD);
-  assert.equal(messages.length, 1);
-  return messages[0];
-}
-
-describe('too-big review message', () => {
-  it('names the line cap when the PR is too long', () => {
-    const message = tooBigMessage(3, 1500);
-    assert.match(message, /will not be reviewed until it is at most 1000 lines \(excluding tests\)\./);
-    assert.match(message, /removed automatically once the PR is at most 1000 lines/);
-    assert.doesNotMatch(message, /components\/areas\./);
-  });
-
-  it('names the area cap when the PR touches too many areas but is short', () => {
-    const message = tooBigMessage(20, 200);
-    assert.match(message, /will not be reviewed until it touches at most 15 components\/areas\./);
-    assert.doesNotMatch(message, /until it is at most 1000 lines/);
-  });
-
-  it('names both caps when both are exceeded', () => {
-    const message = tooBigMessage(20, 1500);
-    assert.match(message, /is at most 1000 lines \(excluding tests\) and touches at most 15 components\/areas\./);
-  });
-
-  it('tells new-component authors to bring one platform first', () => {
-    assert.match(tooBigMessage(3, 1500), /hub and a single platform/);
-    assert.match(tooBigMessage(3, 1500), /mega-pr/);
-  });
-});

.github/scripts/codeowners.js

@@ -1,227 +0,0 @@
-// Shared CODEOWNERS parsing and matching utilities.
-//
-// Used by:
-//   - codeowner-review-request.yml
-//   - codeowner-approved-label-update.yml
-//   - auto-label-pr/detectors.js (detectCodeOwner)
-
-/**
- * Convert a CODEOWNERS glob pattern to a RegExp.
- *
- * Handles **, *, and ? wildcards after escaping regex-special characters.
- */
-function globToRegex(pattern) {
-  let regexStr = pattern
-    .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
-    .replace(/\*\*/g, '\x00GLOBSTAR\x00')  // protect ** from next replace
-    .replace(/\*/g, '[^/]*')               // single star
-    .replace(/\x00GLOBSTAR\x00/g, '.*')    // restore globstar
-    .replace(/\?/g, '.');
-  return new RegExp('^' + regexStr + '$');
-}
-
-/**
- * Parse raw CODEOWNERS file content into an array of
- * { pattern, regex, owners } objects.
- *
- * Each `owners` entry is the raw string from the file (e.g. "@user" or
- * "@esphome/core").
- */
-function parseCodeowners(content) {
-  const lines = content
-    .split('\n')
-    .map(line => line.trim())
-    .filter(line => line && !line.startsWith('#'));
-
-  const patterns = [];
-  for (const line of lines) {
-    const parts = line.split(/\s+/);
-    if (parts.length < 2) continue;
-
-    const pattern = parts[0];
-    const owners = parts.slice(1);
-    const regex = globToRegex(pattern);
-    patterns.push({ pattern, regex, owners });
-  }
-  return patterns;
-}
-
-/**
- * Fetch and parse the CODEOWNERS file via the GitHub API.
- *
- * @param {object} github  - octokit instance from actions/github-script
- * @param {string} owner   - repo owner
- * @param {string} repo    - repo name
- * @param {string} [ref]   - git ref (SHA / branch) to read from
- * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
- */
-async function fetchCodeowners(github, owner, repo, ref) {
-  const params = { owner, repo, path: 'CODEOWNERS' };
-  if (ref) params.ref = ref;
-
-  const { data: file } = await github.rest.repos.getContent(params);
-  const content = Buffer.from(file.content, 'base64').toString('utf8');
-  return parseCodeowners(content);
-}
-
-/**
- * Classify raw owner strings into individual users and teams.
- *
- * @param {string[]} rawOwners - e.g. ["@user1", "@esphome/core"]
- * @returns {{ users: string[], teams: string[] }}
- *   users  – login names without "@"
- *   teams  – team slugs without the "org/" prefix
- */
-function classifyOwners(rawOwners) {
-  const users = [];
-  const teams = [];
-  for (const o of rawOwners) {
-    const clean = o.startsWith('@') ? o.slice(1) : o;
-    if (clean.includes('/')) {
-      teams.push(clean.split('/')[1]);
-    } else {
-      users.push(clean);
-    }
-  }
-  return { users, teams };
-}
-
-/**
- * For each file, find its effective codeowners using GitHub's
- * "last match wins" semantics, then union across all files.
- *
- * @param {string[]} files              - list of file paths
- * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
- * @returns {{ users: Set<string>, teams: Set<string>, matchedFileCount: number }}
- */
-function getEffectiveOwners(files, codeownersPatterns) {
-  const users = new Set();
-  const teams = new Set();
-  let matchedFileCount = 0;
-
-  for (const file of files) {
-    // Last matching pattern wins for each file
-    let effectiveOwners = null;
-    for (const { regex, owners } of codeownersPatterns) {
-      if (regex.test(file)) {
-        effectiveOwners = owners;
-      }
-    }
-    if (effectiveOwners) {
-      matchedFileCount++;
-      const classified = classifyOwners(effectiveOwners);
-      for (const u of classified.users) users.add(u);
-      for (const t of classified.teams) teams.add(t);
-    }
-  }
-
-  return { users, teams, matchedFileCount };
-}
-
-/**
- * Read and parse the CODEOWNERS file from disk.
- *
- * Use this when the repo is already checked out (avoids an API call).
- *
- * @param {string} [repoRoot='.'] - path to the repo root
- * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
- */
-function loadCodeowners(repoRoot = '.') {
-  const fs = require('fs');
-  const path = require('path');
-  const content = fs.readFileSync(path.join(repoRoot, 'CODEOWNERS'), 'utf8');
-  return parseCodeowners(content);
-}
-
-/** Possible label actions returned by determineLabelAction. */
-const LabelAction = Object.freeze({
-  ADD: 'add',
-  REMOVE: 'remove',
-  NONE: 'none',
-});
-
-/**
- * Determine what label action is needed for a PR based on codeowner approvals.
- *
- * Checks changed files against CODEOWNERS patterns, reviews, and current labels
- * to decide if the label should be added, removed, or left unchanged.
- *
- * @param {object} github              - octokit instance from actions/github-script
- * @param {string} owner               - repo owner
- * @param {string} repo                - repo name
- * @param {number} pr_number           - pull request number
- * @param {Array}  codeownersPatterns   - from loadCodeowners / fetchCodeowners
- * @param {string} labelName           - label to manage
- * @returns {Promise<LabelAction>}
- */
-async function determineLabelAction(github, owner, repo, pr_number, codeownersPatterns, labelName) {
-  // Get the list of changed files in this PR
-  const prFiles = await github.paginate(
-    github.rest.pulls.listFiles,
-    { owner, repo, pull_number: pr_number }
-  );
-
-  const changedFiles = prFiles.map(file => file.filename);
-  console.log(`Found ${changedFiles.length} changed files`);
-
-  if (changedFiles.length === 0) {
-    console.log('No changed files found');
-    return LabelAction.NONE;
-  }
-
-  // Get effective owners using last-match-wins semantics
-  const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-  const componentCodeowners = effective.users;
-
-  console.log(`Component-specific codeowners: ${Array.from(componentCodeowners).join(', ') || '(none)'}`);
-
-  // Get current labels
-  const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
-    owner, repo, issue_number: pr_number
-  });
-  const hasLabel = currentLabels.some(label => label.name === labelName);
-
-  if (componentCodeowners.size === 0) {
-    console.log('No component-specific codeowners found');
-    return hasLabel ? LabelAction.REMOVE : LabelAction.NONE;
-  }
-
-  // Get all reviews and find latest per user
-  const reviews = await github.paginate(
-    github.rest.pulls.listReviews,
-    { owner, repo, pull_number: pr_number }
-  );
-
-  const latestReviewByUser = new Map();
-  for (const review of reviews) {
-    if (!review.user || review.user.type === 'Bot' || review.state === 'COMMENTED') continue;
-    latestReviewByUser.set(review.user.login, review);
-  }
-
-  // Check if any component-specific codeowner has an active approval
-  let hasCodeownerApproval = false;
-  for (const [login, review] of latestReviewByUser) {
-    if (review.state === 'APPROVED' && componentCodeowners.has(login)) {
-      console.log(`Codeowner '${login}' has approved`);
-      hasCodeownerApproval = true;
-      break;
-    }
-  }
-
-  if (hasCodeownerApproval && !hasLabel) return LabelAction.ADD;
-  if (!hasCodeownerApproval && hasLabel) return LabelAction.REMOVE;
-
-  console.log(`Label already ${hasLabel ? 'present' : 'absent'}, no change needed`);
-  return LabelAction.NONE;
-}
-
-module.exports = {
-  globToRegex,
-  parseCodeowners,
-  fetchCodeowners,
-  loadCodeowners,
-  classifyOwners,
-  getEffectiveOwners,
-  LabelAction,
-  determineLabelAction
-};

.github/scripts/detect-tags.js

@@ -1,65 +0,0 @@
-/**
- * Shared tag detection from changed file paths.
- * Used by pr-title-check and auto-label-pr workflows.
- */
-
-const COMPONENT_REGEX = /^esphome\/components\/([^\/]+)\//;
-
-/**
- * Detect component names from changed files.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {Set<string>} Set of component names
- */
-function detectComponents(changedFiles) {
-  const components = new Set();
-  for (const file of changedFiles) {
-    const match = file.match(COMPONENT_REGEX);
-    if (match) {
-      components.add(match[1]);
-    }
-  }
-  return components;
-}
-
-/**
- * Detect if core files were changed.
- * Core files are in esphome/core/ or top-level esphome/ directory.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasCoreChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('esphome/core/') ||
-    (file.startsWith('esphome/') && file.split('/').length === 2)
-  );
-}
-
-/**
- * Detect if dashboard files were changed.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasDashboardChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('esphome/components/dashboard_import/')
-  );
-}
-
-/**
- * Detect if GitHub Actions files were changed.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasGitHubActionsChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('.github/workflows/')
-  );
-}
-
-module.exports = {
-  COMPONENT_REGEX,
-  detectComponents,
-  hasCoreChanges,
-  hasDashboardChanges,
-  hasGitHubActionsChanges,
-};

.github/skills

@@ -1 +0,0 @@
-../.agents/skills

.github/workflows/auto-label-pr.yml

@@ -1,46 +0,0 @@
-name: Auto Label PR
-
-on:
-  # Runs only on pull_request_target due to having access to a App token.
-  # This means PRs from forks will not be able to alter this workflow to get the tokens
-  pull_request_target:
-    types: [labeled, opened, reopened, synchronize, edited]
-
-# All PR/label/review writes are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
-permissions:
-  contents: read  # actions/checkout reads the workflow source
-
-env:
-  SMALL_PR_THRESHOLD: 30
-  MEDIUM_PR_THRESHOLD: 100
-  MAX_LABELS: 15
-  TOO_BIG_THRESHOLD: 1000
-  COMPONENT_LABEL_THRESHOLD: 10
-
-jobs:
-  label:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
-          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
-          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
-          permission-pull-requests: write  # pulls.get, pulls.listFiles, list/create/update/dismissReview
-
-      - name: Auto Label PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            const script = require('./.github/scripts/auto-label-pr/index.js');
-            await script({ github, context });

.github/workflows/ci-api-proto.yml

@@ -1,126 +0,0 @@
-name: API Proto CI
-
-on:
-  pull_request:
-    paths:
-      - "esphome/components/api/api.proto"
-      - "esphome/components/api/api_pb2.cpp"
-      - "esphome/components/api/api_pb2.h"
-      - "esphome/components/api/api_pb2_service.cpp"
-      - "esphome/components/api/api_pb2_service.h"
-      - "script/api_protobuf/api_protobuf.py"
-      - ".github/workflows/ci-api-proto.yml"
-
-permissions:
-  contents: read        # actions/checkout for the PR head
-  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale
-
-jobs:
-  check:
-    name: Check generated files
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Set up uv
-        # ``--system`` (below) installs into the setup-python interpreter;
-        # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          enable-cache: true
-          # Pull-request-only workflow: a save could never be shared and
-          # would only consume quota.
-          save-cache: "false"
-          # Pin uv version so the action does not have to fetch the
-          # manifest from raw.githubusercontent.com on every cache
-          # miss; that fetch flakes on Windows runners.
-          version: "0.11.15"
-
-      - name: Install apt dependencies
-        # PR-only workflow, so nothing on dev could seed a shared apt cache
-        # entry; the cached apt action would save one copy per PR. Plain apt
-        # with every call bounded: the apt.conf.d timeouts make a dead
-        # mirror fail over in seconds, and timeout runs under sudo so it can
-        # kill apt-get itself. Install without update first: image lists are
-        # fresh, and the index refresh is what a congested mirror makes slow.
-        timeout-minutes: 15
-        run: |
-          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
-          Acquire::Retries "1";
-          Acquire::http::Timeout "15";
-          Acquire::https::Timeout "15";
-          EOF
-          # Common path: the image's package lists are fresh enough.
-          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
-              apt-get install -y protobuf-compiler; then
-            protoc --version
-            exit 0
-          fi
-          # Rescue path: refresh the lists once with a generous bound; the
-          # apt config already fails a stalled mirror over quickly.
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
-            dpkg --configure -a || true
-          sudo timeout -k 15 300 apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
-            apt-get install -y protobuf-compiler
-          protoc --version
-      - name: Install python dependencies
-        run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt
-      - name: Generate files
-        run: script/api_protobuf/api_protobuf.py
-      - name: Check for changes
-        run: |
-          if ! git diff --quiet; then
-            echo "## Job Failed" | tee -a $GITHUB_STEP_SUMMARY
-            echo "You have altered the generated proto files but they do not match what is expected." | tee -a $GITHUB_STEP_SUMMARY
-            echo "Please run 'script/api_protobuf/api_protobuf.py' and commit the changes." | tee -a $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-      - if: failure()
-        name: Review PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            await github.rest.pulls.createReview({
-              pull_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              event: 'REQUEST_CHANGES',
-              body: 'You have altered the generated proto files but they do not match what is expected.\nPlease run "script/api_protobuf/api_protobuf.py" and commit the changes.'
-            })
-      - if: failure()
-        name: Show changes
-        run: git diff
-      - if: failure()
-        name: Archive artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: generated-proto-files
-          path: |
-            esphome/components/api/api_pb2.*
-            esphome/components/api/api_pb2_service.*
-      - if: success()
-        name: Dismiss review
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            let reviews = await github.rest.pulls.listReviews({
-              pull_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo
-            });
-            for (let review of reviews.data) {
-              if (review.user.login === 'github-actions[bot]' && review.state === 'CHANGES_REQUESTED') {
-                await github.rest.pulls.dismissReview({
-                  pull_number: context.issue.number,
-                  owner: context.repo.owner,
-                  repo: context.repo.repo,
-                  review_id: review.id,
-                  message: 'Files now match the expected proto files.'
-                });
-              }
-            }

.github/workflows/ci-docker.yml

@@ -1,40 +1,29 @@
 ---
 name: CI for docker images
 
-# Only run on PRs that touch the docker image, its build inputs, or any code
-# whose toolchain the compile smoke test exercises (core + target platforms).
-
+# Only run when docker paths change
+# yamllint disable-line rule:truthy
 on:
+  push:
+    branches: [dev, beta, release]
+    paths:
+      - "docker/**"
+      - ".github/workflows/**"
+      - "requirements*.txt"
+      - "platformio.ini"
+      - "script/platformio_install_deps.py"
+
   pull_request:
     paths:
-      # Docker image and its build inputs.
       - "docker/**"
-      - ".github/workflows/ci-docker.yml"
+      - ".github/workflows/**"
       - "requirements*.txt"
-      - "pyproject.toml"
-      - "esphome/idf_component.yml"
-      # Core, build pipeline, toolchain, and target-platform changes can change
-      # how a toolchain is set up or built, so re-run the per-toolchain compile
-      # smoke test when they change.
-      - "esphome/core/**"
-      - "esphome/writer.py"
-      - "esphome/build_gen/**"
-      - "esphome/build_helpers/**"
-      - "esphome/espidf/**"
-      - "esphome/platformio/**"
-      - "esphome/components/bk72xx/**"
-      - "esphome/components/esp32/**"
-      - "esphome/components/esp8266/**"
-      - "esphome/components/host/**"
-      - "esphome/components/libretiny/**"
-      - "esphome/components/ln882x/**"
-      - "esphome/components/nrf52/**"
-      - "esphome/components/rp2040/**"
-      - "esphome/components/rtl87xx/**"
-      - "esphome/components/zephyr/**"
+      - "platformio.ini"
+      - "script/platformio_install_deps.py"
 
 permissions:
-  contents: read  # actions/checkout only
+  contents: read
+  packages: read
 
 concurrency:
   # yamllint disable-line rule:line-length
@@ -44,181 +33,31 @@ concurrency:
 jobs:
   check-docker:
     name: Build docker containers
-    runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # push branch-tagged images to ghcr.io for local testing
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        os: ["ubuntu-24.04", "ubuntu-24.04-arm"]
-        build_type:
-          - "ha-addon"
-          - "docker"
-          # - "lint"
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
-      push: ${{ steps.tag.outputs.push }}
+        arch: [amd64, armv7, aarch64]
+        build_type: ["ha-addon", "docker", "lint"]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v3
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.12"
+          python-version: "3.9"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
 
-      - name: Determine tag and whether to push
-        id: tag
-        env:
-          HEAD_REF: ${{ github.head_ref || github.ref_name }}
+      - name: Set TAG
         run: |
-          # Sanitize the branch name into a valid docker tag: replace invalid
-          # characters, ensure the first character is valid (tags must start
-          # with [A-Za-z0-9_]), and cap the length at 128 characters.
-          branch="$HEAD_REF"
-          tag="${branch//[^a-zA-Z0-9_.-]/-}"
-          case "$tag" in
-            [a-zA-Z0-9_]*) ;;
-            *) tag="pr-${tag}" ;;
-          esac
-          tag="${tag:0:128}"
-          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
-          # Only push branch images for same-repo pull requests. Push events
-          # only fire for dev/beta/release, whose images are owned by the
-          # release pipeline -- never overwrite those from here.
-          if [ "${{ github.event_name }}" = "pull_request" ] \
-            && [ "${{ github.repository }}" = "esphome/esphome" ] \
-            && [ "${{ github.event.pull_request.head.repo.full_name }}" = "esphome/esphome" ]; then
-            echo "push=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "push=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Log in to the GitHub container registry
-        if: steps.tag.outputs.push == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          echo "TAG=check" >> $GITHUB_ENV
 
       - name: Run build
         run: |
           docker/build.py \
-            --tag "${{ steps.tag.outputs.tag }}" \
-            --arch "${{ matrix.os == 'ubuntu-24.04-arm' && 'aarch64' || 'amd64' }}" \
+            --tag "${TAG}" \
+            --arch "${{ matrix.arch }}" \
             --build-type "${{ matrix.build_type }}" \
-            --registry ghcr \
-            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }} ${{ (matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker') && '--load' || '' }}
-
-      # The amd64 "docker" image is also loaded locally (above) and handed to
-      # compile-test as an artifact, so the smoke test reuses this build instead
-      # of building the image a second time. Using an artifact (rather than the
-      # pushed image) keeps it working for fork PRs, which never push to ghcr.io.
-      - name: Export image for compile-test
-        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
-        # zstd over gzip: docker save is on the critical path for every
-        # compile-test job, and zstd -T0 is multithreaded (export 50s -> 9s).
-        # docker load auto-detects the format; its time is layer extraction,
-        # not decompression, so it is unchanged. shell: bash adds pipefail so
-        # a failed docker save cannot upload a truncated artifact.
-        shell: bash
-        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | zstd -T0 -3 > compile-test-image.tar.zst
-
-      - name: Upload compile-test image artifact
-        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          # The tar is already compressed, so upload it as-is. archive: false
-          # skips the redundant zip and makes the file name the artifact name
-          # (the `name` input is ignored in that mode).
-          path: compile-test-image.tar.zst
-          retention-days: 1
-          archive: false
-
-  manifest:
-    name: Push ${{ matrix.build_type }} manifest to ghcr.io
-    needs: [check-docker]
-    if: needs.check-docker.outputs.push == 'true'
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read   # actions/checkout to run docker/build.py
-      packages: write  # buildx imagetools writes the multi-arch tag to ghcr.io
-    strategy:
-      fail-fast: false
-      matrix:
-        build_type:
-          - "ha-addon"
-          - "docker"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
-
-      - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create and push manifest
-        run: |
-          docker/build.py \
-            --tag "${{ needs.check-docker.outputs.tag }}" \
-            --build-type "${{ matrix.build_type }}" \
-            --registry ghcr \
-            manifest
-
-  # Smoke-test the built image by compiling one minimal config per target
-  # platform / toolchain. This catches missing system dependencies in the image
-  # that only surface when a given toolchain is downloaded and run. The image is
-  # the amd64 "docker" build produced by check-docker (shared as an artifact).
-  compile-test:
-    name: Compile ${{ matrix.id }}
-    needs: check-docker
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read  # actions/checkout to load the test configs
-    strategy:
-      fail-fast: false
-      matrix:
-        # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
-        # share a toolchain bundle, so esp32 is exercised on the base variant
-        # across the full framework x toolchain cross-product (arduino/esp-idf
-        # framework, each built with the platformio and native esp-idf
-        # toolchains) so both toolchains stay covered regardless of which one is
-        # the default.
-        id:
-          - esp8266-arduino
-          - esp8266-arduino-native
-          - esp32-arduino-platformio
-          - esp32-arduino-esp-idf
-          - esp32-idf-platformio
-          - esp32-idf-esp-idf
-          - rp2040-arduino
-          - bk72xx-arduino
-          - rtl87xx-arduino
-          - ln882x-arduino
-          - nrf52
-          - host
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Download image artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: compile-test-image.tar.zst
-      - name: Load image
-        run: docker load --input compile-test-image.tar.zst
-      - name: Compile ${{ matrix.id }}
-        run: |
-          docker run --rm \
-            -v "${{ github.workspace }}/docker/test_configs:/config" \
-            -e ESPHOME_LDGEN_STRICT=1 \
-            "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
-            compile "${{ matrix.id }}.yaml"
+            build

.github/workflows/ci-github-scripts.yml

@@ -1,27 +0,0 @@
-name: CI - GitHub Scripts
-
-on:
-  push:
-    branches: [dev, beta, release]
-    paths:
-      - ".github/scripts/**"
-      - ".github/workflows/ci-github-scripts.yml"
-  pull_request:
-    paths:
-      - ".github/scripts/**"
-      - ".github/workflows/ci-github-scripts.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  test-auto-label-pr:
-    name: Test auto-label-pr scripts
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run tests
-        working-directory: .github/scripts/auto-label-pr
-        run: npm test

.github/workflows/ci-memory-impact-comment.yml

@@ -1,111 +0,0 @@
----
-name: Memory Impact Comment (Forks)
-
-on:
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
-
-permissions:
-  contents: read        # actions/checkout of the base repo at the PR's target branch
-  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
-  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
-
-jobs:
-  memory-impact-comment:
-    name: Post memory impact comment (fork PRs only)
-    runs-on: ubuntu-24.04
-    # Only run for PRs from forks that had successful CI runs
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_repository.full_name != github.repository
-    env:
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - name: Get PR details
-        id: pr
-        run: |
-          # Get PR details by searching for PR with matching head SHA
-          # The workflow_run.pull_requests field is often empty for forks
-          # Use paginate to handle repos with many open PRs
-          head_sha="${{ github.event.workflow_run.head_sha }}"
-          pr_data=$(gh api --paginate "/repos/${{ github.repository }}/pulls" \
-            --jq ".[] | select(.head.sha == \"$head_sha\") | {number: .number, base_ref: .base.ref}" \
-            | head -n 1)
-
-          if [ -z "$pr_data" ]; then
-            echo "No PR found for SHA $head_sha, skipping"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          pr_number=$(echo "$pr_data" | jq -r '.number')
-          base_ref=$(echo "$pr_data" | jq -r '.base_ref')
-
-          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
-          echo "base_ref=$base_ref" >> "$GITHUB_OUTPUT"
-          echo "Found PR #$pr_number targeting base branch: $base_ref"
-
-      - name: Check out code from base repository
-        if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Always check out from the base repository (esphome/esphome), never from forks
-          # Use the PR's target branch to ensure we run trusted code from the main repo
-          repository: ${{ github.repository }}
-          ref: ${{ steps.pr.outputs.base_ref }}
-
-      - name: Restore Python
-        if: steps.pr.outputs.skip != 'true'
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: "3.12"
-          cache-key: ${{ hashFiles('.cache-key') }}
-
-      - name: Download memory analysis artifacts
-        if: steps.pr.outputs.skip != 'true'
-        run: |
-          run_id="${{ github.event.workflow_run.id }}"
-          echo "Downloading artifacts from workflow run $run_id"
-
-          mkdir -p memory-analysis
-
-          # Download target analysis artifact
-          if gh run download --name "memory-analysis-target" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
-            echo "Downloaded memory-analysis-target artifact."
-          else
-            echo "No memory-analysis-target artifact found."
-          fi
-
-          # Download PR analysis artifact
-          if gh run download --name "memory-analysis-pr" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
-            echo "Downloaded memory-analysis-pr artifact."
-          else
-            echo "No memory-analysis-pr artifact found."
-          fi
-
-      - name: Check if artifacts exist
-        id: check
-        if: steps.pr.outputs.skip != 'true'
-        run: |
-          if [ -f ./memory-analysis/memory-analysis-target.json ] && [ -f ./memory-analysis/memory-analysis-pr.json ]; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            echo "Memory analysis artifacts not found, skipping comment"
-          fi
-
-      - name: Post or update PR comment
-        if: steps.pr.outputs.skip != 'true' && steps.check.outputs.found == 'true'
-        env:
-          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
-        run: |
-          . venv/bin/activate
-          # Pass PR number and JSON file paths directly to Python script
-          # Let Python parse the JSON to avoid shell injection risks
-          # The script will validate and sanitize all inputs
-          python script/ci_memory_impact_comment.py \
-            --pr-number "$PR_NUMBER" \
-            --target-json ./memory-analysis/memory-analysis-target.json \
-            --pr-json ./memory-analysis/memory-analysis-pr.json

.github/workflows/close-pr-from-fork-default-branch.yml

@@ -1,72 +0,0 @@
-name: Close PR From Fork Default Branch
-
-on:
-  # pull_request_target is required so we have permission to comment and close PRs from forks.
-  pull_request_target:
-    types: [opened, reopened]
-
-permissions:
-  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
-  issues: write         # issues.createComment to explain to the contributor why the PR was closed
-
-jobs:
-  close:
-    name: Close PR opened from fork's default branch
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-      && github.event.pull_request.head.ref == github.event.repository.default_branch
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.payload.pull_request.number;
-            const author = context.payload.pull_request.user.login;
-            const defaultBranch = context.payload.repository.default_branch;
-            const headRepo = context.payload.pull_request.head.repo.full_name;
-
-            const body = [
-              `Hi @${author}, thanks for opening a pull request! :tada:`,
-              ``,
-              `It looks like this PR was opened from the \`${defaultBranch}\` branch of your fork (\`${headRepo}\`), which is the same name as this repository's default branch. Working directly on \`${defaultBranch}\` in your fork causes a few problems:`,
-              ``,
-              `- Your fork's \`${defaultBranch}\` branch will permanently diverge from \`esphome/esphome:${defaultBranch}\`, making it hard to keep your fork up to date.`,
-              `- Any additional commits you push to \`${defaultBranch}\` will be added to this PR, so you can't easily work on multiple changes at once.`,
-              `- Pushing maintainer fixes to your branch is awkward, since it means committing directly to your fork's default branch.`,
-              `- It makes local collaboration painful — \`${defaultBranch}\` in a checkout becomes ambiguous between upstream and your fork, and maintainers end up with naming collisions when fetching your branch.`,
-              ``,
-              `Please re-open this as a new PR from a dedicated feature branch. The usual flow looks like:`,
-              ``,
-              `\`\`\`bash`,
-              `# Make sure your fork's ${defaultBranch} is up to date with upstream`,
-              `git remote add upstream https://github.com/${owner}/${repo}.git  # if you haven't already`,
-              `git fetch upstream`,
-              `git checkout ${defaultBranch}`,
-              `git reset --hard upstream/${defaultBranch}`,
-              `git push --force-with-lease origin ${defaultBranch}`,
-              ``,
-              `# Create a new branch for your change and cherry-pick / re-apply your commits there`,
-              `git checkout -b my-feature-branch upstream/${defaultBranch}`,
-              `# ...re-apply your changes, then:`,
-              `git push origin my-feature-branch`,
-              `\`\`\``,
-              ``,
-              `Then open a new pull request from \`my-feature-branch\` into \`${owner}/${repo}:${defaultBranch}\`.`,
-              ``,
-              `Closing this PR for now — sorry for the friction, and thanks again for contributing! :heart:`,
-            ].join('\n');
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body,
-            });
-
-            await github.rest.pulls.update({
-              owner,
-              repo,
-              pull_number: prNumber,
-              state: 'closed',
-            });

.github/workflows/codeowner-approved-label-update.yml

@@ -1,81 +0,0 @@
-# Adds/removes a 'code-owner-approved' label when a component-specific
-# codeowner approves (or dismisses) a PR.
-#
-# Uses pull_request_target so that fork PRs do not require workflow approval.
-# The label is reconciled on every PR update; for review events specifically,
-# this means the label is applied on the next push after a codeowner review.
-
-name: Codeowner Approved Label
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review]
-    branches-ignore:
-      - release
-      - beta
-
-permissions:
-  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
-  pull-requests: read  # listReviews to determine whether a codeowner has approved
-  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
-
-jobs:
-  codeowner-approved:
-    name: Run
-    if: ${{ github.repository == 'esphome/esphome' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          sparse-checkout: |
-            .github/scripts/codeowners.js
-            CODEOWNERS
-
-      - name: Check codeowner approval and update label
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        with:
-          script: |
-            const { loadCodeowners, determineLabelAction, LabelAction } = require('./.github/scripts/codeowners.js');
-
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const pr_number = parseInt(process.env.PR_NUMBER, 10);
-            const LABEL_NAME = 'code-owner-approved';
-
-            console.log(`Processing PR #${pr_number} for codeowner approval label`);
-
-            const codeownersPatterns = loadCodeowners();
-            const action = await determineLabelAction(
-              github, owner, repo, pr_number, codeownersPatterns, LABEL_NAME
-            );
-
-            if (action === LabelAction.NONE) {
-              console.log('No label change needed');
-              return;
-            }
-
-            try {
-              if (action === LabelAction.ADD) {
-                await github.rest.issues.addLabels({
-                  owner, repo, issue_number: pr_number, labels: [LABEL_NAME]
-                });
-                console.log(`Added '${LABEL_NAME}' label`);
-              } else if (action === LabelAction.REMOVE) {
-                await github.rest.issues.removeLabel({
-                  owner, repo, issue_number: pr_number, name: LABEL_NAME
-                });
-                console.log(`Removed '${LABEL_NAME}' label`);
-              }
-            } catch (error) {
-              if (error.status === 403) {
-                console.log(`Warning: insufficient permissions to update label (expected for fork PRs)`);
-              } else if (error.status === 404) {
-                console.log(`Label '${LABEL_NAME}' not present, nothing to remove`);
-              } else {
-                throw error;
-              }
-            }

.github/workflows/codeowner-review-request.yml

@@ -1,291 +0,0 @@
-# This workflow automatically requests reviews from codeowners when:
-# 1. A PR is opened, reopened, or synchronized (updated)
-# 2. A PR is marked as ready for review
-#
-# It reads the CODEOWNERS file and matches all changed files in the PR against
-# the codeowner patterns, then requests reviews from the appropriate owners
-# while avoiding duplicate requests for users who have already been requested
-# or have already reviewed the PR.
-
-name: Request Codeowner Reviews
-
-on:
-  # Needs to be pull_request_target to get write permissions
-  pull_request_target:
-    types: [opened, reopened, synchronize, ready_for_review]
-    branches-ignore:
-      - release
-      - beta
-
-# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
-permissions:
-  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
-
-jobs:
-  request-codeowner-reviews:
-    name: Run
-    if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by the github-script step below.
-          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
-          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
-
-      - name: Request reviews from component codeowners
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
-
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const pr_number = context.payload.pull_request.number;
-
-            console.log(`Processing PR #${pr_number} for codeowner review requests`);
-
-            // Hidden marker to identify bot comments from this workflow
-            const BOT_COMMENT_MARKER = '<!-- codeowner-review-request-bot -->';
-
-            try {
-              // Get the list of changed files in this PR (with pagination)
-              const files = await github.paginate(
-                github.rest.pulls.listFiles,
-                {
-                  owner,
-                  repo,
-                  pull_number: pr_number
-                }
-              );
-
-              const changedFiles = files.map(file => file.filename);
-              console.log(`Found ${changedFiles.length} changed files`);
-
-              if (changedFiles.length === 0) {
-                console.log('No changed files found, skipping codeowner review requests');
-                return;
-              }
-
-              // Parse CODEOWNERS from the checked-out base branch
-              const codeownersPatterns = loadCodeowners();
-
-              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
-
-              // Helper function to create comment body
-              function createCommentBody(reviewersList, teamsList, matchedFileCount, isSuccessful = true) {
-                const reviewerMentions = reviewersList.map(r => `@${r}`);
-                const teamMentions = teamsList.map(t => `@${owner}/${t}`);
-                const allMentions = [...reviewerMentions, ...teamMentions].join(', ');
-
-                if (isSuccessful) {
-                  return `${BOT_COMMENT_MARKER}\n👋 Hi there! I've automatically requested reviews from codeowners based on the files changed in this PR.\n\n${allMentions} - You've been requested to review this PR as codeowner(s) of ${matchedFileCount} file(s) that were modified. Thanks for your time! 🙏`;
-                } else {
-                  return `${BOT_COMMENT_MARKER}\n👋 Hi there! This PR modifies ${matchedFileCount} file(s) with codeowners.\n\n${allMentions} - As codeowner(s) of the affected files, your review would be appreciated! 🙏\n\n_Note: Automatic review request may have failed, but you're still welcome to review._`;
-                }
-              }
-
-              // Match changed files against CODEOWNERS patterns using last-match-wins semantics
-              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-              const matchedOwners = effective.users;
-              const matchedTeams = effective.teams;
-              const matchedFileCount = effective.matchedFileCount;
-
-              if (matchedOwners.size === 0 && matchedTeams.size === 0) {
-                console.log('No codeowners found for any changed files');
-                return;
-              }
-
-              // Remove the PR author from reviewers
-              const prAuthor = context.payload.pull_request.user.login;
-              matchedOwners.delete(prAuthor);
-
-              // Get current reviewers to avoid duplicate requests (but still mention them)
-              const { data: prData } = await github.rest.pulls.get({
-                owner,
-                repo,
-                pull_number: pr_number
-              });
-
-              const currentReviewers = new Set();
-              const currentTeams = new Set();
-
-              if (prData.requested_reviewers) {
-                prData.requested_reviewers.forEach(reviewer => {
-                  currentReviewers.add(reviewer.login);
-                });
-              }
-
-              if (prData.requested_teams) {
-                prData.requested_teams.forEach(team => {
-                  currentTeams.add(team.slug);
-                });
-              }
-
-              // Check for completed reviews to avoid re-requesting users who have already reviewed
-              const reviews = await github.paginate(
-                github.rest.pulls.listReviews,
-                {
-                  owner,
-                  repo,
-                  pull_number: pr_number
-                }
-              );
-
-              const reviewedUsers = new Set();
-              reviews.forEach(review => {
-                reviewedUsers.add(review.user.login);
-              });
-
-              // Check for previous comments from this workflow to avoid duplicate pings
-              const comments = await github.paginate(
-                github.rest.issues.listComments,
-                {
-                  owner,
-                  repo,
-                  issue_number: pr_number
-                }
-              );
-
-              const previouslyPingedUsers = new Set();
-              const previouslyPingedTeams = new Set();
-
-              // Look for comments from github-actions bot that contain our bot marker
-              const workflowComments = comments.filter(comment =>
-                comment.user.type === 'Bot' &&
-                comment.body.includes(BOT_COMMENT_MARKER)
-              );
-
-              // Extract previously mentioned users and teams from workflow comments
-              for (const comment of workflowComments) {
-                // Match @username patterns (not team mentions)
-                const userMentions = comment.body.match(/@([a-zA-Z0-9_.-]+)(?![/])/g) || [];
-                userMentions.forEach(mention => {
-                  const username = mention.slice(1); // remove @
-                  previouslyPingedUsers.add(username);
-                });
-
-                // Match @org/team patterns
-                const teamMentions = comment.body.match(/@[a-zA-Z0-9_.-]+\/([a-zA-Z0-9_.-]+)/g) || [];
-                teamMentions.forEach(mention => {
-                  const teamName = mention.split('/')[1];
-                  previouslyPingedTeams.add(teamName);
-                });
-              }
-
-              console.log(`Found ${previouslyPingedUsers.size} previously pinged users and ${previouslyPingedTeams.size} previously pinged teams`);
-
-              // Remove users who have already been pinged in previous workflow comments
-              previouslyPingedUsers.forEach(user => {
-                matchedOwners.delete(user);
-              });
-
-              previouslyPingedTeams.forEach(team => {
-                matchedTeams.delete(team);
-              });
-
-              // Remove only users who have already submitted reviews (not just requested reviewers)
-              reviewedUsers.forEach(reviewer => {
-                matchedOwners.delete(reviewer);
-              });
-
-              // For teams, we'll still remove already requested teams to avoid API errors
-              currentTeams.forEach(team => {
-                matchedTeams.delete(team);
-              });
-
-              const reviewersList = Array.from(matchedOwners);
-              const teamsList = Array.from(matchedTeams);
-
-              if (reviewersList.length === 0 && teamsList.length === 0) {
-                console.log('No eligible reviewers found (all may already be requested, reviewed, or previously pinged)');
-                return;
-              }
-
-              const totalReviewers = reviewersList.length + teamsList.length;
-              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${matchedFileCount} matched files`);
-
-              // Request reviews
-              try {
-                const requestParams = {
-                  owner,
-                  repo,
-                  pull_number: pr_number
-                };
-
-                // Filter out users who are already requested reviewers for the API call
-                const newReviewers = reviewersList.filter(reviewer => !currentReviewers.has(reviewer));
-                const newTeams = teamsList.filter(team => !currentTeams.has(team));
-
-                if (newReviewers.length > 0) {
-                  requestParams.reviewers = newReviewers;
-                }
-
-                if (newTeams.length > 0) {
-                  requestParams.team_reviewers = newTeams;
-                }
-
-                // Only make the API call if there are new reviewers to request
-                if (newReviewers.length > 0 || newTeams.length > 0) {
-                  await github.rest.pulls.requestReviewers(requestParams);
-                  console.log(`Successfully requested reviews from ${newReviewers.length} new users and ${newTeams.length} new teams`);
-                } else {
-                  console.log('All codeowners are already requested reviewers or have reviewed');
-                }
-
-                // Only add a comment if there are new codeowners to mention (not previously pinged)
-                if (reviewersList.length > 0 || teamsList.length > 0) {
-                  const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, true);
-
-                  await github.rest.issues.createComment({
-                    owner,
-                    repo,
-                    issue_number: pr_number,
-                    body: commentBody
-                  });
-                  console.log(`Added comment mentioning ${reviewersList.length} users and ${teamsList.length} teams`);
-                } else {
-                  console.log('No new codeowners to mention in comment (all previously pinged)');
-                }
-              } catch (error) {
-                if (error.status === 422) {
-                  console.log('Some reviewers may already be requested or unavailable:', error.message);
-
-                  // Only try to add a comment if there are new codeowners to mention
-                  if (reviewersList.length > 0 || teamsList.length > 0) {
-                    const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, false);
-
-                    try {
-                      await github.rest.issues.createComment({
-                        owner,
-                        repo,
-                        issue_number: pr_number,
-                        body: commentBody
-                      });
-                      console.log(`Added fallback comment mentioning ${reviewersList.length} users and ${teamsList.length} teams`);
-                    } catch (commentError) {
-                      console.log('Failed to add comment:', commentError.message);
-                    }
-                  } else {
-                    console.log('No new codeowners to mention in fallback comment');
-                  }
-                } else {
-                  throw error;
-                }
-              }
-
-            } catch (error) {
-              console.log('Failed to process codeowner review requests:', error.message);
-              console.error(error);
-            }

.github/workflows/codeql.yml

@@ -1,89 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL Advanced"
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "30 18 * * 4"
-
-# Deny by default; the analyze job opts in to exactly what it needs.
-permissions: {}
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    permissions:
-      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
-      packages: read          # fetch internal or private CodeQL query packs
-      actions: read           # required by codeql-action when run from a private repo
-      contents: read          # actions/checkout to scan the repository
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # - language: c-cpp
-          #   build-mode: autobuild
-          - language: python
-            build-mode: none
-            # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
-            # Use `c-cpp` to analyze code written in C, C++ or both
-            # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-            # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-            # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-            # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-            # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-            # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-          # If you wish to specify custom queries, you can do so here or in a config file.
-          # By default, queries listed here will override any specified in a config file.
-          # Prefix the list here with "+" to use these queries and those in the config file.
-
-          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-          # queries: security-extended,security-and-quality
-
-      # If the analyze step fails for one of the languages you are analyzing with
-      # "We were unable to automatically build your code", modify the matrix above
-      # to set the build mode to "manual" for that language. Then modify this step
-      # to build your code.
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-      - if: matrix.build-mode == 'manual'
-        shell: bash
-        run: |
-          echo 'If you are using a "manual" build mode for one or more of the' \
-            'languages you are analyzing, replace this with the commands to build' \
-            'your code, for example:'
-          echo '  make bootstrap'
-          echo '  make release'
-          exit 1
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
-        with:
-          category: "/language:${{matrix.language}}"

.github/workflows/external-component-bot.yml

@@ -1,172 +0,0 @@
-name: Add External Component Comment
-
-on:
-  pull_request_target:
-    types: [opened, synchronize]
-
-# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
-# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
-permissions: {}
-
-jobs:
-  external-comment:
-    name: External component comment
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
-          # the issues.*Comment APIs require the pull-requests scope, not issues.
-          permission-pull-requests: write
-
-      - name: Add external component comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            // Generate external component usage instructions
-            function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {
-                let source;
-                if (owner === 'esphome' && repo === 'esphome')
-                    source = `github://pr#${prNumber}`;
-                else
-                    source = `github://${owner}/${repo}@pull/${prNumber}/head`;
-                return `To use the changes from this PR as an external component, add the following to your ESPHome configuration YAML file:
-
-            \`\`\`yaml
-            external_components:
-              - source: ${source}
-                components: [${componentNames.join(', ')}]
-                refresh: 1h
-            \`\`\``;
-            }
-
-            // Generate repo clone instructions
-            function generateRepoInstructions(prNumber, owner, repo, branch) {
-                return `To use the changes in this PR:
-
-            \`\`\`bash
-            # Clone the repository:
-            git clone https://github.com/${owner}/${repo}
-            cd ${repo}
-
-            # Checkout the PR branch:
-            git fetch origin pull/${prNumber}/head:${branch}
-            git checkout ${branch}
-
-            # Install the development version:
-            script/setup
-
-            # Activate the development version:
-            source venv/bin/activate
-            \`\`\`
-
-            Now you can run \`esphome\` as usual to test the changes in this PR.
-            `;
-            }
-
-            async function createComment(octokit, owner, repo, prNumber, esphomeChanges, componentChanges) {
-                const commentMarker = "<!-- This comment was generated automatically by the external-component-bot workflow. -->";
-                const legacyCommentMarker = "<!-- This comment was generated automatically by a GitHub workflow. -->";
-                let commentBody;
-                if (esphomeChanges.length === 1) {
-                    commentBody = generateExternalComponentInstructions(prNumber, componentChanges, owner, repo);
-                } else {
-                    commentBody = generateRepoInstructions(prNumber, owner, repo, context.payload.pull_request.head.ref);
-                }
-                commentBody += `\n\n---\n(Added by the PR bot)\n\n${commentMarker}`;
-
-                // Check for existing bot comment
-                const comments = await github.paginate(
-                    github.rest.issues.listComments,
-                    {
-                        owner: owner,
-                        repo: repo,
-                        issue_number: prNumber,
-                        per_page: 100,
-                    }
-                );
-
-                const sorted = comments.sort((a, b) => new Date(b.updated_at) - new Date(a.updated_at));
-
-                const botComment = sorted.find(comment =>
-                    (
-                      comment.body.includes(commentMarker) ||
-                      comment.body.includes(legacyCommentMarker)
-                    ) && comment.user.type === "Bot"
-                );
-
-                if (botComment && botComment.body === commentBody) {
-                    // No changes in the comment, do nothing
-                    return;
-                }
-
-                if (botComment) {
-                    // Update existing comment
-                    await github.rest.issues.updateComment({
-                        owner: owner,
-                        repo: repo,
-                        comment_id: botComment.id,
-                        body: commentBody,
-                    });
-                } else {
-                    // Create new comment
-                    await github.rest.issues.createComment({
-                        owner: owner,
-                        repo: repo,
-                        issue_number: prNumber,
-                        body: commentBody,
-                    });
-                }
-            }
-
-            async function getEsphomeAndComponentChanges(github, owner, repo, prNumber) {
-                const changedFiles = await github.paginate(
-                    github.rest.pulls.listFiles,
-                    {
-                        owner: owner,
-                        repo: repo,
-                        pull_number: prNumber,
-                        per_page: 100,
-                    }
-                );
-
-                // Files used only for development and CI, which do not affect use as an external component
-                const ignoredFiles = ["esphome/core/defines.h", "esphome/idf_component.yml"];
-                const esphomeChanges = changedFiles
-                    .filter(file => !ignoredFiles.includes(file.filename) && file.filename.startsWith('esphome/'))
-                    .map(file => {
-                        const match = file.filename.match(/esphome\/([^/]+)/);
-                        return match ? match[1] : null;
-                    })
-                    .filter(it => it !== null);
-
-                if (esphomeChanges.length === 0) {
-                    return {esphomeChanges: [], componentChanges: []};
-                }
-
-                const uniqueEsphomeChanges = [...new Set(esphomeChanges)];
-                const componentChanges = changedFiles
-                    .filter(file => file.filename.startsWith('esphome/components/'))
-                    .map(file => {
-                        const match = file.filename.match(/esphome\/components\/([^/]+)\//);
-                        return match ? match[1] : null;
-                    })
-                    .filter(it => it !== null);
-
-                return {esphomeChanges: uniqueEsphomeChanges, componentChanges: [...new Set(componentChanges)]};
-            }
-
-            // Start of main code.
-
-            const prNumber = context.payload.pull_request.number;
-            const {owner, repo} = context.repo;
-
-            const {esphomeChanges, componentChanges} = await getEsphomeAndComponentChanges(github, owner, repo, prNumber);
-            if (componentChanges.length !== 0) {
-                await createComment(github, owner, repo, prNumber, esphomeChanges, componentChanges);
-            }

.github/workflows/issue-codeowner-notify.yml

@@ -1,163 +0,0 @@
-# This workflow automatically notifies codeowners when an issue is labeled with component labels.
-# It reads the CODEOWNERS file to find the maintainers for the labeled components
-# and posts a comment mentioning them to ensure they're aware of the issue.
-
-name: Notify Issue Codeowners
-
-on:
-  issues:
-    types: [labeled]
-
-permissions:
-  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
-  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
-
-jobs:
-  notify-codeowners:
-    name: Run
-    if: ${{ startsWith(github.event.label.name, format('component{0} ', ':')) }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Notify codeowners for component issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const issue_number = context.payload.issue.number;
-            const labelName = context.payload.label.name;
-
-            console.log(`Processing issue #${issue_number} with label: ${labelName}`);
-
-            // Hidden marker to identify bot comments from this workflow
-            const BOT_COMMENT_MARKER = '<!-- issue-codeowner-notify-bot -->';
-
-            // Extract component name from label
-            const componentName = labelName.replace('component: ', '');
-            console.log(`Component: ${componentName}`);
-
-            try {
-              // Fetch CODEOWNERS file from root
-              const { data: codeownersFile } = await github.rest.repos.getContent({
-                owner,
-                repo,
-                path: 'CODEOWNERS'
-              });
-              const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
-
-              // Parse CODEOWNERS file to extract component mappings
-              const codeownersLines = codeownersContent.split('\n')
-                .map(line => line.trim())
-                .filter(line => line && !line.startsWith('#'));
-
-              let componentOwners = null;
-
-              for (const line of codeownersLines) {
-                const parts = line.split(/\s+/);
-                if (parts.length < 2) continue;
-
-                const pattern = parts[0];
-                const owners = parts.slice(1);
-
-                // Look for component patterns: esphome/components/{component}/*
-                const componentMatch = pattern.match(/^esphome\/components\/([^\/]+)\/\*$/);
-                if (componentMatch && componentMatch[1] === componentName) {
-                  componentOwners = owners;
-                  break;
-                }
-              }
-
-              if (!componentOwners) {
-                console.log(`No codeowners found for component: ${componentName}`);
-                return;
-              }
-
-              console.log(`Found codeowners for '${componentName}': ${componentOwners.join(', ')}`);
-
-              // Separate users and teams
-              const userOwners = [];
-              const teamOwners = [];
-
-              for (const owner of componentOwners) {
-                const cleanOwner = owner.startsWith('@') ? owner.slice(1) : owner;
-                if (cleanOwner.includes('/')) {
-                  // Team mention (org/team-name)
-                  teamOwners.push(`@${cleanOwner}`);
-                } else {
-                  // Individual user
-                  userOwners.push(`@${cleanOwner}`);
-                }
-              }
-
-              // Remove issue author from mentions to avoid self-notification
-              const issueAuthor = context.payload.issue.user.login;
-              const filteredUserOwners = userOwners.filter(mention =>
-                mention !== `@${issueAuthor}`
-              );
-
-              // Check for previous comments from this workflow to avoid duplicate pings
-              const comments = await github.paginate(
-                github.rest.issues.listComments,
-                {
-                  owner,
-                  repo,
-                  issue_number: issue_number
-                }
-              );
-
-              const previouslyPingedUsers = new Set();
-              const previouslyPingedTeams = new Set();
-
-              // Look for comments from github-actions bot that contain codeowner pings for this component
-              const workflowComments = comments.filter(comment =>
-                comment.user.type === 'Bot' &&
-                comment.body.includes(BOT_COMMENT_MARKER) &&
-                comment.body.includes(`component: ${componentName}`)
-              );
-
-              // Extract previously mentioned users and teams from workflow comments
-              for (const comment of workflowComments) {
-                // Match @username patterns (not team mentions)
-                const userMentions = comment.body.match(/@([a-zA-Z0-9_.-]+)(?![/])/g) || [];
-                userMentions.forEach(mention => {
-                  previouslyPingedUsers.add(mention); // Keep @ prefix for easy comparison
-                });
-
-                // Match @org/team patterns
-                const teamMentions = comment.body.match(/@[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+/g) || [];
-                teamMentions.forEach(mention => {
-                  previouslyPingedTeams.add(mention);
-                });
-              }
-
-              console.log(`Found ${previouslyPingedUsers.size} previously pinged users and ${previouslyPingedTeams.size} previously pinged teams for component ${componentName}`);
-
-              // Remove previously pinged users and teams
-              const newUserOwners = filteredUserOwners.filter(mention => !previouslyPingedUsers.has(mention));
-              const newTeamOwners = teamOwners.filter(mention => !previouslyPingedTeams.has(mention));
-
-              const allMentions = [...newUserOwners, ...newTeamOwners];
-
-              if (allMentions.length === 0) {
-                console.log('No new codeowners to notify (all previously pinged or issue author is the only codeowner)');
-                return;
-              }
-
-              // Create comment body
-              const mentionString = allMentions.join(', ');
-              const commentBody = `${BOT_COMMENT_MARKER}\n👋 Hey ${mentionString}!\n\nThis issue has been labeled with \`component: ${componentName}\` and you've been identified as a codeowner of this component. Please take a look when you have a chance!\n\nThanks for maintaining this component! 🙏`;
-
-              // Post comment
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number: issue_number,
-                body: commentBody
-              });
-
-              console.log(`Successfully notified new codeowners: ${mentionString}`);
-
-            } catch (error) {
-              console.log('Failed to process codeowner notifications:', error.message);
-              console.error(error);
-            }

.github/workflows/lock.yml

@@ -1,17 +1,29 @@
 ---
-name: Lock closed issues and PRs
+name: Lock
 
+# yamllint disable-line rule:truthy
 on:
   schedule:
-    - cron: "30 0 * * *"  # Run daily at 00:30 UTC
+    - cron: "30 0 * * *"
   workflow_dispatch:
 
-# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
-permissions: {}
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
 
 jobs:
   lock:
-    permissions:
-      issues: write         # issues.lock on closed issues
-      pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # 2026.9.0
+    runs-on: ubuntu-latest
+    steps:
+      - uses: dessant/lock-threads@v4
+        with:
+          pr-inactive-days: "1"
+          pr-lock-reason: ""
+          exclude-any-pr-labels: keep-open
+
+          issue-inactive-days: "7"
+          issue-lock-reason: ""
+          exclude-any-issue-labels: keep-open

.github/workflows/matchers/lint-python.json

@@ -1,11 +1,11 @@
 {
   "problemMatcher": [
     {
-      "owner": "ruff",
+      "owner": "black",
       "severity": "error",
       "pattern": [
         {
-          "regexp": "^(.*): (Please format this file with the ruff formatter)",
+          "regexp": "^(.*): (Please format this file with the black formatter)",
           "file": 1,
           "message": 2
         }

.github/workflows/pr-title-check.yml

@@ -1,98 +0,0 @@
-name: PR Title Check
-
-on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened]
-    branches-ignore:
-      - release
-      - beta
-
-permissions:
-  contents: read       # actions/checkout to load detect-tags.js
-  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
-
-jobs:
-  check:
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const {
-              detectComponents,
-              hasCoreChanges,
-              hasDashboardChanges,
-              hasGitHubActionsChanges,
-            } = require('./.github/scripts/detect-tags.js');
-
-            const title = context.payload.pull_request.title;
-            const user = context.payload.pull_request.user;
-
-            // Skip bot PRs (e.g. dependabot, esphome[bot] device-class sync) -
-            // they have their own title formats.
-            if (user.type === 'Bot') {
-              return;
-            }
-
-            // Block titles starting with "word:" or "word(scope):" patterns
-            const commitStylePattern = /^\w+(\(.*?\))?[!]?\s*:/;
-            if (commitStylePattern.test(title)) {
-              core.setFailed(
-                `PR title should not start with a "prefix:" style format.\n` +
-                `Please use the format: [component] Brief description\n`
-              );
-              return;
-            }
-
-            // Get changed files to detect tags
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-            const filenames = files.map(f => f.filename);
-
-            // Detect tags from changed files using shared logic
-            const tags = new Set();
-
-            for (const comp of detectComponents(filenames)) {
-              tags.add(comp);
-            }
-            if (hasCoreChanges(filenames)) tags.add('core');
-            if (hasDashboardChanges(filenames)) tags.add('dashboard');
-            if (hasGitHubActionsChanges(filenames)) tags.add('ci');
-
-            if (tags.size === 0) {
-              return;
-            }
-
-            // Check for MDX syntax characters not wrapped in backticks.
-            // Astro docs MDX treats bare `<` as JSX component opening tags and
-            // bare `{` as JS expressions, so both must be escaped in changelog entries.
-            const stripped = title.replace(/`[^`]*`/g, '');
-            if (/[<>{}]/.test(stripped)) {
-              core.setFailed(
-                'PR title contains `<`, `>`, `{`, or `}` not wrapped in backticks.\n' +
-                'Astro docs MDX interprets bare `<` as JSX components and bare `{` as JS expressions.\n' +
-                'Please wrap these characters with backticks, e.g.: [component] Add `<feature>` support'
-              );
-              return;
-            }
-
-            // Check title starts with [tag] prefix
-            const bracketPattern = /^\[\w+\]/;
-            if (!bracketPattern.test(title)) {
-              const suggestion = [...tags].map(c => `[${c}]`).join('');
-              // Skip if the suggested prefix would be too long for a readable title
-              if (suggestion.length > 40) {
-                return;
-              }
-              core.setFailed(
-                `PR modifies: ${[...tags].join(', ')}\n` +
-                `Title must start with a [tag] prefix.\n` +
-                `Suggested: ${suggestion} <description>`
-              );
-            }

.github/workflows/release-nightly.yml

@@ -1,38 +0,0 @@
----
-name: Nightly Dev Release
-
-# Works out the dated dev tag and starts the release workflow with it, so that
-# the release run is named after the tag it builds. A workflow run name is
-# fixed when the run starts and cannot read a file or the current date.
-
-on:
-  schedule:
-    - cron: "0 2 * * *"
-
-permissions:
-  contents: read  # actions/checkout to read the version from esphome/const.py
-
-jobs:
-  trigger:
-    name: Start release build
-    if: github.repository == 'esphome/esphome'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read  # actions/checkout to read the version from esphome/const.py
-      actions: write  # gh workflow run starts release.yml
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Start the release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          VERSION=$(sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p" esphome/const.py)
-          if [[ -z "$VERSION" ]]; then
-            echo "::error::Could not read __version__ from esphome/const.py"
-            exit 1
-          fi
-          TAG="${VERSION}$(date --utc '+%Y%m%d')"
-          echo "Starting release build for ${TAG}"
-          gh workflow run release.yml --ref "${GITHUB_REF_NAME}" --field tag="${TAG}"

.github/workflows/release.yml

@@ -1,26 +1,16 @@
 ---
 name: Publish Release
 
-# Releases (production and beta) are named after the version they publish.
-# Dev builds are named after the dated dev tag, which is passed in by the
-# nightly workflow because a run name cannot compute it itself.
-run-name: ${{ github.event.inputs.tag || github.event.release.tag_name || format('Manual build ({0})', github.ref_name) }}
-
+# yamllint disable-line rule:truthy
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: >-
-          Tag to build. Only supported on dev, where the nightly workflow
-          uses it. Leave empty to build the version from esphome/const.py
-          with today's date appended.
-        required: false
-        default: ""
   release:
     types: [published]
+  schedule:
+    - cron: "0 2 * * *"
 
 permissions:
-  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
+  contents: read
 
 jobs:
   init:
@@ -28,191 +18,94 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       tag: ${{ steps.tag.outputs.tag }}
-      branch_build: ${{ steps.tag.outputs.branch_build }}
-      deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v3
       - name: Get tag
         id: tag
-        env:
-          INPUT_TAG: ${{ github.event.inputs.tag }}
         # yamllint disable rule:line-length
         run: |
-          if [[ "${{ github.event_name }}" = "release" ]]; then
-            TAG="${{ github.event.release.tag_name}}"
-            BRANCH_BUILD="false"
-            if [[ "${{ github.event.release.prerelease }}" = "true" ]]; then
-              ENVIRONMENT="beta"
-            else
-              ENVIRONMENT="production"
-            fi
+          if [[ "$GITHUB_EVENT_NAME" = "release" ]]; then
+            TAG="${GITHUB_REF#refs/tags/}"
           else
+            TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
+            today="$(date --utc '+%Y%m%d')"
+            TAG="${TAG}${today}"
             BRANCH=${GITHUB_REF#refs/heads/}
-            # The nightly workflow passes the finished tag so that the run name
-            # matches what is built. Without it, work it out here.
-            TAG="${INPUT_TAG}"
-            if [[ -n "$TAG" && "$BRANCH" != "dev" ]]; then
-              echo "::error::The tag input is only supported on dev. A build from ${BRANCH} has to use the tag worked out here, which carries the branch name, so that it cannot publish over the dev, beta, latest or stable images."
-              exit 1
-            fi
-            if [[ -z "$TAG" ]]; then
-              TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
-              today="$(date --utc '+%Y%m%d')"
-              TAG="${TAG}${today}"
-              if [[ "$BRANCH" != "dev" ]]; then
-                TAG="${TAG}-${BRANCH}"
-              fi
-            fi
             if [[ "$BRANCH" != "dev" ]]; then
-              BRANCH_BUILD="true"
-              ENVIRONMENT=""
-            else
-              BRANCH_BUILD="false"
-              ENVIRONMENT="dev"
+              TAG="${TAG}-${BRANCH}"
             fi
           fi
           echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          echo "branch_build=${BRANCH_BUILD}" >> $GITHUB_OUTPUT
-          echo "deploy_env=${ENVIRONMENT}" >> $GITHUB_OUTPUT
         # yamllint enable rule:line-length
 
   deploy-pypi:
     name: Build and publish to PyPi
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
-    permissions:
-      contents: read   # actions/checkout to build the sdist/wheel
-      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v3
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v4
         with:
           python-version: "3.x"
+      - name: Set up python environment
+        env:
+          ESPHOME_NO_VENV: 1
+        run: |
+          script/setup
+          pip install twine
       - name: Build
-        run: |-
-          pip3 install build
-          python3 -m build
-      - name: Publish
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
-        with:
-          skip-existing: true
+        run: python setup.py sdist bdist_wheel
+      - name: Upload
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: twine upload dist/*
 
   deploy-docker:
-    name: Build ESPHome ${{ matrix.platform.arch }}
+    name: Build and publish ESPHome ${{ matrix.image.title}}
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
-    runs-on: ${{ matrix.platform.os }}
+      contents: read
+      packages: write
+    runs-on: ubuntu-latest
+    continue-on-error: ${{ matrix.image.title == 'lint' }}
     needs: [init]
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - arch: amd64
-            os: "ubuntu-24.04"
-          - arch: arm64
-            os: "ubuntu-24.04-arm"
-
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
-
-      - name: Log in to docker hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          username: ${{ secrets.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-      - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Build docker
-        uses: ./.github/actions/build-image
-        with:
-          target: final
-          build_type: docker
-          suffix: ""
-          version: ${{ needs.init.outputs.tag }}
-
-      - name: Build ha-addon
-        uses: ./.github/actions/build-image
-        with:
-          target: final
-          build_type: ha-addon
-          suffix: "hassio"
-          version: ${{ needs.init.outputs.tag }}
-
-      # - name: Build lint
-      #   uses: ./.github/actions/build-image
-      #   with:
-      #     target: lint
-      #     build_type: lint
-      #     suffix: lint
-      #     version: ${{ needs.init.outputs.tag }}
-
-      - name: Upload digests
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: digests-${{ matrix.platform.arch }}
-          path: /tmp/digests
-          retention-days: 1
-
-  deploy-manifest:
-    name: Publish ESPHome ${{ matrix.image.build_type }} to ${{ matrix.registry }}
-    runs-on: ubuntu-latest
-    needs:
-      - init
-      - deploy-docker
-    if: github.repository == 'esphome/esphome'
-    permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
     strategy:
       fail-fast: false
       matrix:
         image:
-          - build_type: "docker"
-            suffix: ""
-          - build_type: "ha-addon"
+          - title: "ha-addon"
             suffix: "hassio"
-            # - build_type: "lint"
-            #   suffix: "lint"
-        registry:
-          - ghcr
-          - dockerhub
+            target: "hassio"
+            baseimg: "hassio"
+          - title: "docker"
+            suffix: ""
+            target: "docker"
+            baseimg: "docker"
+          - title: "lint"
+            suffix: "lint"
+            target: "lint"
+            baseimg: "docker"
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Download digests
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/checkout@v3
+      - name: Set up Python
+        uses: actions/setup-python@v4
         with:
-          pattern: digests-*
-          path: /tmp/digests
-          merge-multiple: true
+          python-version: "3.9"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
 
       - name: Log in to docker hub
-        if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        if: matrix.registry == 'ghcr'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -221,49 +114,44 @@ jobs:
       - name: Generate short tags
         id: tags
         run: |
-          output=$(docker/generate_tags.py \
+          docker/generate_tags.py \
             --tag "${{ needs.init.outputs.tag }}" \
-            --suffix "${{ matrix.image.suffix }}" \
-            --registry "${{ matrix.registry }}")
-          echo $output
-          for l in $output; do
-            echo $l >> $GITHUB_OUTPUT
-          done
+            --suffix "${{ matrix.image.suffix }}"
 
-      - name: Create manifest list and push
-        working-directory: /tmp/digests/${{ matrix.image.build_type }}/${{ matrix.registry }}
-        run: |
-          docker buildx imagetools create $(jq -Rcnr 'inputs | . / "," | map("-t " + .) | join(" ")' <<< "${{ steps.tags.outputs.tags}}") \
-            $(printf '${{ steps.tags.outputs.image }}@sha256:%s ' *)
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: ./docker/Dockerfile
+          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          target: ${{ matrix.image.target }}
+          push: true
+          # yamllint disable rule:line-length
+          cache-from: type=registry,ref=ghcr.io/${{ steps.tags.outputs.image }}:cache-${{ steps.tags.outputs.channel }}
+          cache-to: type=registry,ref=ghcr.io/${{ steps.tags.outputs.image }}:cache-${{ steps.tags.outputs.channel }},mode=max
+          # yamllint enable rule:line-length
+          tags: ${{ steps.tags.outputs.tags }}
+          build-args: |
+            BASEIMGTYPE=${{ matrix.image.baseimg }}
+            BUILD_VERSION=${{ needs.init.outputs.tag }}
 
-  version-notifier:
-    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
+  deploy-ha-addon-repo:
+    if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
-    needs:
-      - init
-      - deploy-manifest
+    needs: [deploy-docker]
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          owner: esphome
-          repositories: version-notifier
-          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
-
       - name: Trigger Workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v6
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
+          github-token: ${{ secrets.DEPLOY_HA_ADDON_REPO_TOKEN }}
           script: |
-            await github.rest.actions.createWorkflowDispatch({
+            github.rest.actions.createWorkflowDispatch({
               owner: "esphome",
-              repo: "version-notifier",
-              workflow_id: "notify.yml",
+              repo: "home-assistant-addon",
+              workflow_id: "bump-version.yml",
               ref: "main",
               inputs: {
-                version: "${{ needs.init.outputs.tag }}",
+                version: "${{ github.event.release.tag_name }}",
+                content: ${{ toJSON(github.event.release.body) }}
               }
             })

.github/workflows/stale.yml

@@ -1,65 +1,51 @@
 ---
 name: Stale
 
+# yamllint disable-line rule:truthy
 on:
   schedule:
     - cron: "30 0 * * *"
   workflow_dispatch:
 
-# The reusable workflow authenticates as the ESPHome GitHub App, so GITHUB_TOKEN
-# needs no permissions at all.
-permissions: {}
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
 
 jobs:
   stale:
-    if: github.repository_owner == 'esphome'
-    # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
-    # GitHub App token so the labels, comments and closures come from
-    # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@4fbce13026c393d6eb6b247e394dcd9ef1af76c2  # main
-    secrets:
-      ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-    with:
-      # Live only on dev: a workflow_dispatch from any other branch is a dry run
-      dry-run: ${{ github.ref != 'refs/heads/dev' }}
-      days-before-stale: 90
-      days-before-stale-conflicting: 30
-      days-before-close: 7
-      stale-label: stale
-      exempt-label: not-stale
-      conflict-label: needs-rebase
-      ignored-users: esphbot,codecov-commenter
-      stale-pr-message: >
-        There hasn't been any activity on this pull request recently. This
-        pull request has been automatically marked as stale because of that
-        and will be closed if no further activity occurs within 7 days.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v8
+        with:
+          days-before-pr-stale: 90
+          days-before-pr-close: 7
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+          remove-stale-when-updated: true
+          stale-pr-label: "stale"
+          exempt-pr-labels: "not-stale"
+          stale-pr-message: >
+            There hasn't been any activity on this pull request recently. This
+            pull request has been automatically marked as stale because of that
+            and will be closed if no further activity occurs within 7 days.
+            Thank you for your contributions.
 
-        If you are the author of this PR, please leave a comment if you want
-        to keep it open. Also, please merge the latest dev branch into your
-        branch to ensure that it's up to date with the latest changes.
-
-        Thank you for your contribution!
-      conflict-pr-message: >
-        This pull request has merge conflicts. Please merge the latest dev
-        branch into your branch to resolve them.
-      stale-conflicting-pr-message: >
-        The merge conflicts on this pull request have not been resolved for
-        30 days, so it has been marked as stale and will be closed if they
-        are not resolved within 7 days.
-
-        Please merge the latest dev branch into your branch. Once the pull
-        request is mergeable again the stale label is removed.
-
-        Thank you for your contribution!
-      stale-issue-message: >
-        There hasn't been any activity on this issue recently. Due to the
-        high number of incoming GitHub notifications, we have to clean some
-        of the old issues, as many of them have already been resolved with
-        the latest updates.
-
-        Please make sure to update to the latest ESPHome version and
-        check if that solves the issue. Let us know if that works for you by
-        adding a comment 👍
-
-        This issue has now been marked as stale and will be closed if no
-        further activity occurs. Thank you for your contributions.
+  # Use stale to automatically close issues with a
+  # reference to the issue tracker
+  close-issues:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v8
+        with:
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          days-before-issue-stale: 1
+          days-before-issue-close: 1
+          remove-stale-when-updated: true
+          stale-issue-label: "stale"
+          exempt-issue-labels: "not-stale"
+          stale-issue-message: >
+            https://github.com/esphome/esphome/issues/430

.github/workflows/status-check-labels.yml

@@ -1,29 +0,0 @@
-name: Status check labels
-
-on:
-  pull_request:
-    types: [opened, reopened, labeled, unlabeled, synchronize]
-
-permissions:
-  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, needs-developer-docs, merge-after-release, chained-pr)
-
-jobs:
-  check:
-    name: Check blocking labels
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check for blocking labels
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const blockingLabels = ['needs-docs', 'needs-developer-docs', 'merge-after-release', 'chained-pr'];
-            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number
-            });
-            const labelNames = labels.map(l => l.name);
-            const found = blockingLabels.filter(bl => labelNames.includes(bl));
-            if (found.length > 0) {
-              core.setFailed(`Pull request cannot be merged, it has blocking label(s): ${found.join(', ')}`);
-            }

.github/workflows/sync-dependency-versions.yml

@@ -1,96 +0,0 @@
-# Keeps pre-commit hook revs in sync with the requirements files.
-#
-# Dependabot only bumps the pins in requirements*.txt. Some of those tools
-# are pinned again as hook revs in .pre-commit-config.yaml. This workflow
-# runs script/sync_dependency_versions.py against the pull request branch
-# and pushes a commit with the revs updated.
-
-name: Sync dependency versions
-
-on:
-  # pull_request_target rather than pull_request so the App secret is
-  # available on Dependabot pull requests (pull_request runs opened by
-  # Dependabot only see Dependabot secrets). The job below only touches
-  # branches in this repository and only ever executes the script from the
-  # base branch checkout, so fork code never runs with the token.
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    branches:
-      - dev
-    paths:
-      - requirements_dev.txt
-      - requirements_test.txt
-      - .pre-commit-config.yaml
-      - script/sync_dependency_versions.py
-
-# The push to the pull request branch uses the App token minted below, so
-# the workflow's GITHUB_TOKEN does not need any scopes.
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  sync:
-    name: Sync pinned versions
-    runs-on: ubuntu-latest
-    # Same-repository branches only: a push to a fork is not possible with
-    # this token, and it keeps untrusted heads out of a privileged job.
-    if: >-
-      github.repository == 'esphome/esphome'
-      && github.event.pull_request.head.repo.full_name == github.repository
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # A push made with the workflow's own GITHUB_TOKEN would not start
-          # CI on the new commit; a push with the App token does.
-          permission-contents: write  # git push of the sync commit to the pull request branch
-
-      - name: Check out base branch
-        # Provides the script that runs below. Deliberately the base branch
-        # so the pull request cannot change what executes here.
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          persist-credentials: false
-
-      - name: Check out pull request branch
-        # No allow-unsafe-pr-checkout here on purpose: checkout v7 only
-        # refuses heads that live in a different repository, and the job
-        # condition above already limits runs to same-repository branches.
-        # Leaving it off keeps that refusal as a backstop for fork heads.
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          path: pull-request
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install yamlrocks
-        # The script edits YAML through yamlrocks. Take the pin from the
-        # base branch requirements so this workflow has no copy of its own.
-        run: pip install "$(grep -E '^yamlrocks==' requirements_test.txt | cut -d'#' -f1)"
-
-      - name: Sync pinned versions
-        run: python script/sync_dependency_versions.py --root pull-request
-
-      - name: Push changes
-        working-directory: pull-request
-        run: |
-          if git diff --quiet; then
-            echo "All pinned versions already match the requirements files."
-            exit 0
-          fi
-          git config user.name "esphome[bot]"
-          git config user.email "115708604+esphome[bot]@users.noreply.github.com"
-          git commit -am "Sync pinned tool versions with requirements files"
-          git push

.github/workflows/sync-device-classes.yml

@@ -4,12 +4,8 @@ name: Synchronise Device Classes from Home Assistant
 on:
   workflow_dispatch:
   schedule:
-    - cron: "45 6 * * *"
+    - cron: '45 6 * * *'
 
-# Repo writes (branch push, PR open) happen via the App token minted below,
-# so the workflow's GITHUB_TOKEN does not need any write scopes.
-permissions:
-  contents: read  # actions/checkout for this repo and home-assistant/core
 
 jobs:
   sync:
@@ -17,89 +13,37 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'esphome/esphome'
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
-          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
-          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
-
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v3
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v3
         with:
           repository: home-assistant/core
           path: lib/home-assistant
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v4
         with:
-          python-version: "3.14"
-
-      - name: Set up uv
-        # An order of magnitude faster than pip on cold boots, with its
-        # own wheel cache. ``--system`` (below) installs into the
-        # setup-python interpreter so subsequent ``prek`` /
-        # ``script/run-in-env.py`` steps find the deps without a
-        # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          enable-cache: true
-          # Pin uv version so the action does not have to fetch the
-          # manifest from raw.githubusercontent.com on every cache
-          # miss; that fetch flakes on Windows runners.
-          version: "0.11.15"
+          python-version: 3.11
 
       - name: Install Home Assistant
         run: |
-          uv pip install --system -e lib/home-assistant
-          uv pip install --system -r requirements.txt -r requirements_test.txt
+          python -m pip install --upgrade pip
+          pip install -e lib/home-assistant
 
       - name: Sync
         run: |
           python ./script/sync-device_class.py
 
-      - name: Apply prek auto-fixes
-        # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
-        # files. prek exits non-zero whenever a hook touches anything,
-        # which would otherwise abort the workflow before the auto-fixes
-        # can flow into the sync PR.
-        #
-        # PREK_SKIP:
-        #   - no-commit-to-branch is a local guard against committing on
-        #     dev/release/beta; CI runs on dev by definition, and
-        #     peter-evans/create-pull-request creates the branch itself.
-        #   - pylint surfaces import-error / relative-beyond-top-level
-        #     noise here because this workflow installs only a subset of
-        #     the runtime deps (HA + requirements*.txt); main CI already
-        #     gates pylint on real PRs.
-        env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files || true
-
-      - name: Verify prek clean
-        # Second pass: re-run all hooks against the now-fixed tree.
-        # Auto-fixers exit 0 (nothing to change); any remaining failure
-        # from a check-only hook (flake8 / yamllint / ci-custom) is a
-        # real issue and fails the workflow loudly. Same PREK_SKIP list as
-        # above for the same reasons.
-        env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files
-
       - name: Commit changes
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@v5
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
-          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          committer: esphomebot <esphome@nabucasa.com>
+          author: esphomebot <esphome@nabucasa.com>
           branch: sync/device-classes
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"
           body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}

.github/workflows/sync-integration-durations.yml

@@ -1,98 +0,0 @@
----
-name: Refresh integration test durations
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "45 5 * * 1"
-
-# Repo writes (branch push, PR open) happen via the App token minted below,
-# so the workflow's GITHUB_TOKEN does not need any write scopes.
-permissions:
-  contents: read
-  actions: read  # gh api / gh run download for the CI junit artifacts
-
-jobs:
-  sync:
-    name: Refresh integration test durations
-    runs-on: ubuntu-latest
-    if: github.repository == 'esphome/esphome'
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          permission-contents: write       # push the sync branch
-          permission-pull-requests: write  # open or refresh the sync PR
-
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.13"
-
-      - name: Refresh from the newest usable dev run
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # Only full matrix dev runs upload junit-integration-* artifacts
-          # (see the integration-tests job); the merge script re-checks
-          # coverage regardless.
-          # Newest-first candidates via their bucket-0 artifact. Fork PRs run
-          # their own ci.yml, so name and branch are spoofable; require
-          # same-repo. Assignment failures trip set -e and fail loudly.
-          candidates=$(
-            gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=junit-integration-0&per_page=100" \
-              --jq '.artifacts[] | select(.expired | not) | .workflow_run
-                    | select(.head_branch == "dev" and .head_repository_id != null
-                             and .head_repository_id == .repository_id)
-                    | .id'
-          )
-          # Green runs first, then the rest newest first; a run missing a
-          # bucket fails the coverage check and the next one is tried
-          green=""
-          rest=""
-          for id in ${candidates}; do
-            conclusion=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${id}" --jq '.conclusion // ""')
-            if [ "${conclusion}" = "success" ]; then
-              green="${green} ${id}"
-            elif [ -n "${conclusion}" ]; then
-              rest="${rest} ${id}"
-            fi
-          done
-          # helpers.py imports colorama; the script needs nothing else
-          pip install colorama
-          for id in ${green} ${rest}; do
-            rm -rf /tmp/junit
-            if ! gh run download "${id}" --repo "${GITHUB_REPOSITORY}" -p "junit-integration-*" -D /tmp/junit; then
-              echo "::warning::Could not download artifacts for run ${id}; trying the next"
-              continue
-            fi
-            status=0
-            python script/update_integration_test_durations.py /tmp/junit || status=$?
-            if [ "${status}" -eq 0 ]; then
-              echo "Refreshed from run ${id}"
-              exit 0
-            fi
-            # Only EXIT_LOW_COVERAGE (3) from the script advances to the next run
-            [ "${status}" -eq 3 ] || exit 1
-            echo "::warning::Run ${id} covers too few test files; trying the next"
-          done
-          echo "::error::No dev CI run with usable junit artifacts in range; the feed is starved"
-          exit 1
-
-      - name: Commit changes
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          commit-message: "[ci] Refresh integration test durations"
-          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          branch: sync/integration-durations
-          delete-branch: true
-          title: "[ci] Refresh integration test durations"
-          body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ steps.generate-token.outputs.token }}

.gitignore

@@ -13,12 +13,6 @@ __pycache__/
 # Intellij Idea
 .idea
 
-# Eclipse
-.project
-.cproject
-.pydevproject
-.settings/
-
 # Vim
 *.swp
 
@@ -75,9 +69,6 @@ cov.xml
 # pyenv
 .python-version
 
-# asdf
-.tool-versions
-
 # Environments
 .env
 .venv
@@ -91,10 +82,6 @@ venv-*/
 # mypy
 .mypy_cache/
 
-# nix
-/default.nix
-/shell.nix
-
 .pioenvs
 .piolibdeps
 .pio
@@ -133,24 +120,13 @@ CTestTestfile.cmake
 .gcc-flags.json
 
 config/
-# Test fixture config/ directories are tracked (the rule above is the dashboard dir)
-!tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
-# Output kept by failing tests for inspection; uploaded by CI
-test_artifacts/
 /.temp-clang-tidy.cpp
 /.temp/
 .pio/
 
 sdkconfig.*
 !sdkconfig.defaults
-!sdkconfig.defaults.*
 
-.tests/
-
-/components
-/managed_components
-/dependencies.lock
-
-api-docs/
+.tests/

.pre-commit-config.yaml

@@ -1,64 +1,33 @@
 ---
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
-ci:
-  autoupdate_commit_msg: 'pre-commit: autoupdate'
-  autoupdate_schedule: off  # Disabled until ruff versions are synced between deps and pre-commit
-  # Skip hooks that have issues in pre-commit CI environment
-  skip: [pylint]
-
 repos:
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    # Ruff version.
-    rev: v0.17.0
+  - repo: https://github.com/psf/black
+    rev: 23.3.0
     hooks:
-      # Run the linter.
-      - id: ruff
-        args: [--fix]
-      # Run the formatter.
-      - id: ruff-format
+      - id: black
+        args:
+          - --safe
+          - --quiet
+        files: ^((esphome|script|tests)/.+)?[^/]+\.py$
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.4.1
+    rev: 6.0.0
     hooks:
       - id: flake8
         additional_dependencies:
-          - flake8-docstrings==1.7.0
+          - flake8-docstrings==1.5.0
           - pydocstyle==5.1.1
         files: ^(esphome|tests)/.+\.py$
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v3.4.0
     hooks:
       - id: no-commit-to-branch
         args:
           - --branch=dev
           - --branch=release
           - --branch=beta
-      - id: end-of-file-fixer
-      - id: trailing-whitespace
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.22.0
+    rev: v3.7.0
     hooks:
       - id: pyupgrade
-        args: [--py312-plus]
-  - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.38.0
-    hooks:
-      - id: yamllint
-        exclude: ^(\.clang-format|\.clang-tidy)$
-  - repo: https://github.com/pre-commit/mirrors-clang-format
-    rev: v13.0.1
-    hooks:
-      - id: clang-format
-        types_or: [c, c++]
-  - repo: local
-    hooks:
-      - id: pylint
-        name: pylint
-        entry: python script/run-in-env.py pylint
-        language: system
-        types: [python]
-        files: ^esphome/.+\.py$
-      - id: ci-custom
-        name: ci-custom
-        entry: python script/run-in-env.py script/ci-custom.py
-        language: system
+        args: [--py39-plus]

.yamllint

@@ -1,19 +1,3 @@
 ---
-extends: default
-
-ignore-from-file: .gitignore
-
-rules:
-  document-start: disable
-  empty-lines:
-    level: error
-    max: 1
-    max-start: 0
-    max-end: 1
-  indentation:
-    level: error
-    spaces: 2
-    indent-sequences: true
-    check-multi-line-strings: false
-  line-length: disable
-  truthy: disable
+ignore: |
+  venv/

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

CODEOWNERS

@@ -6,408 +6,174 @@
 # the integration's code owner is automatically notified.
 
 # Core Code
-pyproject.toml @esphome/core
+setup.py @esphome/core
 esphome/*.py @esphome/core
 esphome/core/* @esphome/core
-.github/** @esphome/core
 
 # Integrations
-esphome/components/a01nyub/* @MrSuicideParrot
-esphome/components/a02yyuw/* @TH-Braemer
 esphome/components/absolute_humidity/* @DAVe3283
 esphome/components/ac_dimmer/* @glmnet
 esphome/components/adc/* @esphome/core
 esphome/components/adc128s102/* @DeerMaximum
 esphome/components/addressable_light/* @justfalter
-esphome/components/ade7953/* @angelnu
-esphome/components/ade7953_base/* @angelnu
-esphome/components/ade7953_i2c/* @angelnu
-esphome/components/ade7953_spi/* @angelnu
-esphome/components/ads1118/* @solomondg1
-esphome/components/ags10/* @mak-42
-esphome/components/aic3204/* @kbx81
 esphome/components/airthings_ble/* @jeromelaban
 esphome/components/airthings_wave_base/* @jeromelaban @ncareau
 esphome/components/airthings_wave_mini/* @ncareau
-esphome/components/airthings_wave_plus/* @jeromelaban @precurse
-esphome/components/alarm_control_panel/* @grahambrown11 @hwstar
-esphome/components/alpha3/* @jan-hofmeier
-esphome/components/am2315c/* @swoboda1337
+esphome/components/airthings_wave_plus/* @jeromelaban
+esphome/components/alarm_control_panel/* @grahambrown11
 esphome/components/am43/* @buxtronix
 esphome/components/am43/cover/* @buxtronix
 esphome/components/am43/sensor/* @buxtronix
 esphome/components/analog_threshold/* @ianchi
 esphome/components/animation/* @syndlex
 esphome/components/anova/* @buxtronix
-esphome/components/apc1/* @ademuri
-esphome/components/apc_proteous/* @clydebarrow
-esphome/components/apds9306/* @aodrenah
-esphome/components/apds9930/* @iyesin
-esphome/components/api/* @esphome/core
-esphome/components/aqi/* @freekode @jasstrong @ximex
-esphome/components/aranet/* @patrickod
-esphome/components/as5600/* @ammmze
-esphome/components/as5600/sensor/* @ammmze
+esphome/components/api/* @OttoWinter
 esphome/components/as7341/* @mrgnr
-esphome/components/as734x/* @latonita @mrgnr
-esphome/components/async_tcp/* @esphome/core
-esphome/components/at581x/* @X-Ryl669
+esphome/components/async_tcp/* @OttoWinter
 esphome/components/atc_mithermometer/* @ahpohl
-esphome/components/atm90e26/* @danieltwagner
-esphome/components/atm90e32/* @circuitsetup @descipher
-esphome/components/audio/* @kahrendt
-esphome/components/audio_adc/* @kbx81
-esphome/components/audio_dac/* @kbx81
-esphome/components/audio_file/* @kahrendt
-esphome/components/audio_file/media_source/* @kahrendt
-esphome/components/audio_http/* @kahrendt
-esphome/components/axs15231/* @clydebarrow
 esphome/components/b_parasite/* @rbaron
 esphome/components/ballu/* @bazuchan
 esphome/components/bang_bang/* @OttoWinter
 esphome/components/bedjet/* @jhansche
 esphome/components/bedjet/climate/* @jhansche
 esphome/components/bedjet/fan/* @jhansche
-esphome/components/bedjet/sensor/* @javawizard @jhansche
-esphome/components/beken_spi_led_strip/* @Mat931
-esphome/components/bh1745/* @latonita
 esphome/components/bh1750/* @OttoWinter
-esphome/components/bh1900nux/* @B48D81EFCC
 esphome/components/binary_sensor/* @esphome/core
-esphome/components/bk72xx/* @kuba2k2
-esphome/components/bk72xx_ble/* @Bl00d-B0b
-esphome/components/bk72xx_ble_tracker/* @Bl00d-B0b
-esphome/components/bl0906/* @athom-tech @jesserockz @tarontop
 esphome/components/bl0939/* @ziceva
-esphome/components/bl0940/* @dan-s-github @tobias-
-esphome/components/bl0942/* @dbuezas @dwmw2
-esphome/components/ble_client/* @buxtronix @clydebarrow
-esphome/components/ble_device_base/* @Bl00d-B0b
-esphome/components/ble_nus/* @tomaszduda23
-esphome/components/bluetooth_connection/* @bdraco @jesserockz
-esphome/components/bluetooth_proxy/* @bdraco @jesserockz
-esphome/components/bm8563/* @abmantis
-esphome/components/bme280_base/* @esphome/core
-esphome/components/bme280_spi/* @apbodrov
+esphome/components/bl0940/* @tobias-
+esphome/components/bl0942/* @dbuezas
+esphome/components/ble_client/* @buxtronix
+esphome/components/bluetooth_proxy/* @jesserockz
 esphome/components/bme680_bsec/* @trvrnrth
-esphome/components/bme68x_bsec2/* @kbx81 @neffs
-esphome/components/bme68x_bsec2_i2c/* @kbx81 @neffs
-esphome/components/bmi160/* @flaviut
-esphome/components/bmi270/* @clydebarrow
-esphome/components/bmp280_base/* @ademuri
-esphome/components/bmp280_i2c/* @ademuri
-esphome/components/bmp280_spi/* @ademuri
-esphome/components/bmp3xx/* @latonita
-esphome/components/bmp3xx_base/* @latonita @martgras
-esphome/components/bmp3xx_i2c/* @latonita
-esphome/components/bmp3xx_spi/* @latonita
-esphome/components/bmp581_base/* @danielkent-net @kahrendt
-esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
-esphome/components/bmp581_spi/* @danielkent-net @kahrendt
+esphome/components/bmp3xx/* @martgras
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
-esphome/components/bq25186/* @Rapsssito
-esphome/components/bq27220/* @rggammon
-esphome/components/bq76972/* @limpkin
-esphome/components/bridge/* @kbx81
-esphome/components/bthome_mithermometer/* @nagyrobi
 esphome/components/button/* @esphome/core
-esphome/components/bytebuffer/* @clydebarrow
-esphome/components/camera/* @bdraco @DT-art1
-esphome/components/camera_encoder/* @DT-art1
 esphome/components/canbus/* @danielschramm @mvturnho
-esphome/components/cap1188/* @mreditor97
-esphome/components/captive_portal/* @esphome/core
-esphome/components/cc1101/* @gabest11 @lygris
+esphome/components/cap1188/* @MrEditor97
+esphome/components/captive_portal/* @OttoWinter
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
-esphome/components/cdc_acm_uart/* @kbx81
-esphome/components/cdc_acm_uart/bridge/* @kbx81
-esphome/components/ch422g/* @clydebarrow @jesterret
-esphome/components/ch423/* @dwmw2
-esphome/components/chsc6x/* @kkosik20
 esphome/components/climate/* @esphome/core
 esphome/components/climate_ir/* @glmnet
-esphome/components/cm1106/* @andrewjswan
 esphome/components/color_temperature/* @jesserockz
-esphome/components/combination/* @Cat-Ion @kahrendt
-esphome/components/const/* @esphome/core
 esphome/components/coolix/* @glmnet
 esphome/components/copy/* @OttoWinter
-esphome/components/counter/* @clydebarrow
 esphome/components/cover/* @esphome/core
 esphome/components/cs5460a/* @balrog-kun
 esphome/components/cse7761/* @berfenger
-esphome/components/cst226/* @clydebarrow
-esphome/components/cst328/* @latonita
-esphome/components/cst816/* @clydebarrow
-esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
-esphome/components/d01/* @ch604
 esphome/components/dac7678/* @NickB1
-esphome/components/daikin_arc/* @MagicBear
 esphome/components/daikin_brc/* @hagak
-esphome/components/dallas_temp/* @ssieb
 esphome/components/daly_bms/* @s1lvi0
 esphome/components/dashboard_import/* @esphome/core
-esphome/components/datetime/* @jesserockz @rfdarter
-esphome/components/debug/* @esphome/core
+esphome/components/debug/* @OttoWinter
 esphome/components/delonghi/* @grob6000
-esphome/components/dew_point/* @CFlix
 esphome/components/dfplayer/* @glmnet
-esphome/components/dfrobot_sen0395/* @niklasweber
-esphome/components/dfrobot_sen0609/* @remcom
 esphome/components/dht/* @OttoWinter
 esphome/components/display_menu_base/* @numo68
-esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
-esphome/components/ds1603l/* @JakeLC15
-esphome/components/ds2484/* @mrk-its
-esphome/components/ds248x/* @tomwellnitz
-esphome/components/ds3231/* @linkedupbits
-esphome/components/dsmr/* @glmnet @PolarGoose
-esphome/components/duty_time/* @dudanov
-esphome/components/ecocomfort2/* @gledian
+esphome/components/dsmr/* @glmnet @zuidwijk
 esphome/components/ee895/* @Stock-M
-esphome/components/ektf2232/touchscreen/* @jesserockz
-esphome/components/emc2101/* @ellull
-esphome/components/emmeti/* @E440QF
-esphome/components/emontx/* @FredM67 @glynhudson @TrystanLea
-esphome/components/ens160/* @latonita
-esphome/components/ens160_base/* @latonita @vincentscode
-esphome/components/ens160_i2c/* @latonita
-esphome/components/ens160_spi/* @latonita
+esphome/components/ektf2232/* @jesserockz
 esphome/components/ens210/* @itn3rd77
-esphome/components/epaper_spi/* @esphome/core
-esphome/components/es7210/* @kahrendt
-esphome/components/es7243e/* @kbx81
-esphome/components/es8156/* @kbx81
-esphome/components/es8311/* @kahrendt @kroimon
-esphome/components/es8388/* @P4uLT
-esphome/components/es9038q2m_katana/* @GioMez
 esphome/components/esp32/* @esphome/core
-esphome/components/esp32_ble/* @bdraco @jesserockz @Rapsssito
-esphome/components/esp32_ble_client/* @bdraco @jesserockz
-esphome/components/esp32_ble_server/* @clydebarrow @jesserockz @Rapsssito
-esphome/components/esp32_ble_tracker/* @bdraco
+esphome/components/esp32_ble/* @jesserockz
+esphome/components/esp32_ble_client/* @jesserockz
+esphome/components/esp32_ble_server/* @jesserockz
 esphome/components/esp32_camera_web_server/* @ayufan
 esphome/components/esp32_can/* @Sympatron
-esphome/components/esp32_hosted/* @swoboda1337
-esphome/components/esp32_hosted/update/* @swoboda1337
-esphome/components/esp32_power_management/* @rwrozelle
-esphome/components/esp32_rmt/* @jesserockz
+esphome/components/esp32_improv/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
-esphome/components/esp_ldo/* @clydebarrow
-esphome/components/espectre/* @francescopace
-esphome/components/esphome/ota/* @esphome/core
-esphome/components/espnow/* @jesserockz
-esphome/components/espnow/packet_transport/* @EasilyBoredEngineer
 esphome/components/ethernet_info/* @gtjadsonsantos
-esphome/components/event/* @nohat
-esphome/components/exponential_moving_average/* @clydebarrow
 esphome/components/exposure_notifications/* @OttoWinter
 esphome/components/ezo/* @ssieb
 esphome/components/ezo_pmp/* @carlos-sarmiento
-esphome/components/ezsp_proxy_tap/* @kbx81 @puddly
 esphome/components/factory_reset/* @anatoly-savchenkov
 esphome/components/fastled_base/* @OttoWinter
 esphome/components/feedback/* @ianchi
-esphome/components/file/* @esphome/core
-esphome/components/filter_lifetime/* @tuct
-esphome/components/fingerprint_grow/* @alexborro @loongyh @OnFreund
-esphome/components/font/* @clydebarrow @esphome/core
-esphome/components/friedrich/* @rwrozelle
+esphome/components/fingerprint_grow/* @OnFreund @loongyh
 esphome/components/fs3000/* @kahrendt
-esphome/components/ft5x06/* @clydebarrow
-esphome/components/ft63x6/* @gpambrozio
-esphome/components/fusb302b/* @remcom
-esphome/components/gcja5/* @gcormier
-esphome/components/gdk101/* @Szewcson
-esphome/components/gl_r01_i2c/* @pkejval
 esphome/components/globals/* @esphome/core
-esphome/components/gp2y1010au0f/* @zry98
-esphome/components/gp8403/* @jesserockz @sebydocky
+esphome/components/gp8403/* @jesserockz
 esphome/components/gpio/* @esphome/core
-esphome/components/gpio/one_wire/* @ssieb
-esphome/components/gps/* @coogle @ximex
+esphome/components/gps/* @coogle
 esphome/components/graph/* @synco
-esphome/components/graphical_display_menu/* @MrMDavidson
-esphome/components/gree/* @orestismers
-esphome/components/gree/switch/* @nagyrobi
-esphome/components/grove_gas_mc_v2/* @YorkshireIoT
-esphome/components/grove_tb6612fng/* @max246
 esphome/components/growatt_solar/* @leeuwte
-esphome/components/gsl3670/* @clydebarrow
-esphome/components/gt911/* @clydebarrow @jesserockz
 esphome/components/haier/* @paveldn
-esphome/components/haier/binary_sensor/* @paveldn
-esphome/components/haier/button/* @paveldn
-esphome/components/haier/select/* @paveldn
-esphome/components/haier/sensor/* @paveldn
-esphome/components/haier/switch/* @paveldn
-esphome/components/haier/text_sensor/* @paveldn
-esphome/components/haier_tundra/* @fauxpark
-esphome/components/haier_tundra/button/* @fauxpark
-esphome/components/haier_tundra/switch/* @fauxpark
-esphome/components/haier_water_heater/* @TheLexus
 esphome/components/havells_solar/* @sourabhjaiswal
 esphome/components/hbridge/fan/* @WeekendWarrior
 esphome/components/hbridge/light/* @DotNetDann
-esphome/components/hbridge/switch/* @dwmw2
-esphome/components/hc8/* @omartijn
-esphome/components/hdc2010/* @optimusprimespace @ssieb
-esphome/components/hdc2080/* @G-Pereira @jesserockz
-esphome/components/hdc302x/* @joshuasing
-esphome/components/hdmi_cec/* @JosVanEijndhoven
-esphome/components/he60r/* @clydebarrow
 esphome/components/heatpumpir/* @rob-deutsch
 esphome/components/hitachi_ac424/* @sourabhjaiswal
-esphome/components/hlk_fm22x/* @OnFreund
-esphome/components/hlw8032/* @rici4kubicek
 esphome/components/hm3301/* @freekode
-esphome/components/hmac_md5/* @dwmw2
-esphome/components/hmac_sha256/* @dwmw2
-esphome/components/hoermann_hcp/* @zweckj
-esphome/components/homeassistant/* @esphome/core @OttoWinter
-esphome/components/homeassistant/button/* @jesserockz
-esphome/components/homeassistant/number/* @landonr
-esphome/components/homeassistant/select/* @jesserockz
-esphome/components/homeassistant/switch/* @Links2004
-esphome/components/homeassistant/text/* @jesserockz
-esphome/components/honeywell_hih_i2c/* @Benichou34
+esphome/components/homeassistant/* @OttoWinter
 esphome/components/honeywellabp/* @RubyBailey
-esphome/components/honeywellabp2_i2c/* @jpfaff
-esphome/components/host/* @clydebarrow @esphome/core
-esphome/components/host/time/* @clydebarrow
+esphome/components/host/* @esphome/core
 esphome/components/hrxl_maxsonar_wr/* @netmikey
 esphome/components/hte501/* @Stock-M
-esphome/components/http_request/ota/* @oarcher
-esphome/components/http_request/update/* @jesserockz
-esphome/components/htu31d/* @betterengineering
-esphome/components/hub75/* @stuartparmenter
-esphome/components/husb238/* @latonita
 esphome/components/hydreon_rgxx/* @functionpointer
 esphome/components/hyt271/* @Philippe12
 esphome/components/i2c/* @esphome/core
-esphome/components/i2c_device/* @gabest11
 esphome/components/i2s_audio/* @jesserockz
+esphome/components/i2s_audio/media_player/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
-esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
-esphome/components/i2s_clockless_led_strip/* @j9brown
-esphome/components/iaqcore/* @yozik04
-esphome/components/icm20689/* @lboue
-esphome/components/icnt86/* @danepowell
-esphome/components/ili9xxx/* @clydebarrow @nielsnl68
+esphome/components/i2s_audio/speaker/* @jesserockz
+esphome/components/ili9xxx/* @nielsnl68
 esphome/components/improv_base/* @esphome/core
-esphome/components/improv_ble/* @jesserockz
 esphome/components/improv_serial/* @esphome/core
-esphome/components/ina226/* @latonita @Sergio303
-esphome/components/ina260/* @mreditor97
-esphome/components/ina2xx_base/* @latonita
-esphome/components/ina2xx_i2c/* @latonita
-esphome/components/ina2xx_spi/* @latonita
-esphome/components/infrared/* @kbx81
+esphome/components/ina260/* @MrEditor97
 esphome/components/inkbird_ibsth1_mini/* @fkirill
-esphome/components/inkplate/* @jesserockz @JosipKuci
+esphome/components/inkplate6/* @jesserockz
 esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
-esphome/components/ir_rf_base/* @bdraco @kbx81
-esphome/components/ir_rf_proxy/* @kbx81
-esphome/components/it8951/* @koosoli @limengdu @Passific
-esphome/components/jsn_sr04t/* @Mafus1
-esphome/components/json/* @esphome/core
-esphome/components/kamstrup_kmp/* @cfeenstra1024
+esphome/components/json/* @OttoWinter
+esphome/components/kalman_combinator/* @Cat-Ion
 esphome/components/key_collector/* @ssieb
 esphome/components/key_provider/* @ssieb
 esphome/components/kuntze/* @ssieb
-esphome/components/lc709203f/* @ilikecake
 esphome/components/lcd_menu/* @numo68
-esphome/components/ld2410/* @regevbr @sebcaps
-esphome/components/ld2410s/* @NovakIrs
-esphome/components/ld2412/* @Rihan9
-esphome/components/ld2420/* @descipher
-esphome/components/ld2450/* @hareeshmu
-esphome/components/ld2460/* @jesusvallejo
-esphome/components/ld24xx/* @kbx81
-esphome/components/ld6002b/* @hepter
+esphome/components/ld2410/* @sebcaps
 esphome/components/ledc/* @OttoWinter
-esphome/components/libretiny/* @kuba2k2
-esphome/components/libretiny_pwm/* @kuba2k2
 esphome/components/light/* @esphome/core
-esphome/components/lightwaverf/* @max246
 esphome/components/lilygo_t5_47/touchscreen/* @jesserockz
-esphome/components/lis2dw12/* @latonita
-esphome/components/lis2dw12_i2c/* @latonita
-esphome/components/lis2dw12_spi/* @latonita
-esphome/components/lis3dh/* @zebble
-esphome/components/lm75b/* @beormund
-esphome/components/ln882h_ble/* @Bl00d-B0b
-esphome/components/ln882h_ble_tracker/* @Bl00d-B0b
-esphome/components/ln882x/* @lamauny
 esphome/components/lock/* @esphome/core
 esphome/components/logger/* @esphome/core
-esphome/components/logger/select/* @clydebarrow
-esphome/components/lp5562/* @DennisGaida
-esphome/components/lps22/* @nagisa
-esphome/components/lsm6ds/* @clydebarrow
-esphome/components/ltr390/* @latonita @sjtrny
-esphome/components/ltr501/* @latonita
-esphome/components/ltr_als_ps/* @latonita
-esphome/components/lvgl/* @clydebarrow
-esphome/components/m5stack_8angle/* @rnauber
-esphome/components/mapping/* @clydebarrow
+esphome/components/ltr390/* @sjtrny
 esphome/components/matrix_keypad/* @ssieb
-esphome/components/max17043/* @blacknell
-esphome/components/max17048/* @B48D81EFCC
 esphome/components/max31865/* @DAVe3283
-esphome/components/max31888/* @JiriPrchal
 esphome/components/max44009/* @berfenger
 esphome/components/max6956/* @looping40
 esphome/components/max7219digit/* @rspaargaren
 esphome/components/max9611/* @mckaymatthew
 esphome/components/mcp23008/* @jesserockz
 esphome/components/mcp23017/* @jesserockz
-esphome/components/mcp23s08/* @jesserockz @SenexCrenshaw
-esphome/components/mcp23s17/* @jesserockz @SenexCrenshaw
+esphome/components/mcp23s08/* @SenexCrenshaw @jesserockz
+esphome/components/mcp23s17/* @SenexCrenshaw @jesserockz
 esphome/components/mcp23x08_base/* @jesserockz
 esphome/components/mcp23x17_base/* @jesserockz
 esphome/components/mcp23xxx_base/* @jesserockz
 esphome/components/mcp2515/* @danielschramm @mvturnho
 esphome/components/mcp3204/* @rsumner
-esphome/components/mcp3221/* @philippderdiedas
-esphome/components/mcp4461/* @p1ngb4ck
 esphome/components/mcp4728/* @berfenger
 esphome/components/mcp47a1/* @jesserockz
-esphome/components/mcp9600/* @mreditor97
+esphome/components/mcp9600/* @MrEditor97
+esphome/components/mcp9808/* @k7hpn
 esphome/components/md5/* @esphome/core
 esphome/components/mdns/* @esphome/core
 esphome/components/media_player/* @jesserockz
-esphome/components/media_source/* @kahrendt
-esphome/components/micro_wake_word/* @jesserockz @kahrendt
-esphome/components/micronova/* @edenhaus @jorre05
-esphome/components/microphone/* @jesserockz @kahrendt
+esphome/components/microphone/* @jesserockz
 esphome/components/mics_4514/* @jesserockz
-esphome/components/mics_5524/* @nliaudat
 esphome/components/midea/* @dudanov
 esphome/components/midea_ir/* @dudanov
-esphome/components/midea_portasplit/* @Fexiven
-esphome/components/mipi_dsi/* @clydebarrow
-esphome/components/mipi_rgb/* @clydebarrow
-esphome/components/mipi_spi/* @clydebarrow
-esphome/components/mistral_ir/* @lerhum
 esphome/components/mitsubishi/* @RubyBailey
-esphome/components/mitsubishi_cn105/* @crnjan
-esphome/components/mixer/speaker/* @kahrendt
-esphome/components/mk2pvrouter/* @FredM67
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff
-esphome/components/mmc5983/* @agoode
-esphome/components/modbus_client/* @exciton
 esphome/components/modbus_controller/* @martgras
 esphome/components/modbus_controller/binary_sensor/* @martgras
 esphome/components/modbus_controller/number/* @martgras
@@ -416,143 +182,66 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
-esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
-esphome/components/motion/* @esphome/core
 esphome/components/mpl3115a2/* @kbickar
 esphome/components/mpu6886/* @fabaff
-esphome/components/ms8607/* @e28eta
-esphome/components/msa3xx/* @latonita
-esphome/components/nau7802/* @cujomalainey
 esphome/components/network/* @esphome/core
-esphome/components/nextion/* @edwardtfn @senexcrenshaw
+esphome/components/nextion/* @senexcrenshaw
 esphome/components/nextion/binary_sensor/* @senexcrenshaw
 esphome/components/nextion/sensor/* @senexcrenshaw
 esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
-esphome/components/nfc/* @jesserockz @kbx81
-esphome/components/noblex/* @AGalfra
-esphome/components/noise/* @esphome/core
-esphome/components/npi19/* @bakerkj
-esphome/components/nrf52/* @tomaszduda23
-esphome/components/ns2009/* @tchilov
-esphome/components/ns2009/touchscreen/* @tchilov
+esphome/components/nfc/* @jesserockz
 esphome/components/number/* @esphome/core
-esphome/components/one_wire/* @ssieb
-esphome/components/online_image/* @clydebarrow @guillempages
-esphome/components/opentherm/* @olegtarasov
-esphome/components/openthread/* @mrene
-esphome/components/opt3001/* @ccutrer
 esphome/components/ota/* @esphome/core
 esphome/components/output/* @esphome/core
-esphome/components/packet_transport/* @clydebarrow
 esphome/components/pca6416a/* @Mat931
-esphome/components/pca9505/* @ajfriesen @ssieb
-esphome/components/pca9554/* @bdraco @clydebarrow @hwstar
+esphome/components/pca9554/* @hwstar
 esphome/components/pcf85063/* @brogon
-esphome/components/pcf8563/* @KoenBreeman
-esphome/components/pcm5122/* @remcom
-esphome/components/pd_pioneer_ir/* @martinsah
-esphome/components/pi4ioe5v6408/* @jesserockz
 esphome/components/pid/* @OttoWinter
 esphome/components/pipsolar/* @andreashergert1984
-esphome/components/pixoo/* @jesserockz
 esphome/components/pm1006/* @habbie
-esphome/components/pm2005/* @andrewjswan
 esphome/components/pmsa003i/* @sjtrny
-esphome/components/pmsx003/* @ximex
-esphome/components/pmwcs3/* @SeByDocKy
-esphome/components/pn532/* @jesserockz @OttoWinter
-esphome/components/pn532_i2c/* @jesserockz @OttoWinter
-esphome/components/pn532_spi/* @jesserockz @OttoWinter
-esphome/components/pn7150/* @jesserockz @kbx81
-esphome/components/pn7150_i2c/* @jesserockz @kbx81
-esphome/components/pn7160/* @jesserockz @kbx81
-esphome/components/pn7160_i2c/* @jesserockz @kbx81
-esphome/components/pn7160_spi/* @jesserockz @kbx81
-esphome/components/pn71xx/* @jesserockz @kbx81
-esphome/components/power_management/* @rwrozelle
+esphome/components/pn532/* @OttoWinter @jesserockz
+esphome/components/pn532_i2c/* @OttoWinter @jesserockz
+esphome/components/pn532_spi/* @OttoWinter @jesserockz
 esphome/components/power_supply/* @esphome/core
 esphome/components/preferences/* @esphome/core
-esphome/components/provisioning/* @esphome/core
 esphome/components/psram/* @esphome/core
-esphome/components/pulse_meter/* @cstaahl @stevebaxter @TrentHouliston
+esphome/components/pulse_meter/* @cstaahl @stevebaxter
 esphome/components/pvvx_mithermometer/* @pasiz
-esphome/components/pylontech/* @functionpointer
-esphome/components/pzem6l24/* @nuttytree
-esphome/components/qmi8658/* @clydebarrow
 esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
-esphome/components/qspi_dbi/* @clydebarrow
-esphome/components/qwiic_pir/* @kahrendt
-esphome/components/radio_frequency/* @kbx81
 esphome/components/radon_eye_ble/* @jeffeb3
 esphome/components/radon_eye_rd200/* @jeffeb3
 esphome/components/rc522/* @glmnet
 esphome/components/rc522_i2c/* @glmnet
 esphome/components/rc522_spi/* @glmnet
-esphome/components/rd03d/* @jasstrong
-esphome/components/remko_ar715/* @naKruul
-esphome/components/renogy_inverter_ble/* @emilioaray-dev
-esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
-esphome/components/ring_buffer/* @kahrendt
-esphome/components/router/speaker/* @kahrendt
-esphome/components/rp2/* @jesserockz
-esphome/components/rp2040_ble/* @bdraco
+esphome/components/rp2040/* @jesserockz
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
-esphome/components/rp2_ble_tracker/* @bdraco
-esphome/components/rpi_dpi_rgb/* @clydebarrow
-esphome/components/rtl87xx/* @kuba2k2
-esphome/components/rtttl/* @glmnet @ximex
-esphome/components/runtime_image/* @clydebarrow @guillempages @kahrendt
-esphome/components/runtime_stats/* @bdraco
-esphome/components/rx8025t/* @remcom
-esphome/components/rx8111/* @techdregs
-esphome/components/rx8130/* @beormund
-esphome/components/safe_mode/* @jsuanet @kbx81 @paulmonigatti
-esphome/components/samsung/* @jorofi
+esphome/components/rtttl/* @glmnet
+esphome/components/safe_mode/* @jsuanet @paulmonigatti
 esphome/components/scd4x/* @martgras @sjtrny
 esphome/components/script/* @esphome/core
-esphome/components/sdl/* @bdm310 @clydebarrow
 esphome/components/sdm_meter/* @jesserockz @polyfaces
 esphome/components/sdp3x/* @Azimath
-esphome/components/seeed_mr24hpc1/* @limengdu
-esphome/components/seeed_mr60bha2/* @limengdu
-esphome/components/seeed_mr60fda2/* @limengdu
 esphome/components/selec_meter/* @sourabhjaiswal
 esphome/components/select/* @esphome/core
-esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
-esphome/components/sen6x/* @martgras @mebner86 @tuct
-esphome/components/sendspin/* @kahrendt
-esphome/components/sendspin/image/* @kahrendt
-esphome/components/sendspin/media_player/* @kahrendt
-esphome/components/sendspin/media_source/* @kahrendt
-esphome/components/sendspin/sensor/* @kahrendt
-esphome/components/sendspin/switch/* @kahrendt
-esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
-esphome/components/serial_proxy/* @kbx81
-esphome/components/sfa30/* @ghsensdev
-esphome/components/sfa40/* @NoQuarrel
 esphome/components/sgp40/* @SenexCrenshaw
-esphome/components/sgp4x/* @martgras @SenexCrenshaw
-esphome/components/sh1122_base/* @pl4nkton
-esphome/components/sh1122_spi/* @pl4nkton
-esphome/components/sha256/* @esphome/core
+esphome/components/sgp4x/* @SenexCrenshaw @martgras
 esphome/components/shelly_dimmer/* @edge90 @rnauber
-esphome/components/sht3xd/* @mrtoy-me
 esphome/components/sht4x/* @sjtrny
 esphome/components/shutdown/* @esphome/core @jsuanet
-esphome/components/siemens_ira211/* @fonix232
 esphome/components/sigma_delta_output/* @Cat-Ion
 esphome/components/sim800l/* @glmnet
 esphome/components/sm10bit_base/* @Cossid
@@ -562,21 +251,10 @@ esphome/components/sm2335/* @Cossid
 esphome/components/sml/* @alengwenus
 esphome/components/smt100/* @piechade
 esphome/components/sn74hc165/* @jesserockz
-esphome/components/snapshot/* @clydebarrow
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
-esphome/components/sound_level/* @kahrendt
-esphome/components/spa06_base/* @danielkent-net
-esphome/components/spa06_i2c/* @danielkent-net
-esphome/components/spa06_spi/* @danielkent-net
-esphome/components/spd2010/* @grischard
-esphome/components/speaker/* @jesserockz @kahrendt
-esphome/components/speaker/media_player/* @kahrendt @synesthesiam
-esphome/components/speaker_source/* @kahrendt
-esphome/components/spi/* @clydebarrow @esphome/core
-esphome/components/spi_device/* @clydebarrow
-esphome/components/spi_led_strip/* @clydebarrow
-esphome/components/split_buffer/* @jesserockz
+esphome/components/speaker/* @jesserockz
+esphome/components/spi/* @esphome/core
 esphome/components/sprinkler/* @kbx81
 esphome/components/sps30/* @martgras
 esphome/components/ssd1322_base/* @kbx81
@@ -590,67 +268,32 @@ esphome/components/ssd1331_base/* @kbx81
 esphome/components/ssd1331_spi/* @kbx81
 esphome/components/ssd1351_base/* @kbx81
 esphome/components/ssd1351_spi/* @kbx81
-esphome/components/st7123/* @miniskipper
-esphome/components/st7567_base/* @latonita
-esphome/components/st7567_i2c/* @latonita
-esphome/components/st7567_spi/* @latonita
-esphome/components/st7701s/* @clydebarrow
 esphome/components/st7735/* @SenexCrenshaw
 esphome/components/st7789v/* @kbx81
 esphome/components/st7920/* @marsjan155
-esphome/components/statsd/* @Links2004
-esphome/components/stcc4/* @j9brown
-esphome/components/stts22h/* @B48D81EFCC
 esphome/components/substitutions/* @esphome/core
 esphome/components/sun/* @OttoWinter
-esphome/components/sun_gtil2/* @Mat931
 esphome/components/switch/* @esphome/core
-esphome/components/switch/binary_sensor/* @ssieb
-esphome/components/sx126x/* @swoboda1337
-esphome/components/sx127x/* @swoboda1337
-esphome/components/sy6970/* @linkedupbits
-esphome/components/syslog/* @clydebarrow
-esphome/components/systa_bus/* @Mat931
 esphome/components/t6615/* @tylermenezes
-esphome/components/tas2780/* @remcom
-esphome/components/tas58xx/* @mrtoy-me @remcom
-esphome/components/tc74/* @sethgirvan
-esphome/components/tca8418/* @zebble
 esphome/components/tca9548a/* @andreashergert1984
-esphome/components/tca9555/* @mobrembski
 esphome/components/tcl112/* @glmnet
-esphome/components/tcp_uart/* @Bascht74
 esphome/components/tee501/* @Stock-M
-esphome/components/teleinfo/* @0hax @FredM67
-esphome/components/tem3200/* @bakerkj
-esphome/components/template/alarm_control_panel/* @grahambrown11 @hwstar
-esphome/components/template/datetime/* @rfdarter
-esphome/components/template/event/* @nohat
-esphome/components/template/fan/* @ssieb
-esphome/components/text/* @mauritskorse
-esphome/components/tfluna/* @candrews
-esphome/components/thermopro_ble/* @sittner
+esphome/components/teleinfo/* @0hax
+esphome/components/template/alarm_control_panel/* @grahambrown11
 esphome/components/thermostat/* @kbx81
-esphome/components/time/* @esphome/core
-esphome/components/tinyusb/* @kbx81
-esphome/components/tinyusb_keyboard/* @frederikbolding
+esphome/components/time/* @OttoWinter
 esphome/components/tlc5947/* @rnauber
-esphome/components/tlc5971/* @IJIJI
 esphome/components/tm1621/* @Philippe12
 esphome/components/tm1637/* @glmnet
 esphome/components/tm1638/* @skykingjwc
-esphome/components/tm1651/* @mrtoy-me
-esphome/components/tmc2209/* @remcom
-esphome/components/tmc22xx/* @remcom
+esphome/components/tm1651/* @freekode
 esphome/components/tmp102/* @timsavage
 esphome/components/tmp1075/* @sybrenstuvel
 esphome/components/tmp117/* @Azimath
 esphome/components/tof10120/* @wstrzalka
-esphome/components/tormatic/* @ti-mo
 esphome/components/toshiba/* @kbx81
-esphome/components/touchscreen/* @jesserockz @nielsnl68
+esphome/components/touchscreen/* @jesserockz
 esphome/components/tsl2591/* @wjcarpenter
-esphome/components/tt21100/* @kroimon
 esphome/components/tuya/binary_sensor/* @jesserockz
 esphome/components/tuya/climate/* @jesserockz
 esphome/components/tuya/number/* @frankiboy1
@@ -658,74 +301,23 @@ esphome/components/tuya/select/* @bearpawmaxim
 esphome/components/tuya/sensor/* @jesserockz
 esphome/components/tuya/switch/* @jesserockz
 esphome/components/tuya/text_sensor/* @dentra
-esphome/components/tuya/water_heater/* @iago-veiga
 esphome/components/uart/* @esphome/core
-esphome/components/uart/button/* @ssieb
-esphome/components/uart/event/* @eoasmxd
-esphome/components/uart/packet_transport/* @clydebarrow
-esphome/components/uart_mux/* @kbx81
-esphome/components/uart_tcp/* @Bascht74
-esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
-esphome/components/ufm01/* @ljungqvist
-esphome/components/ultrasonic/* @ssieb @swoboda1337
-esphome/components/unicode/* @esphome/core
-esphome/components/update/* @jesserockz
-esphome/components/uponor_smatrix/* @kroimon
-esphome/components/usb_cdc_acm/* @kbx81
-esphome/components/usb_host/* @clydebarrow
-esphome/components/usb_uart/* @clydebarrow
-esphome/components/valve/* @esphome/core
+esphome/components/ultrasonic/* @OttoWinter
 esphome/components/vbus/* @ssieb
-esphome/components/veml3235/* @kbx81
-esphome/components/veml7700/* @latonita
 esphome/components/version/* @esphome/core
-esphome/components/voice_assistant/* @jesserockz @kahrendt
-esphome/components/wake_on_lan/* @clydebarrow @willwill2will54
-esphome/components/watchdog/* @oarcher
-esphome/components/water_heater/* @dhoeben
-esphome/components/waveshare_epaper/* @clydebarrow
-esphome/components/waveshare_io_ch32v003/* @latonita
-esphome/components/web_server/ota/* @esphome/core
-esphome/components/web_server_base/* @esphome/core
-esphome/components/web_server_idf/* @dentra
-esphome/components/weikai/* @DrCoolZic
-esphome/components/weikai_i2c/* @DrCoolZic
-esphome/components/weikai_spi/* @DrCoolZic
-esphome/components/whirlpool/* @arpena @glmnet
+esphome/components/voice_assistant/* @jesserockz
+esphome/components/wake_on_lan/* @willwill2will54
+esphome/components/web_server_base/* @OttoWinter
+esphome/components/whirlpool/* @glmnet
 esphome/components/whynter/* @aeonsablaze
 esphome/components/wiegand/* @ssieb
-esphome/components/wireguard/* @droscy @lhoracek @thomas0bernard
-esphome/components/wk2132_i2c/* @DrCoolZic
-esphome/components/wk2132_spi/* @DrCoolZic
-esphome/components/wk2168_i2c/* @DrCoolZic
-esphome/components/wk2168_spi/* @DrCoolZic
-esphome/components/wk2204_i2c/* @DrCoolZic
-esphome/components/wk2204_spi/* @DrCoolZic
-esphome/components/wk2212_i2c/* @DrCoolZic
-esphome/components/wk2212_spi/* @DrCoolZic
 esphome/components/wl_134/* @hobbypunk90
-esphome/components/wts01/* @alepee
 esphome/components/x9c/* @EtienneMD
-esphome/components/xdb401/* @RT530
-esphome/components/xgzp68xx/* @gcormier
-esphome/components/xiaomi_body_scale/* @dckiller51
-esphome/components/xiaomi_hhccjcy10/* @fariouche
-esphome/components/xiaomi_lywsd02mmc/* @juanluss31
 esphome/components/xiaomi_lywsd03mmc/* @ahpohl
-esphome/components/xiaomi_mccgq02hl/* @ahpohl @morph027
 esphome/components/xiaomi_mhoc303/* @drug123
 esphome/components/xiaomi_mhoc401/* @vevsvevs
 esphome/components/xiaomi_rtcgq02lm/* @jesserockz
-esphome/components/xiaomi_xmwsdj04mmc/* @medusalix
 esphome/components/xl9535/* @mreditor97
-esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
-esphome/components/xxtea/* @clydebarrow
-esphome/components/zephyr/* @tomaszduda23
-esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
-esphome/components/zephyr_pwm/* @wiomoc
-esphome/components/zhlt01/* @cfeenstra1024
-esphome/components/zigbee/* @luar123 @tomaszduda23
-esphome/components/zio_ultrasonic/* @kahrendt
-esphome/components/zwave_proxy/* @kbx81
+esphome/components/xpt2046/* @nielsnl68 @numo68

CODE_OF_CONDUCT.md

@@ -34,7 +34,7 @@ This Code of Conduct applies both within project spaces and in public spaces whe
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at esphome@openhomefoundation.org. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at esphome@nabucasa.com. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
 
 Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
 

CONTRIBUTING.md

@@ -1,14 +1,14 @@
-# Contributing to ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/)
+# Contributing to ESPHome
 
-We welcome contributions to the ESPHome suite of code and documentation!
+For a detailed guide, please see https://esphome.io/guides/contributing.html#contributing-to-esphome
 
-Please read our [contributing guide](https://developers.esphome.io/contributing/code/) if you wish to contribute to the
-project and be sure to join us on [Discord](https://discord.gg/KhAMKrd).
+Things to note when contributing:
 
-**See also:**
-
-[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/esphome/issues) -- [Feature requests](https://github.com/orgs/esphome/discussions)
-
----
-
-[![ESPHome - A project from the Open Home Foundation](https://www.openhomefoundation.org/badges/esphome.png)](https://www.openhomefoundation.org/)
+ - Please test your changes :)
+ - If a new feature is added or an existing user-facing feature is changed, you should also
+   update the [docs](https://github.com/esphome/esphome-docs). See [contributing to esphome-docs](https://esphome.io/guides/contributing.html#contributing-to-esphomedocs)
+   for more information.
+ - Please also update the tests in the `tests/` folder. You can do so by just adding a line in one of the YAML files
+   which checks if your new feature compiles correctly.
+ - Sometimes I will let pull requests linger because I'm not 100% sure about them. Please feel free to ping
+   me after some time.

GEMINI.md

@@ -1 +0,0 @@
-AGENTS.md

MANIFEST.in

@@ -1,9 +1,6 @@
 include LICENSE
 include README.md
 include requirements.txt
-recursive-include esphome *.yaml
 recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
-recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt
-recursive-include esphome requirements.txt

README.md

@@ -1,16 +1,9 @@
-# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/) [![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://codspeed.io/esphome/esphome)
+# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/)
 
-<a href="https://esphome.io/">
-  <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://media.esphome.io/logo/logo-text-on-dark.svg">
-    <img src="https://media.esphome.io/logo/logo-text-on-light.svg" alt="ESPHome Logo">
-  </picture>
-</a>
+[![ESPHome Logo](https://esphome.io/_images/logo-text.png)](https://esphome.io/)
 
----
+**Documentation:** https://esphome.io/
 
-[Documentation](https://esphome.io) -- [Issues](https://github.com/esphome/esphome/issues) -- [Feature requests](https://github.com/orgs/esphome/discussions)
+For issues, please go to [the issue tracker](https://github.com/esphome/issues/issues).
 
----
-
-[![ESPHome - A project from the Open Home Foundation](https://www.openhomefoundation.org/badges/esphome.png)](https://www.openhomefoundation.org/)
+For feature requests, please see [feature requests](https://github.com/esphome/feature-requests/issues).

THREAT_MODEL.md

@@ -1,197 +0,0 @@
-# ESPHome Threat Model
-
-This document defines the trust boundary for the **ESPHome** repository — the
-Python compiler/CLI and the device firmware it generates — so that real security
-bugs can be told apart from defense-in-depth improvements. It gives contributors,
-reviewers, and security researchers a clear answer to one question:
-**does this issue let an _unauthenticated_ attacker do something they shouldn't?**
-
-Related documents:
-
-- Deployment guidance for operators:
-  https://esphome.io/guides/security_best_practices/
-- The **Device Builder dashboard** (the web UI, its authentication, ingress,
-  Origin/Host gates, and peer-link pairing) lives in a separate repository and
-  has its own threat model. If your report concerns any of that, please read and
-  report there instead:
-  https://github.com/esphome/device-builder/blob/main/docs/THREAT_MODEL.md
-
-## The trust boundary
-
-For this repository there are two trusted inputs by design:
-
-1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
-   (see below).
-2. **Authenticated peers of a running device** — clients holding the device's
-   API/OTA encryption key, API password, OTA password, or web server
-   credentials.
-
-The security boundary is therefore **unauthenticated network traffic vs. those
-trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
-security bug.
-
-## Config authors are host-equivalent by design
-
-Anyone who can supply or edit a configuration is **trusted with full code
-execution on the host that runs `esphome`**, on purpose. This is what the product
-does, not a flaw. A config author can already, through fully supported features:
-
-- Run arbitrary **Python** at validation/compile time via `external_components:`
-  (and other component-import mechanisms) — ESPHome imports those packages as
-  ordinary Python.
-- Run arbitrary **shell** commands through the compile/validate/flash toolchain
-  that ESPHome invokes as subprocesses.
-- Read and write arbitrary files reachable by the process (e.g. via `!include`,
-  `packages:`, `dashboard_import:`, and generated build output).
-
-Because of this, a malicious config author is equivalent to shell access on the
-host running the build.
-
-## What is *not* a security vulnerability
-
-If exploiting an issue requires the ability to supply or edit configuration, it
-is **not** a vulnerability in ESPHome, because that ability already grants host
-code execution. This explicitly includes, among others:
-
-- Template / expression injection in substitutions or any YAML string value
-  (e.g. Jinja `${...}` evaluation reaching Python internals). This grants no
-  capability a config author lacks.
-- `!include` / `packages:` / `dashboard_import:` reading or fetching content
-  from surprising or remote locations.
-- The validator or compiler crashing or behaving unexpectedly on adversarial
-  YAML.
-- ESPHome running as root in the official container — that is the documented
-  deployment posture, reachable by the same caller through the features above.
-
-These do not warrant a CVE or coordinated disclosure. Hardening in these areas
-(for example, sandboxing template evaluation as least-surprise defense-in-depth)
-is welcome as a normal enhancement PR, framed as cleanliness rather than a
-security fix — not as a vulnerability remediation.
-
-## What we do defend
-
-These *are* security bugs in this repo, and we want to hear about them privately:
-
-- Memory-safety or protocol bugs in the generated **device firmware** that are
-  remotely triggerable over the network (native API, web server, OTA, BLE,
-  captive portal, etc.) **without** valid credentials.
-- Authentication or encryption bypass on the device — reaching API calls, OTA
-  updates, or the web server without the configured key/password.
-- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
-  web server auth below their documented guarantees.
-
-## The web server is an open HTTP API by design
-
-The `web_server` component exposes a plain HTTP interface for viewing and
-controlling entities, and, when the `web_server` OTA platform is enabled, for
-uploading firmware at `/update`. Its only access controls are the optional
-`web_server` `auth:` credentials and the network the device sits on.
-
-When `auth:` is not configured, every endpoint is reachable by any client that
-can reach the device. This is intentional; enabling `web_server` without `auth:`
-is choosing an open control surface, in the same way that running native OTA
-without a password leaves OTA open. The API is documented and is meant to be
-called by other devices, scripts, and pages.
-
-As defense-in-depth, the web server checks the `Origin` header on browser requests
-to its entity control and state endpoints: a request whose `Origin` does not match
-the address the device is served on is rejected, and the `allowed_origins` option
-widens that list. This blocks the common "confused deputy" (CSRF) case where a page
-the operator visits drives the device through their browser. It is **not** an
-authentication boundary: it only constrains browsers. Any client that omits the
-`Origin` header — `curl`, scripts, or other non-browser callers on the same
-network — reaches every endpoint exactly as before. The check also does not cover
-the web OTA `/update` endpoint. The device performs no CSRF-token or `Referer`
-validation. The following are therefore **not** vulnerabilities in this repository:
-
-- Requests without an `Origin` header (for example `curl`) reaching the control
-  endpoints, whether or not `web_server` `auth:` is set.
-- Requests from an origin the operator added to `allowed_origins`.
-- Cross-origin or CSRF firmware upload through the web OTA endpoint (`/update`) when
-  web OTA is enabled without `web_server` `auth:`. The `/update` endpoint is not
-  covered by the `Origin` check; this is the same exposure as running OTA without a
-  password.
-
-The supported defenses are `web_server` `auth:`, protecting OTA (a web password or
-a native OTA password), and keeping devices on a trusted, segmented network. See
-the security best practices guide linked above.
-
-What remains in scope is bypassing `web_server` `auth:` when it *is* configured,
-and any memory-safety or protocol bug in the server reachable without credentials.
-
-This section documents the current design and scope; it is not a judgment that the
-design is optimal or that it will not change.
-
-## OTA update encryption
-
-The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. A device
-whose `api:` block has an encryption key, static in the YAML or provisioned at
-runtime, compiles in the transport and offers it on every OTA connection once
-it holds a key, so an uploader presenting that key gets the guarantees below
-even without an `ota: encryption:` block; only that block makes the device
-require encryption. The guarantees are: the firmware image is confidential in
-transit, the uploader is authenticated by the pre-shared key, and the plaintext
-negotiation preceding the handshake is bound into the handshake prologue, so
-stripping or tampering with it fails the first MAC. With `ota: encryption:`
-configured both ends fail closed with no override: the device refuses
-plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured. Without that block the CLI tries a static api key when the device
-offers and, until 2027.3.0, falls back to plaintext with a warning when the
-offer is missing or the handshake fails; a runtime provisioned key never
-reaches the CLI, so those uploads stay plaintext.
-
-Defeating any of that without the key is in scope: a device that requires
-encryption accepting a plaintext or downgraded upload, getting past the MAC,
-or recovering image contents from captured traffic.
-
-The following are **not** vulnerabilities, by design:
-
-- Plaintext OTA on a device with no `ota: encryption:` block, including one
-  that offers encryption because it has an api key. That is the documented
-  default, authenticated (if at all) by the OTA password. An uploader that
-  takes the offer skips the password; the key authenticates it. With a
-  runtime provisioned key and no `provisioning:` window, whoever provisions
-  the key gains that upload path too; validation warns about the pair.
-- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
-  active attacker who strips the offer or breaks the handshake can make a
-  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
-  device that requires encryption still refuses that upload.
-- The enablement window: firmware built with a static api key already offers
-  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
-  Older firmware needs one last plaintext upload of an offering build, with
-  the pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. With the `web_server`
-  or `prometheus` component the shared listener is always up, so the endpoint
-  stays reachable and validation warns about that combination;
-  `captive_portal:` alone brings the listener up only for the fallback AP
-  window, which is the intended recovery path, so that is not warned about.
-- CLI retry behavior on transport or MAC failures; every attempt renegotiates
-  a fresh handshake with fresh ephemerals, so retrying does not weaken
-  authentication.
-
-## Explicitly out of scope
-
-- Local attackers who already have shell access on the host that runs `esphome`.
-- Supply-chain attacks against ESPHome or its dependencies.
-- Operator-supplied hostile YAML (covered above — config authoring is trusted).
-- Attacks that require an already-authenticated device peer (someone who already
-  holds the API key / OTA / web credentials).
-- Access to the device web server or its web OTA endpoint by non-browser clients
-  (those that send no `Origin` header). The web server is an open HTTP API by
-  design (see above); browser cross-origin requests are blocked by default, but the
-  real controls are `web_server` `auth:` and network isolation.
-- Anything in the dashboard / device-builder — report that in its own repository
-  (linked at the top).
-- Deployments where the operator removed protections or exposed credentials. See
-  the security best practices guide:
-  https://esphome.io/guides/security_best_practices/
-
-## Reporting a vulnerability
-
-If you believe you've found an issue that crosses the unauthenticated boundary
-above, please report it privately via GitHub Security Advisories rather than a
-public issue. For issues that require config-write access, please review this
-document first — they are very likely out of scope by design. For dashboard /
-device-builder issues, report against that repository and consult its threat
-model (linked at the top).

codecov.yml

@@ -1,18 +0,0 @@
-coverage:
-  status:
-    patch:
-      default:
-        target: 100%
-        threshold: 0%
-    project:
-      default:
-        informational: true
-
-ignore:
-  - "esphome/components/**/*"
-  - "esphome/analyze_memory/**/*"
-  - "tests/integration/**/*"
-
-comment:
-  layout: "reach, diff, flags, files"
-  require_changes: true

docker/Dockerfile

@@ -1,57 +1,86 @@
-ARG BUILD_VERSION=dev
-ARG BUILD_BASE_VERSION=2026.06.1
-ARG BUILD_TYPE=docker
+# Build these with the build.py script
+# Example:
+#   python3 docker/build.py --tag dev --arch amd64 --build-type docker build
 
-FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base-source-docker
-FROM ghcr.io/esphome/docker-base:debian-ha-addon-${BUILD_BASE_VERSION} AS base-source-ha-addon
+# One of "docker", "hassio"
+ARG BASEIMGTYPE=docker
 
-ARG BUILD_TYPE
-FROM base-source-${BUILD_TYPE} AS base
+# https://github.com/hassio-addons/addon-debian-base/releases
+FROM ghcr.io/hassio-addons/debian-base:6.2.3 AS base-hassio
+# https://hub.docker.com/_/debian?tab=tags&page=1&name=bullseye
+FROM debian:bullseye-20230208-slim AS base-docker
 
-RUN git config --system --add safe.directory "*" \
-    && git config --system advice.detachedHead false
+FROM base-${BASEIMGTYPE} AS base
 
-ENV PIP_DISABLE_PIP_VERSION_CHECK=1
-
-RUN pip install --no-cache-dir -U pip uv==0.10.1
-
-COPY requirements.txt /
+ARG TARGETARCH
+ARG TARGETVARIANT
 
 RUN \
-    uv pip install --no-cache-dir \
-    -r /requirements.txt
+    apt-get update \
+    # Use pinned versions so that we get updates with build caching
+    && apt-get install -y --no-install-recommends \
+        python3=3.9.2-3 \
+        python3-pip=20.3.4-4+deb11u1 \
+        python3-setuptools=52.0.0-4 \
+        python3-pil=8.1.2+dfsg-0.3+deb11u1 \
+        python3-cryptography=3.3.2-1 \
+        python3-venv=3.9.2-3 \
+        iputils-ping=3:20210202-1 \
+        git=1:2.30.2-1+deb11u2 \
+        curl=7.74.0-1.3+deb11u7 \
+        openssh-client=1:8.4p1-5+deb11u1 \
+        libcairo2=1.16.0-5 \
+        python3-cffi=1.14.5-1 \
+    && rm -rf \
+        /tmp/* \
+        /var/{cache,log}/* \
+        /var/lib/apt/lists/*
 
-# Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.24.0
+ENV \
+  # Fix click python3 lang warning https://click.palletsprojects.com/en/7.x/python3/
+  LANG=C.UTF-8 LC_ALL=C.UTF-8 \
+  # Store globally installed pio libs in /piolibs
+  PLATFORMIO_GLOBALLIB_DIR=/piolibs
+
+# Support legacy binaries on Debian multiarch system. There is no "correct" way
+# to do this, other than using properly built toolchains...
+# See: https://unix.stackexchange.com/questions/553743/correct-way-to-add-lib-ld-linux-so-3-in-debian
+RUN \
+    if [ "$TARGETARCH$TARGETVARIANT" = "armv7" ]; then \
+        ln -s /lib/arm-linux-gnueabihf/ld-linux.so.3 /lib/ld-linux.so.3; \
+    fi
 
 RUN \
-    platformio settings set enable_telemetry No \
+    # Ubuntu python3-pip is missing wheel
+    pip3 install --no-cache-dir \
+        wheel==0.37.1 \
+        platformio==6.1.7 \
+    # Change some platformio settings
+    && platformio settings set enable_telemetry No \
     && platformio settings set check_platformio_interval 1000000 \
     && mkdir -p /piolibs
 
-ARG BUILD_VERSION
 
-LABEL \
-    org.opencontainers.image.authors="The ESPHome Authors" \
-    org.opencontainers.image.title="ESPHome" \
-    org.opencontainers.image.description="ESPHome is a system to configure your microcontrollers by simple yet powerful configuration files and control them remotely through Home Automation systems" \
-    org.opencontainers.image.url="https://esphome.io/" \
-    org.opencontainers.image.documentation="https://esphome.io/" \
-    org.opencontainers.image.source="https://github.com/esphome/esphome" \
-    org.opencontainers.image.licenses="ESPHome" \
-    org.opencontainers.image.version=${BUILD_VERSION}
+# First install requirements to leverage caching when requirements don't change
+COPY requirements.txt requirements_optional.txt script/platformio_install_deps.py platformio.ini /
+RUN \
+    pip3 install --no-cache-dir -r /requirements.txt -r /requirements_optional.txt \
+    && /platformio_install_deps.py /platformio.ini --libraries
 
 
 # ======================= docker-type image =======================
-FROM base AS base-docker
+FROM base AS docker
+
+# Copy esphome and install
+COPY . /esphome
+RUN pip3 install --no-cache-dir --no-use-pep517 -e /esphome
+
+# Settings for dashboard
+ENV USERNAME="" PASSWORD=""
 
 # Expose the dashboard to Docker
 EXPOSE 6052
 
-# Run healthcheck (heartbeat)
-HEALTHCHECK --interval=30s --timeout=30s \
-    CMD curl --fail http://localhost:6052/version -A "HealthCheck" || exit 1
-
 COPY docker/docker_entrypoint.sh /entrypoint.sh
 
 # The directory the user should mount their configuration files to
@@ -64,23 +93,65 @@ ENTRYPOINT ["/entrypoint.sh"]
 CMD ["dashboard", "/config"]
 
 
-# ======================= ha-addon-type image =======================
-FROM base AS base-ha-addon
+
+
+# ======================= hassio-type image =======================
+FROM base AS hassio
+
+RUN \
+    apt-get update \
+    # Use pinned versions so that we get updates with build caching
+    && apt-get install -y --no-install-recommends \
+        nginx-light=1.18.0-6.1+deb11u3 \
+    && rm -rf \
+        /tmp/* \
+        /var/{cache,log}/* \
+        /var/lib/apt/lists/*
+
+ARG BUILD_VERSION=dev
 
 # Copy root filesystem
 COPY docker/ha-addon-rootfs/ /
 
-ARG BUILD_VERSION
+# Copy esphome and install
+COPY . /esphome
+RUN pip3 install --no-cache-dir --no-use-pep517 -e /esphome
+
+# Labels
 LABEL \
     io.hass.name="ESPHome" \
-    io.hass.description="ESPHome is a system to configure your microcontrollers by simple yet powerful configuration files and control them remotely through Home Automation systems" \
+    io.hass.description="Manage and program ESP8266/ESP32 microcontrollers through YAML configuration files" \
     io.hass.type="addon" \
     io.hass.version="${BUILD_VERSION}"
     # io.hass.arch is inherited from addon-debian-base
 
-ARG BUILD_TYPE
-FROM base-${BUILD_TYPE} AS final
 
-# Copy esphome and install
-COPY . /esphome
-RUN uv pip install --no-cache-dir -e /esphome
+
+
+# ======================= lint-type image =======================
+FROM base AS lint
+
+ENV \
+  PLATFORMIO_CORE_DIR=/esphome/.temp/platformio
+
+RUN \
+    apt-get update \
+    # Use pinned versions so that we get updates with build caching
+    && apt-get install -y --no-install-recommends \
+        clang-format-13=1:13.0.1-6~deb11u1 \
+        clang-tidy-11=1:11.0.1-2 \
+        patch=2.7.6-7 \
+        software-properties-common=0.96.20.2-2.1 \
+        nano=5.4-2+deb11u2 \
+        build-essential=12.9 \
+        python3-dev=3.9.2-3 \
+    && rm -rf \
+        /tmp/* \
+        /var/{cache,log}/* \
+        /var/lib/apt/lists/*
+
+COPY requirements_test.txt /
+RUN pip3 install --no-cache-dir -r /requirements_test.txt
+
+VOLUME ["/esphome"]
+WORKDIR /esphome

docker/build.py

@@ -1,29 +1,28 @@
 #!/usr/bin/env python3
-import argparse
 from dataclasses import dataclass
-import re
-import shlex
 import subprocess
+import argparse
+from platform import machine
+import shlex
+import re
 import sys
 
+
 CHANNEL_DEV = "dev"
 CHANNEL_BETA = "beta"
 CHANNEL_RELEASE = "release"
 CHANNELS = [CHANNEL_DEV, CHANNEL_BETA, CHANNEL_RELEASE]
 
 ARCH_AMD64 = "amd64"
+ARCH_ARMV7 = "armv7"
 ARCH_AARCH64 = "aarch64"
-ARCHS = [ARCH_AMD64, ARCH_AARCH64]
+ARCHS = [ARCH_AMD64, ARCH_ARMV7, ARCH_AARCH64]
 
 TYPE_DOCKER = "docker"
 TYPE_HA_ADDON = "ha-addon"
 TYPE_LINT = "lint"
 TYPES = [TYPE_DOCKER, TYPE_HA_ADDON, TYPE_LINT]
 
-REGISTRY_GHCR = "ghcr"
-REGISTRY_DOCKERHUB = "dockerhub"
-REGISTRIES = [REGISTRY_GHCR, REGISTRY_DOCKERHUB]
-
 
 parser = argparse.ArgumentParser()
 parser.add_argument(
@@ -38,12 +37,6 @@ parser.add_argument(
 parser.add_argument(
     "--build-type", choices=TYPES, required=True, help="The type of build to run"
 )
-parser.add_argument(
-    "--registry",
-    choices=REGISTRIES,
-    action="append",
-    help="Restrict to specific registries (default: all). May be passed multiple times.",
-)
 parser.add_argument(
     "--dry-run", action="store_true", help="Don't run any commands, just print them"
 )
@@ -55,11 +48,6 @@ build_parser.add_argument("--push", help="Also push the images", action="store_t
 build_parser.add_argument(
     "--load", help="Load the docker image locally", action="store_true"
 )
-build_parser.add_argument(
-    "--no-cache-to",
-    help="Don't write the build cache (avoids polluting the shared cache)",
-    action="store_true",
-)
 manifest_parser = subparsers.add_parser(
     "manifest", help="Create a manifest from already pushed images"
 )
@@ -69,7 +57,7 @@ manifest_parser = subparsers.add_parser(
 class DockerParams:
     build_to: str
     manifest_to: str
-    build_type: str
+    baseimgtype: str
     platform: str
     target: str
 
@@ -81,19 +69,25 @@ class DockerParams:
             TYPE_LINT: "esphome/esphome-lint",
         }[build_type]
         build_to = f"{prefix}-{arch}"
+        baseimgtype = {
+            TYPE_DOCKER: "docker",
+            TYPE_HA_ADDON: "hassio",
+            TYPE_LINT: "docker",
+        }[build_type]
         platform = {
             ARCH_AMD64: "linux/amd64",
+            ARCH_ARMV7: "linux/arm/v7",
             ARCH_AARCH64: "linux/arm64",
         }[arch]
         target = {
-            TYPE_DOCKER: "final",
-            TYPE_HA_ADDON: "final",
+            TYPE_DOCKER: "docker",
+            TYPE_HA_ADDON: "hassio",
             TYPE_LINT: "lint",
         }[build_type]
         return cls(
             build_to=build_to,
             manifest_to=prefix,
-            build_type=build_type,
+            baseimgtype=baseimgtype,
             platform=platform,
             target=target,
         )
@@ -105,19 +99,16 @@ def main():
     def run_command(*cmd, ignore_error: bool = False):
         print(f"$ {shlex.join(list(cmd))}")
         if not args.dry_run:
-            rc = subprocess.call(list(cmd), close_fds=False)
+            rc = subprocess.call(list(cmd))
             if rc != 0 and not ignore_error:
                 print("Command failed")
                 sys.exit(1)
 
-    registries = args.registry or REGISTRIES
-
     # detect channel from tag
     match = re.match(r"^(\d+\.\d+)(?:\.\d+)?(b\d+)?$", args.tag)
     major_minor_version = None
     if match is None:
-        # Custom tag (e.g. a branch name) -- push only the tag itself
-        channel = None
+        channel = CHANNEL_DEV
     elif match.group(2) is None:
         major_minor_version = match.group(1)
         channel = CHANNEL_RELEASE
@@ -146,18 +137,11 @@ def main():
             CHANNEL_DEV: "cache-dev",
             CHANNEL_BETA: "cache-beta",
             CHANNEL_RELEASE: "cache-latest",
-        }.get(channel, "cache-dev")
-        # Cache images live alongside the pushed images; prefer GHCR when it is
-        # one of the selected registries, otherwise fall back to Docker Hub so a
-        # registry-restricted build doesn't need GHCR auth.
-        cache_prefix = "ghcr.io/" if REGISTRY_GHCR in registries else ""
-        cache_img = f"{cache_prefix}{params.build_to}:{cache_tag}"
+        }[channel]
+        cache_img = f"ghcr.io/{params.build_to}:{cache_tag}"
 
-        imgs = []
-        if REGISTRY_DOCKERHUB in registries:
-            imgs += [f"{params.build_to}:{tag}" for tag in tags_to_push]
-        if REGISTRY_GHCR in registries:
-            imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]
+        imgs = [f"{params.build_to}:{tag}" for tag in tags_to_push]
+        imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]
 
         # 3. build
         cmd = [
@@ -165,7 +149,7 @@ def main():
             "buildx",
             "build",
             "--build-arg",
-            f"BUILD_TYPE={params.build_type}",
+            f"BASEIMGTYPE={params.baseimgtype}",
             "--build-arg",
             f"BUILD_VERSION={args.tag}",
             "--cache-from",
@@ -180,9 +164,7 @@ def main():
         for img in imgs:
             cmd += ["--tag", img]
         if args.push:
-            cmd += ["--push"]
-            if not args.no_cache_to:
-                cmd += ["--cache-to", f"type=registry,ref={cache_img},mode=max"]
+            cmd += ["--push", "--cache-to", f"type=registry,ref={cache_img},mode=max"]
         if args.load:
             cmd += ["--load"]
 
@@ -190,22 +172,20 @@ def main():
     elif args.command == "manifest":
         manifest = DockerParams.for_type_arch(args.build_type, ARCH_AMD64).manifest_to
 
-        targets = []
-        if REGISTRY_DOCKERHUB in registries:
-            targets += [f"{manifest}:{tag}" for tag in tags_to_push]
-        if REGISTRY_GHCR in registries:
-            targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
-        # Use buildx imagetools (not `docker manifest`) so the per-arch sources,
-        # which buildx pushes as single-platform manifest lists, are combined
-        # and pushed correctly in one step.
+        targets = [f"{manifest}:{tag}" for tag in tags_to_push]
+        targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
+        # 1. Create manifests
         for target in targets:
-            cmd = ["docker", "buildx", "imagetools", "create", "--tag", target]
+            cmd = ["docker", "manifest", "create", target]
             for arch in ARCHS:
                 src = f"{DockerParams.for_type_arch(args.build_type, arch).build_to}:{args.tag}"
                 if target.startswith("ghcr.io"):
                     src = f"ghcr.io/{src}"
                 cmd.append(src)
             run_command(*cmd)
+        # 2. Push manifests
+        for target in targets:
+            run_command("docker", "manifest", "push", target)
 
 
 if __name__ == "__main__":

docker/docker_entrypoint.sh

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
 # If /cache is mounted, use that as PIO's coredir
 # otherwise use path in /config (so that PIO packages aren't downloaded on each compile)
@@ -21,27 +21,4 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs and compiler caches on the persistent
-# cache root, not the container's user cache dir: it is lost on every
-# restart, and not writable when the container runs as a non-root user.
-export ESPHOME_ESP_IDF_PREFIX="$(dirname "${pio_cache_base}")/idf"
-export ESPHOME_SDK_NRF_PREFIX="$(dirname "${pio_cache_base}")/sdk-nrf"
-export ESPHOME_ARDUINO8266_PREFIX="$(dirname "${pio_cache_base}")/arduino8266"
-export ESPHOME_HOST_PREFIX="$(dirname "${pio_cache_base}")/host"
-export ESPHOME_PLATFORMIO_CCACHE_DIR="$(dirname "${pio_cache_base}")/platformio-ccache"
-
-# If /build is mounted, use that as the build path
-# otherwise use path in /config (so that builds aren't lost on container restart)
-if [[ -d /build ]]; then
-    export ESPHOME_BUILD_PATH=/build
-fi
-
-# The default CMD is "dashboard /config". Route the dashboard to the new
-# Device Builder, but pass every other subcommand (compile, run, config,
-# logs, ...) straight through to the esphome CLI so direct CLI use keeps working.
-if [[ "$1" == "dashboard" ]]; then
-    shift
-    exec esphome-device-builder "$@"
-fi
-
 exec esphome "$@"

docker/generate_tags.py

@@ -1,15 +1,13 @@
 #!/usr/bin/env python3
-import argparse
-import os
 import re
+import os
+import argparse
+import json
 
 CHANNEL_DEV = "dev"
 CHANNEL_BETA = "beta"
 CHANNEL_RELEASE = "release"
 
-GHCR = "ghcr"
-DOCKERHUB = "dockerhub"
-
 parser = argparse.ArgumentParser()
 parser.add_argument(
     "--tag",
@@ -23,31 +21,21 @@ parser.add_argument(
     required=True,
     help="The suffix of the tag.",
 )
-parser.add_argument(
-    "--registry",
-    type=str,
-    choices=[GHCR, DOCKERHUB],
-    required=False,
-    action="append",
-    help="The registry to build tags for.",
-)
 
 
 def main():
     args = parser.parse_args()
 
     # detect channel from tag
-    match = re.match(r"^(\d+\.\d+)(?:\.\d+)(?:(b\d+)|(-dev\d+))?$", args.tag)
+    match = re.match(r"^(\d+\.\d+)(?:\.\d+)?(b\d+)?$", args.tag)
     major_minor_version = None
-    if match is None:  # eg 2023.12.0-dev20231109-testbranch
-        channel = None  # Ran with custom tag for a branch etc
-    elif match.group(3) is not None:  # eg 2023.12.0-dev20231109
+    if match is None:
         channel = CHANNEL_DEV
-    elif match.group(2) is not None:  # eg 2023.12.0b1
-        channel = CHANNEL_BETA
-    else:  # eg 2023.12.0
+    elif match.group(2) is None:
         major_minor_version = match.group(1)
         channel = CHANNEL_RELEASE
+    else:
+        channel = CHANNEL_BETA
 
     tags_to_push = [args.tag]
     if channel == CHANNEL_DEV:
@@ -65,31 +53,15 @@ def main():
 
     suffix = f"-{args.suffix}" if args.suffix else ""
 
-    repository = (
-        (os.environ.get("GITHUB_REPOSITORY") or "esphome/esphome").strip().lower()
-    )
-    image_name = f"{repository}{suffix}"
+    with open(os.environ["GITHUB_OUTPUT"], "w") as f:
+        print(f"channel={channel}", file=f)
+        print(f"image=esphome/esphome{suffix}", file=f)
+        full_tags = []
 
-    print(f"channel={channel}")
-
-    if args.registry is None:
-        args.registry = [GHCR, DOCKERHUB]
-    elif len(args.registry) == 1:
-        if GHCR in args.registry:
-            print(f"image=ghcr.io/{image_name}")
-        if DOCKERHUB in args.registry:
-            print(f"image=docker.io/{image_name}")
-
-    print(f"image_name={image_name}")
-
-    full_tags = []
-
-    for tag in tags_to_push:
-        if GHCR in args.registry:
-            full_tags += [f"ghcr.io/{image_name}:{tag}"]
-        if DOCKERHUB in args.registry:
-            full_tags += [f"docker.io/{image_name}:{tag}"]
-    print(f"tags={','.join(full_tags)}")
+        for tag in tags_to_push:
+            full_tags += [f"ghcr.io/esphome/esphome{suffix}:{tag}"]
+            full_tags += [f"esphome/esphome{suffix}:{tag}"]
+        print(f"tags={','.join(full_tags)}", file=f)
 
 
 if __name__ == "__main__":

docker/ha-addon-rootfs/etc/cont-init.d/30-esphome-fork.sh

@@ -1,47 +0,0 @@
-#!/usr/bin/with-contenv bashio
-# ==============================================================================
-# This file installs the user ESPHome fork if specified.
-# The fork must be up to date with the latest ESPHome dev branch
-# and have no conflicts.
-# This config option only exists in the ESPHome Dev add-on.
-# ==============================================================================
-
-declare esphome_fork
-
-if bashio::config.has_value 'esphome_fork'; then
-  esphome_fork=$(bashio::config 'esphome_fork')
-  # format: [username][/repository]:ref
-  if [[ "$esphome_fork" =~ ^(([^/]+)(/([^:]+))?:)?([^:/]+)$ ]]; then
-    username="${BASH_REMATCH[2]:-esphome}"
-    repository="${BASH_REMATCH[4]:-esphome}"
-    ref="${BASH_REMATCH[5]}"
-  else
-    bashio::exit.nok "Invalid esphome_fork format: $esphome_fork"
-  fi
-  full_url="https://github.com/${username}/${repository}/archive/${ref}.tar.gz"
-  bashio::log.info "Checking forked ESPHome"
-  dev_version=$(python3 -c "from esphome.const import __version__; print(__version__)")
-  bashio::log.info "Downloading ESPHome from fork '${esphome_fork}' (${full_url})..."
-  curl -L -o /tmp/esphome.tar.gz "${full_url}" -qq ||
-    bashio::exit.nok "Failed downloading ESPHome fork."
-  bashio::log.info "Installing ESPHome from fork '${esphome_fork}' (${full_url})..."
-  rm -rf /esphome || bashio::exit.nok "Failed to remove ESPHome."
-  mkdir /esphome
-  tar -zxf /tmp/esphome.tar.gz -C /esphome --strip-components=1 ||
-    bashio::exit.nok "Failed installing ESPHome from fork."
-  pip install -U -e /esphome || bashio::exit.nok "Failed installing ESPHome from fork."
-  rm -f /tmp/esphome.tar.gz
-  fork_version=$(python3 -c "from esphome.const import __version__; print(__version__)")
-
-  if [[ "$fork_version" != "$dev_version" ]]; then
-    bashio::log.error "############################"
-    bashio::log.error "Uninstalled fork as version does not match"
-    bashio::log.error "Update (or ask the author to update) the branch"
-    bashio::log.error "This is important as the dev addon and the dev ESPHome"
-    bashio::log.error "branch can have changes that are not compatible with old forks"
-    bashio::log.error "and get reported as bugs which we cannot solve easily."
-    bashio::log.error "############################"
-    bashio::exit.nok
-  fi
-  bashio::log.info "Installed ESPHome from fork '${esphome_fork}' (${full_url})..."
-fi

docker/ha-addon-rootfs/etc/nginx/includes/mime.types

@@ -0,0 +1,96 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

docker/ha-addon-rootfs/etc/nginx/includes/proxy_params.conf

@@ -0,0 +1,16 @@
+proxy_http_version          1.1;
+proxy_ignore_client_abort   off;
+proxy_read_timeout          86400s;
+proxy_redirect              off;
+proxy_send_timeout          86400s;
+proxy_max_temp_file_size    0;
+
+proxy_set_header Accept-Encoding "";
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-NginX-Proxy true;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header Authorization "";

docker/ha-addon-rootfs/etc/nginx/includes/server_params.conf

@@ -0,0 +1,8 @@
+root            /dev/null;
+server_name     $hostname;
+
+client_max_body_size 512m;
+
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header X-Robots-Tag none;

docker/ha-addon-rootfs/etc/nginx/includes/ssl_params.conf

@@ -0,0 +1,8 @@
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;

docker/ha-addon-rootfs/etc/nginx/includes/upstream.conf

@@ -0,0 +1,3 @@
+upstream esphome {
+    server unix:/var/run/esphome.sock;
+}

docker/ha-addon-rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,30 @@
+daemon off;
+user root;
+pid /var/run/nginx.pid;
+worker_processes 1;
+error_log /proc/1/fd/1 error;
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/includes/mime.types;
+
+    access_log              off;
+    default_type            application/octet-stream;
+    gzip                    on;
+    keepalive_timeout       65;
+    sendfile                on;
+    server_tokens           off;
+
+    tcp_nodelay             on;
+    tcp_nopush              on;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    include /etc/nginx/includes/upstream.conf;
+    include /etc/nginx/servers/*.conf;
+}

docker/ha-addon-rootfs/etc/nginx/servers/.gitkeep

@@ -0,0 +1 @@
+Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley)

docker/ha-addon-rootfs/etc/nginx/templates/direct.gtpl

@@ -0,0 +1,28 @@
+server {
+    {{ if not .ssl }}
+    listen 6052 default_server;
+    {{ else }}
+    listen 6052 default_server ssl http2;
+    {{ end }}
+
+    include /etc/nginx/includes/server_params.conf;
+    include /etc/nginx/includes/proxy_params.conf;
+
+    {{ if .ssl }}
+    include /etc/nginx/includes/ssl_params.conf;
+
+    ssl_certificate /ssl/{{ .certfile }};
+    ssl_certificate_key /ssl/{{ .keyfile }};
+
+    # Redirect http requests to https on the same port.
+    # https://rageagainstshell.com/2016/11/redirect-http-to-https-on-the-same-port-in-nginx/
+    error_page 497 https://$http_host$request_uri;
+    {{ end }}
+
+    # Clear Home Assistant Ingress header
+    proxy_set_header X-HA-Ingress "";
+
+    location / {
+        proxy_pass http://esphome;
+    }
+}

docker/ha-addon-rootfs/etc/nginx/templates/ingress.gtpl

@@ -0,0 +1,18 @@
+server {
+    listen 127.0.0.1:{{ .port }} default_server;
+    listen {{ .interface }}:{{ .port }} default_server;
+
+    include /etc/nginx/includes/server_params.conf;
+    include /etc/nginx/includes/proxy_params.conf;
+
+    # Set Home Assistant Ingress header
+    proxy_set_header X-HA-Ingress "YES";
+
+    location / {
+        allow   172.30.32.2;
+        allow   127.0.0.1;
+        deny    all;
+
+        proxy_pass http://esphome;
+    }
+}

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/discovery/run

@@ -4,6 +4,7 @@
 # Home Assistant Add-on: ESPHome
 # Sends discovery information to Home Assistant.
 # ==============================================================================
+declare config
 declare port
 
 # We only disable it when disabled explicitly
@@ -15,20 +16,17 @@ fi
 
 port=$(bashio::addon.ingress_port)
 
-# Wait for the ESPHome Device Builder to become available
+# Wait for NGINX to become available
 bashio::net.wait_for "${port}" "127.0.0.1" 300
 
-# Send one discovery message; the config is a JSON string built with bashio::var.json.
-send_discovery() {
-    local service=$1
-    local config=$2
-    if bashio::discovery "${service}" "${config}" > /dev/null; then
-        bashio::log.info "Successfully send ${service} discovery information to Home Assistant."
-    else
-        bashio::log.error "${service} discovery message to Home Assistant failed!"
-    fi
-}
+config=$(\
+    bashio::var.json \
+        host "127.0.0.1" \
+        port "^${port}" \
+)
 
-send_discovery "esphome" "$(bashio::var.json host "127.0.0.1" port "^${port}")"
-# The Device Builder MCP server, consumed by Home Assistant's mcp integration.
-send_discovery "mcp" "$(bashio::var.json url "http://127.0.0.1:${port}/api/mcp")"
+if bashio::discovery "esphome" "${config}" > /dev/null; then
+    bashio::log.info "Successfully send discovery information to Home Assistant."
+else
+    bashio::log.error "Discovery message to Home Assistant failed!"
+fi

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/finish

@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # ==============================================================================
 # Home Assistant Community Add-on: ESPHome
-# Take down the S6 supervision tree when ESPHome Device Builder fails
+# Take down the S6 supervision tree when ESPHome dashboard fails
 # ==============================================================================
 declare exit_code
 readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
@@ -10,7 +10,7 @@ readonly exit_code_service="${1}"
 readonly exit_code_signal="${2}"
 
 bashio::log.info \
-  "Service ESPHome Device Builder exited with code ${exit_code_service}" \
+  "Service ESPHome dashboard exited with code ${exit_code_service}" \
   "(by signal ${exit_code_signal})"
 
 if [[ "${exit_code_service}" -eq 256 ]]; then