Merge branch 'dev' into revert-9439-lib_compat_mode_fix

This reverts commit f4ac951b15.

.agents/skills/code-review/SKILL.md

@@ -1,116 +0,0 @@
----
-name: code-review
-description: Review guidance for ESPHome pull requests. Use this when reviewing a pull request that changes ESPHome Python, C++, or component code, to check it against the project's coding conventions, embedded-systems memory rules, testing requirements, and breaking-change policy.
----
-
-# Reviewing ESPHome pull requests
-
-ESPHome parses YAML into C++ firmware for memory-constrained microcontrollers
-(ESP32, ESP8266, RP2040, LibreTiny). Review changes with that in mind: RAM and
-flash are scarce, and code runs unattended for months.
-
-`AGENTS.md` in the repository root is the full contributor guide and the
-authority when it disagrees with this summary. The developer documentation at
-https://developers.esphome.io explains the component lifecycle and the reasoning
-behind these rules. This skill lists the concrete things worth flagging in a
-review; read `AGENTS.md` for the detail behind any item.
-
-Only raise findings that the diff actually introduces or changes. Do not ask for
-drive-by cleanup of pre-existing code the PR did not touch.
-
-## Memory and embedded constraints (highest value)
-
-Heap allocation after `setup()` is treated as a reliability bug, not a
-performance nit, because it fragments a small shared heap. Flag:
-
-- New heap allocation on a hot path or after setup that could be avoided.
-- `std::vector` where the size is known at compile time (use `std::array`, or
-  `StaticVector<T, N>` when a `push_back` API is needed) or fixed at runtime
-  init (use `FixedVector<T>`).
-- Listener / child-entity registration lists stored as `std::vector`; these have
-  a compile-time-known count and should use `cg.slot_counter()` plus
-  `StaticVector`.
-- `std::vector<uint8_t>` for a byte buffer that never grows: prefer
-  `std::unique_ptr<uint8_t[]>` or `std::array`.
-- `std::map` / `std::set` / `std::unordered_map` for small datasets (1-16
-  elements): a `std::vector` of a small struct with linear search is lighter.
-- `std::deque` anywhere: it allocates 512-byte blocks and should be avoided.
-- `std::string` storing a value set once from config: prefer `StringRef` (the
-  literal already lives in flash).
-- `std::string` / `std::to_string` / string-returning helpers on hot paths where
-  a buffer or view API exists.
-
-## C++ conventions
-
-- Include what you use: a file referencing a symbol must include the header that
-  declares it, even if it currently arrives transitively. New or changed uses of
-  a symbol need the matching include.
-- Prefix all member access with `this->`.
-- Naming: `lower_snake_case` for functions/methods/variables, `UpperCamelCase`
-  for classes/structs/enums, `UPPER_SNAKE_CASE` for namespace-scope constants,
-  trailing underscore on protected/private fields.
-- `enum class` values must be prefixed with the enum name in `UPPER_SNAKE_CASE`
-  (e.g. `UARTFlushResult::UART_FLUSH_RESULT_SUCCESS`). Bare names like `SUCCESS`,
-  `FAIL`, or `OK` collide with SDK macros on some platforms and break the build.
-- Prefer `const`/`enum` over `#define`; `#define` is only for conditional
-  compilation and code-generation sizes.
-- Never call `millis()` in a `loop()` body; use
-  `App.get_loop_component_start_time()`. A rate-limit gate below ~16 ms (the loop
-  period) does nothing.
-- Pick the timing primitive by cadence: gated `loop()` under 250 ms,
-  `set_interval` at 500 ms and above.
-- Do not override a base method to return the value it already returns (e.g.
-  `get_setup_priority()` returning `setup_priority::DATA`).
-- Wrap string literals passed as printf `%s` args in `LOG_STR_LITERAL()`.
-- Required, invariant dependencies should be constructor parameters, not setters.
-- Callback registration methods must be templated (`template<typename F>`), not
-  typed as `std::function`, so lightweight forwarders avoid a heap allocation.
-- Two-space indent, `using` over `typedef`, wrap at 120 columns.
-
-## Python conventions
-
-- Type-annotate every new function signature (params and return), new dataclass
-  fields, and new module-level variables. Import `ConfigType` from
-  `esphome.types`.
-- Use the walrus operator to avoid a double lookup, e.g.
-  `if (blah := config.get(CONF_BLAH)) is not None:`.
-- Reuse existing validators from `config_validation.py` (`cv.rename_key`,
-  `cv.has_exactly_one_key`, etc.) via `cv.All(...)` instead of hand-rolling.
-- `esphome/const.py` is frozen: no new `CONF_` constants there. Define them in
-  the component's own `.py`, or in `esphome/components/const/__init__.py` when
-  shared. The same constant defined in three or more component files fails CI.
-- State that must persist during code generation goes in `CORE.data` namespaced
-  under the component `DOMAIN` (a `@dataclass`), not module-level mutable globals.
-- Prefer callback-based triggers via `build_callback_automation()`; only use a
-  `Trigger<Ts...>` subclass when the forwarder needs mutable state.
-
-## Testing and coverage
-
-- New and changed lines and branches need test coverage, including defensive
-  early-returns, error paths, and no-op guards. A mocked-out function is not
-  covered; exercise the real call path too.
-- Component YAML tests live in `tests/components/<component>/`. Never define
-  buses (uart, i2c, spi, modbus) directly in a test file: pull them from
-  `tests/test_build_components/common/` through dict-style `packages:` so CI can
-  group builds. List-style packages or top-level merge keys block grouping.
-- Config-only checks use the `validate.*.yaml` prefix; compiled checks use
-  `test.*.yaml`.
-
-## Breaking changes and public API
-
-- Base classes under `esphome/core/` and documented config options are public
-  API. Undocumented `public` members of a component are internal.
-- A breaking change needs justification, a migration path in the PR description,
-  and a deprecation window where feasible (`ESPDEPRECATED` in C++,
-  `cv.rename_key(..., removed_in=...)` in Python). Changing a codegen-injected
-  lambda signature is not a breaking change.
-
-## Process and PR hygiene
-
-- PR titles start with a `[tag]` prefix: the component name (e.g. `[uart] ...`)
-  or `[core]` for shared code.
-- Prose in docs, comments, and commit messages should be plain English. Keep
-  inline comments short and only where the code is not self-explanatory; do not
-  restate what the code says.
-- Verify the PR fills out `.github/PULL_REQUEST_TEMPLATE.md` and adds
-  `CODEOWNERS` entries for a new component.

.agents/skills/pr-workflow/SKILL.md

@@ -1,96 +0,0 @@
----
-name: pr-workflow
-description: Create pull requests for esphome. Use when creating PRs, submitting changes, or preparing contributions.
-allowed-tools: Read, Bash, Glob, Grep
----
-
-# ESPHome PR Workflow
-
-When creating a pull request for esphome, follow these steps:
-
-## 1. Create Branch from Upstream
-
-Always base your branch on **upstream** (not origin/fork) to ensure you have the latest code:
-
-```bash
-git fetch upstream
-git checkout -b <branch-name> upstream/dev
-```
-
-## 2. Read the PR Template
-
-Before creating a PR, read `.github/PULL_REQUEST_TEMPLATE.md` to understand required fields.
-
-## 3. Create the PR
-
-Use `gh pr create` with the **full template** filled in. Never skip or abbreviate sections.
-
-Required fields:
-- **What does this implement/fix?**: Brief description of changes
-- **Types of changes**: Check ONE appropriate box (Bugfix, New feature, Breaking change, etc.)
-- **Related issue**: Use `fixes <link>` syntax if applicable
-- **Pull request in esphome.io**: Link if docs are needed
-- **Test Environment**: Check platforms you tested on
-- **Example config.yaml**: Include working example YAML
-- **Checklist**: Verify code is tested and tests added
-
-## 4. Example PR Body
-
-```markdown
-# What does this implement/fix?
-
-<describe your changes here>
-
-## Types of changes
-
-- [ ] Bugfix (non-breaking change which fixes an issue)
-- [x] New feature (non-breaking change which adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Developer breaking change (an API change that could break external components)
-- [ ] Code quality improvements to existing code or addition of tests
-- [ ] Other
-
-**Related issue or feature (if applicable):**
-
-- fixes https://github.com/esphome/esphome/issues/XXX
-
-**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**
-
-- esphome/esphome.io#XXX
-
-## Test Environment
-
-- [x] ESP32
-- [x] ESP32 IDF
-- [ ] ESP8266
-- [ ] RP2040
-- [ ] BK72xx
-- [ ] RTL87xx
-- [ ] LN882x
-- [ ] nRF52840
-
-## Example entry for `config.yaml`:
-
-```yaml
-# Example config.yaml
-component_name:
-  id: my_component
-  option: value
-```
-
-## Checklist:
-  - [x] The code change is tested and works locally.
-  - [x] Tests have been added to verify that the new code works (under `tests/` folder).
-
-If user exposed functionality or configuration variables are added/changed:
-  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
-```
-
-## 5. Push and Create PR
-
-```bash
-git push -u origin <branch-name>
-gh pr create --repo esphome/esphome --base dev --title "[component] Brief description"
-```
-
-Title should be prefixed with the component name in brackets, e.g. `[safe_mode] Add feature`.

.ai/instructions.md

@@ -0,0 +1,222 @@
+# ESPHome AI Collaboration Guide
+
+This document provides essential context for AI models interacting with this project. Adhering to these guidelines will ensure consistency and maintain code quality.
+
+## 1. Project Overview & Purpose
+
+*   **Primary Goal:** ESPHome is a system to configure microcontrollers (like ESP32, ESP8266, RP2040, and LibreTiny-based chips) using simple yet powerful YAML configuration files. It generates C++ firmware that can be compiled and flashed to these devices, allowing users to control them remotely through home automation systems.
+*   **Business Domain:** Internet of Things (IoT), Home Automation.
+
+## 2. Core Technologies & Stack
+
+*   **Languages:** Python (>=3.10), C++ (gnu++20)
+*   **Frameworks & Runtimes:** PlatformIO, Arduino, ESP-IDF.
+*   **Build Systems:** PlatformIO is the primary build system. CMake is used as an alternative.
+*   **Configuration:** YAML.
+*   **Key Libraries/Dependencies:**
+    *   **Python:** `voluptuous` (for configuration validation), `PyYAML` (for parsing configuration files), `paho-mqtt` (for MQTT communication), `tornado` (for the web server), `aioesphomeapi` (for the native API).
+    *   **C++:** `ArduinoJson` (for JSON serialization/deserialization), `AsyncMqttClient-esphome` (for MQTT), `ESPAsyncWebServer` (for the web server).
+*   **Package Manager(s):** `pip` (for Python dependencies), `platformio` (for C++/PlatformIO dependencies).
+*   **Communication Protocols:** Protobuf (for native API), MQTT, HTTP.
+
+## 3. Architectural Patterns
+
+*   **Overall Architecture:** The project follows a code-generation architecture. The Python code parses user-defined YAML configuration files and generates C++ source code. This C++ code is then compiled and flashed to the target microcontroller using PlatformIO.
+
+*   **Directory Structure Philosophy:**
+    *   `/esphome`: Contains the core Python source code for the ESPHome application.
+    *   `/esphome/components`: Contains the individual components that can be used in ESPHome configurations. Each component is a self-contained unit with its own C++ and Python code.
+    *   `/tests`: Contains all unit and integration tests for the Python code.
+    *   `/docker`: Contains Docker-related files for building and running ESPHome in a container.
+    *   `/script`: Contains helper scripts for development and maintenance.
+
+*   **Core Architectural Components:**
+    1.  **Configuration System** (`esphome/config*.py`): Handles YAML parsing and validation using Voluptuous, schema definitions, and multi-platform configurations.
+    2.  **Code Generation** (`esphome/codegen.py`, `esphome/cpp_generator.py`): Manages Python to C++ code generation, template processing, and build flag management.
+    3.  **Component System** (`esphome/components/`): Contains modular hardware and software components with platform-specific implementations and dependency management.
+    4.  **Core Framework** (`esphome/core/`): Manages the application lifecycle, hardware abstraction, and component registration.
+    5.  **Dashboard** (`esphome/dashboard/`): A web-based interface for device configuration, management, and OTA updates.
+
+*   **Platform Support:**
+    1.  **ESP32** (`components/esp32/`): Espressif ESP32 family. Supports multiple variants (S2, S3, C3, etc.) and both IDF and Arduino frameworks.
+    2.  **ESP8266** (`components/esp8266/`): Espressif ESP8266. Arduino framework only, with memory constraints.
+    3.  **RP2040** (`components/rp2040/`): Raspberry Pi Pico/RP2040. Arduino framework with PIO (Programmable I/O) support.
+    4.  **LibreTiny** (`components/libretiny/`): Realtek and Beken chips. Supports multiple chip families and auto-generated components.
+
+## 4. Coding Conventions & Style Guide
+
+*   **Formatting:**
+    *   **Python:** Uses `ruff` and `flake8` for linting and formatting. Configuration is in `pyproject.toml`.
+    *   **C++:** Uses `clang-format` for formatting. Configuration is in `.clang-format`.
+
+*   **Naming Conventions:**
+    *   **Python:** Follows PEP 8. Use clear, descriptive names following snake_case.
+    *   **C++:** Follows the Google C++ Style Guide.
+
+*   **Component Structure:**
+    *   **Standard Files:**
+        ```
+        components/[component_name]/
+        ├── __init__.py          # Component configuration schema and code generation
+        ├── [component].h        # C++ header file (if needed)
+        ├── [component].cpp      # C++ implementation (if needed)
+        └── [platform]/         # Platform-specific implementations
+            ├── __init__.py      # Platform-specific configuration
+            ├── [platform].h     # Platform C++ header
+            └── [platform].cpp   # Platform C++ implementation
+        ```
+
+    *   **Component Metadata:**
+        - `DEPENDENCIES`: List of required components
+        - `AUTO_LOAD`: Components to automatically load
+        - `CONFLICTS_WITH`: Incompatible components
+        - `CODEOWNERS`: GitHub usernames responsible for maintenance
+        - `MULTI_CONF`: Whether multiple instances are allowed
+
+*   **Code Generation & Common Patterns:**
+    *   **Configuration Schema Pattern:**
+        ```python
+        import esphome.codegen as cg
+        import esphome.config_validation as cv
+        from esphome.const import CONF_KEY, CONF_ID
+
+        CONF_PARAM = "param"  # A constant that does not yet exist in esphome/const.py
+
+        my_component_ns = cg.esphome_ns.namespace("my_component")
+        MyComponent = my_component_ns.class_("MyComponent", cg.Component)
+
+        CONFIG_SCHEMA = cv.Schema({
+            cv.GenerateID(): cv.declare_id(MyComponent),
+            cv.Required(CONF_KEY): cv.string,
+            cv.Optional(CONF_PARAM, default=42): cv.int_,
+        }).extend(cv.COMPONENT_SCHEMA)
+
+        async def to_code(config):
+            var = cg.new_Pvariable(config[CONF_ID])
+            await cg.register_component(var, config)
+            cg.add(var.set_key(config[CONF_KEY]))
+            cg.add(var.set_param(config[CONF_PARAM]))
+        ```
+
+    *   **C++ Class Pattern:**
+        ```cpp
+        namespace esphome {
+        namespace my_component {
+
+        class MyComponent : public Component {
+         public:
+          void setup() override;
+          void loop() override;
+          void dump_config() override;
+
+          void set_key(const std::string &key) { this->key_ = key; }
+          void set_param(int param) { this->param_ = param; }
+
+         protected:
+          std::string key_;
+          int param_{0};
+        };
+
+        }  // namespace my_component
+        }  // namespace esphome
+        ```
+
+    *   **Common Component Examples:**
+        - **Sensor:**
+          ```python
+          from esphome.components import sensor
+          CONFIG_SCHEMA = sensor.sensor_schema(MySensor).extend(cv.polling_component_schema("60s"))
+          async def to_code(config):
+              var = await sensor.new_sensor(config)
+              await cg.register_component(var, config)
+          ```
+
+        - **Binary Sensor:**
+          ```python
+          from esphome.components import binary_sensor
+          CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend({ ... })
+          async def to_code(config):
+              var = await binary_sensor.new_binary_sensor(config)
+          ```
+
+        - **Switch:**
+          ```python
+          from esphome.components import switch
+          CONFIG_SCHEMA = switch.switch_schema().extend({ ... })
+          async def to_code(config):
+              var = await switch.new_switch(config)
+          ```
+
+*   **Configuration Validation:**
+    *   **Common Validators:** `cv.int_`, `cv.float_`, `cv.string`, `cv.boolean`, `cv.int_range(min=0, max=100)`, `cv.positive_int`, `cv.percentage`.
+    *   **Complex Validation:** `cv.All(cv.string, cv.Length(min=1, max=50))`, `cv.Any(cv.int_, cv.string)`.
+    *   **Platform-Specific:** `cv.only_on(["esp32", "esp8266"])`, `cv.only_with_arduino`.
+    *   **Schema Extensions:**
+        ```python
+        CONFIG_SCHEMA = cv.Schema({ ... })
+         .extend(cv.COMPONENT_SCHEMA)
+         .extend(uart.UART_DEVICE_SCHEMA)
+         .extend(i2c.i2c_device_schema(0x48))
+         .extend(spi.spi_device_schema(cs_pin_required=True))
+        ```
+
+## 5. Key Files & Entrypoints
+
+*   **Main Entrypoint(s):** `esphome/__main__.py` is the main entrypoint for the ESPHome command-line interface.
+*   **Configuration:**
+    *   `pyproject.toml`: Defines the Python project metadata and dependencies.
+    *   `platformio.ini`: Configures the PlatformIO build environments for different microcontrollers.
+    *   `.pre-commit-config.yaml`: Configures the pre-commit hooks for linting and formatting.
+*   **CI/CD Pipeline:** Defined in `.github/workflows`.
+
+## 6. Development & Testing Workflow
+
+*   **Local Development Environment:** Use the provided Docker container or create a Python virtual environment and install dependencies from `requirements_dev.txt`.
+*   **Running Commands:** Use the `script/run-in-env.py` script to execute commands within the project's virtual environment. For example, to run the linter: `python3 script/run-in-env.py pre-commit run`.
+*   **Testing:**
+    *   **Python:** Run unit tests with `pytest`.
+    *   **C++:** Use `clang-tidy` for static analysis.
+    *   **Component Tests:** YAML-based compilation tests are located in `tests/`. The structure is as follows:
+        ```
+        tests/
+        ├── test_build_components/ # Base test configurations
+        └── components/[component]/ # Component-specific tests
+        ```
+        Run them using `script/test_build_components`. Use `-c <component>` to test specific components and `-t <target>` for specific platforms.
+*   **Debugging and Troubleshooting:**
+    *   **Debug Tools:**
+        - `esphome config <file>.yaml` to validate configuration.
+        - `esphome compile <file>.yaml` to compile without uploading.
+        - Check the Dashboard for real-time logs.
+        - Use component-specific debug logging.
+    *   **Common Issues:**
+        - **Import Errors**: Check component dependencies and `PYTHONPATH`.
+        - **Validation Errors**: Review configuration schema definitions.
+        - **Build Errors**: Check platform compatibility and library versions.
+        - **Runtime Errors**: Review generated C++ code and component logic.
+
+## 7. Specific Instructions for AI Collaboration
+
+*   **Contribution Workflow (Pull Request Process):**
+    1.  **Fork & Branch:** Create a new branch in your fork.
+    2.  **Make Changes:** Adhere to all coding conventions and patterns.
+    3.  **Test:** Create component tests for all supported platforms and run the full test suite locally.
+    4.  **Lint:** Run `pre-commit` to ensure code is compliant.
+    5.  **Commit:** Commit your changes. There is no strict format for commit messages.
+    6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title should have a prefix of the component being worked on (e.g., `[display] Fix bug`, `[abc123] Add new component`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made with the PULL_REQUEST_TEMPLATE.md template filled out correctly.
+
+*   **Documentation Contributions:**
+    *   Documentation is hosted in the separate `esphome/esphome-docs` repository.
+    *   The contribution workflow is the same as for the codebase.
+
+*   **Best Practices:**
+    *   **Component Development:** Keep dependencies minimal, provide clear error messages, and write comprehensive docstrings and tests.
+    *   **Code Generation:** Generate minimal and efficient C++ code. Validate all user inputs thoroughly. Support multiple platform variations.
+    *   **Configuration Design:** Aim for simplicity with sensible defaults, while allowing for advanced customization.
+
+*   **Security:** Be mindful of security when making changes to the API, web server, or any other network-related code. Do not hardcode secrets or keys.
+
+*   **Dependencies & Build System Integration:**
+    *   **Python:** When adding a new Python dependency, add it to the appropriate `requirements*.txt` file and `pyproject.toml`.
+    *   **C++ / PlatformIO:** When adding a new C++ dependency, add it to `platformio.ini` and use `cg.add_library`.
+    *   **Build Flags:** Use `cg.add_build_flag(...)` to add compiler flags.

.clang-tidy

@@ -5,30 +5,24 @@ Checks: >-
   -altera-*,
   -android-*,
   -boost-*,
-  -bugprone-derived-method-shadowing-base-method,
   -bugprone-easily-swappable-parameters,
   -bugprone-implicit-widening-of-multiplication-result,
-  -bugprone-invalid-enum-default-initialization,
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
-  -bugprone-tagged-union-member-count,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
   -cert-err33-c,
   -cert-err58-cpp,
-  -cert-int09-c,
   -cert-oop57-cpp,
   -cert-str34-c,
   -clang-analyzer-optin.core.EnumCastOutOfRange,
   -clang-analyzer-optin.cplusplus.UninitializedObject,
   -clang-analyzer-osx.*,
-  -clang-analyzer-security.ArrayBound,
   -clang-diagnostic-delete-abstract-non-virtual-dtor,
   -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
   -clang-diagnostic-deprecated-declarations,
   -clang-diagnostic-ignored-optimization-argument,
-  -clang-diagnostic-missing-designated-field-initializers,
   -clang-diagnostic-missing-field-initializers,
   -clang-diagnostic-shadow-field,
   -clang-diagnostic-unused-const-variable,
@@ -48,7 +42,6 @@ Checks: >-
   -cppcoreguidelines-owning-memory,
   -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
-  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -cppcoreguidelines-pro-type-const-cast,
@@ -61,13 +54,12 @@ Checks: >-
   -cppcoreguidelines-rvalue-reference-param-not-moved,
   -cppcoreguidelines-special-member-functions,
   -cppcoreguidelines-use-default-member-init,
-  -cppcoreguidelines-use-enum-class,
   -cppcoreguidelines-virtual-class-destructor,
-  -fuchsia-default-arguments-calls,
-  -fuchsia-default-arguments-declarations,
   -fuchsia-multiple-inheritance,
   -fuchsia-overloaded-operator,
   -fuchsia-statically-constructed-objects,
+  -fuchsia-default-arguments-declarations,
+  -fuchsia-default-arguments-calls,
   -google-build-using-namespace,
   -google-explicit-constructor,
   -google-readability-braces-around-statements,
@@ -79,63 +71,49 @@ Checks: >-
   -llvm-else-after-return,
   -llvm-header-guard,
   -llvm-include-order,
-  -llvm-prefer-static-over-anonymous-namespace,
   -llvm-qualified-auto,
-  -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
   -misc-include-cleaner,
-  -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
-  -misc-override-with-different-visibility,
   -misc-unused-parameters,
   -misc-use-anonymous-namespace,
-  -misc-use-internal-linkage,
   -modernize-avoid-bind,
-  -modernize-avoid-variadic-functions,
   -modernize-avoid-c-arrays,
-  -modernize-avoid-c-style-cast,
+  -modernize-concat-nested-namespaces,
   -modernize-macro-to-enum,
   -modernize-return-braced-init-list,
   -modernize-type-traits,
   -modernize-use-auto,
   -modernize-use-constraints,
   -modernize-use-default-member-init,
-  -modernize-use-designated-initializers,
   -modernize-use-equals-default,
-  -modernize-use-integer-sign-comparison,
   -modernize-use-nodiscard,
   -modernize-use-nullptr,
-  -modernize-use-ranges,
+  -modernize-use-nodiscard,
+  -modernize-use-nullptr,
   -modernize-use-trailing-return-type,
   -mpi-*,
   -objc-*,
   -performance-enum-size,
-  -portability-avoid-pragma-once,
-  -portability-template-virtual-member-function,
-  -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
+  -readability-container-contains,
   -readability-container-data-pointer,
   -readability-convert-member-functions-to-static,
   -readability-else-after-return,
-  -readability-enum-initial-value,
   -readability-function-cognitive-complexity,
   -readability-implicit-bool-conversion,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
-  -readability-math-missing-parentheses,
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
   -readability-redundant-member-init,
-  -readability-redundant-parentheses,
-  -readability-redundant-typename,
+  -readability-redundant-string-init,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
-  -readability-use-std-min-max,
-  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
 FormatStyle:     google
 CheckOptions:

.clang-tidy.hash

@@ -0,0 +1 @@
+4df2fc55e977ba821978fac5f1e721ce2338e23647050b7005b4c801b1770739

.claude/settings.json

@@ -1,16 +0,0 @@
-{
-  "hooks": {
-    "SessionStart": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "d=\"${CLAUDE_PROJECT_DIR:-.}\"; [ -x \"$d/venv/bin/python\" ] || { mkdir -p \"$d/.temp\"; env -u VIRTUAL_ENV \"$d/script/setup\" >\"$d/.temp/setup.log\" 2>&1 || echo '{\"systemMessage\":\"script/setup failed; see .temp/setup.log\"}'; }",
-            "statusMessage": "Setting up dev environment (script/setup)...",
-            "timeout": 900
-          }
-        ]
-      }
-    ]
-  }
-}

.claude/skills

@@ -1 +0,0 @@
-../.agents/skills

.coveragerc

@@ -1,5 +1,4 @@
 [run]
 omit =
     esphome/components/*
-    esphome/analyze_memory/*
     tests/integration/*

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-ARG BUILD_BASE_VERSION=2026.06.1
+ARG BUILD_BASE_VERSION=2025.04.0
 
 
 FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base
@@ -31,4 +31,7 @@ RUN \
     platformio settings set enable_telemetry No \
     && platformio settings set check_platformio_interval 1000000
 
+COPY script/platformio_install_deps.py platformio.ini ./
+RUN ./platformio_install_deps.py platformio.ini --libraries --platforms --tools
+
 WORKDIR /workspaces

.devcontainer/devcontainer.json

@@ -12,9 +12,10 @@
     "--privileged",
     "-e",
     "GIT_EDITOR=code --wait"
-    // uncomment and edit the path in order to pass through local USB serial to the container
+    // uncomment and edit the path in order to pass though local USB serial to the conatiner
     // , "--device=/dev/ttyACM0"
   ],
+  "appPort": 6052,
   // if you are using avahi in the host device, uncomment these to allow the
   // devcontainer to find devices via mdns
   //"mounts": [
@@ -40,11 +41,7 @@
       ],
       "settings": {
         "python.languageServer": "Pylance",
-        // Use the container's pre-provisioned venv (built by the Dockerfile, outside the
-        // bind-mounted workspace) rather than a ./venv that may leak in from the host and
-        // mismatch the container's Python. See .devcontainer/Dockerfile (esphome-venv).
-        "python.defaultInterpreterPath": "/home/esphome/.local/esphome-venv/bin/python",
-        "python.terminal.activateEnvironment": true,
+        "python.pythonPath": "/usr/bin/python3",
         "pylint.args": [
           "--rcfile=${workspaceFolder}/pyproject.toml"
         ],

.dockerignore

@@ -115,4 +115,4 @@ examples/
 Dockerfile
 .git/
 tests/
-.?*
+.*

.gitattributes

@@ -1,5 +1,3 @@
 # Normalize line endings to LF in the repository
 * text eol=lf
 *.png binary
-*.gif binary
-*.apng binary

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -9,29 +9,6 @@ body:
         If you have a feature request or enhancement, please [request them here instead][fr].
 
         [fr]: https://github.com/orgs/esphome/discussions
-  - type: markdown
-    attributes:
-      value: |
-        ## Use of AI in bug reports
-
-        AI tools are good at carrying out well-defined tasks, but they are not good at troubleshooting.
-        Please do NOT paste an AI-generated wall of text into the issue template - if the AI hasn't solved
-        your problem, its wild guesses are not likely to help.
-
-        Please DO include your own words and observations, compile/boot logs, and
-        especially a minimal reproducible example of your YAML configuration that demonstrates the problem.
-
-        It is however quite acceptable to use AI to translate your *own* report,
-        if you aren't a competent English speaker.
-
-        If you really think it will be useful to include an AI's analysis, preferably wrap it in a `<details>` block which will be collapsed by default.
-
-        If you are using AI to help solve a problem, rather than asking it to speculate about what the problem is,
-        it can be more useful to ask it to create a step-by-step troubleshooting procedure.
-        AI is also useful for generating boilerplate code, such as a minimal reproducible example of your YAML
-        configuration that demonstrates the problem.
-
-        Used properly, AI can be a useful tool to help you solve your problem, but don't let it get in the way.
   - type: textarea
     validations:
       required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -2,13 +2,13 @@
 blank_issues_enabled: false
 contact_links:
   - name: Report an issue with the ESPHome documentation
-    url: https://github.com/esphome/esphome.io/issues/new/choose
+    url: https://github.com/esphome/esphome-docs/issues/new/choose
     about: Report an issue with the ESPHome documentation.
   - name: Report an issue with the ESPHome web server
     url: https://github.com/esphome/esphome-webserver/issues/new/choose
     about: Report an issue with the ESPHome web server.
   - name: Report an issue with the ESPHome Builder / Dashboard
-    url: https://github.com/esphome/device-builder/issues/new/choose
+    url: https://github.com/esphome/dashboard/issues/new/choose
     about: Report an issue with the ESPHome Builder / Dashboard.
   - name: Report an issue with the ESPHome API client
     url: https://github.com/esphome/aioesphomeapi/issues/new/choose

.github/PULL_REQUEST_TEMPLATE.md

@@ -6,10 +6,7 @@
 
 - [ ] Bugfix (non-breaking change which fixes an issue)
 - [ ] New feature (non-breaking change which adds functionality)
-- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected) — [policy](https://developers.esphome.io/contributing/code/#what-constitutes-a-c-breaking-change)
-- [ ] Developer breaking change (an API change that could break external components) — [policy](https://developers.esphome.io/contributing/code/#what-is-considered-public-c-api)
-- [ ] Undocumented C++ API change (removal or change of undocumented public methods that lambda users may depend on) — [policy](https://developers.esphome.io/contributing/code/#c-user-expectations)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
 - [ ] Code quality improvements to existing code or addition of tests
 - [ ] Other
 
@@ -17,23 +14,18 @@
 
 - fixes <link to issue>
 
-**Pull request in [esphome.io](https://github.com/esphome/esphome.io) with documentation (if applicable):**
+**Pull request in [esphome-docs](https://github.com/esphome/esphome-docs) with documentation (if applicable):**
 
-- esphome/esphome.io#<esphome.io PR number goes here>
-
-**Pull request in [developers.esphome.io](https://github.com/esphome/developers.esphome.io) with developer documentation (if applicable):**
-
-- esphome/developers.esphome.io#<developers.esphome.io PR number goes here>
+- esphome/esphome-docs#<esphome-docs PR number goes here>
 
 ## Test Environment
 
 - [ ] ESP32
 - [ ] ESP32 IDF
 - [ ] ESP8266
-- [ ] RP2040/RP2350
+- [ ] RP2040
 - [ ] BK72xx
 - [ ] RTL87xx
-- [ ] LN882x
 - [ ] nRF52840
 
 ## Example entry for `config.yaml`:
@@ -48,4 +40,4 @@
   - [ ] Tests have been added to verify that the new code works (under `tests/` folder).
 
 If user exposed functionality or configuration variables are added/changed:
-  - [ ] Documentation added/updated in [esphome.io](https://github.com/esphome/esphome.io).
+  - [ ] Documentation added/updated in [esphome-docs](https://github.com/esphome/esphome-docs).

.github/actions/build-image/action.yaml

@@ -15,6 +15,11 @@ inputs:
     description: "Version to build"
     required: true
     example: "2023.12.0"
+  base_os:
+    description: "Base OS to use"
+    required: false
+    default: "debian"
+    example: "debian"
 runs:
   using: "composite"
   steps:
@@ -42,7 +47,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+      uses: docker/build-push-action@v6.18.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -55,6 +60,7 @@ runs:
         build-args: |
           BUILD_TYPE=${{ inputs.build_type }}
           BUILD_VERSION=${{ inputs.version }}
+          BUILD_OS=${{ inputs.base_os }}
         outputs: |
           type=image,name=ghcr.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
 
@@ -67,7 +73,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+      uses: docker/build-push-action@v6.18.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -80,6 +86,7 @@ runs:
         build-args: |
           BUILD_TYPE=${{ inputs.build_type }}
           BUILD_VERSION=${{ inputs.version }}
+          BUILD_OS=${{ inputs.base_os }}
         outputs: |
           type=image,name=docker.io/${{ steps.tags.outputs.image_name }},push-by-digest=true,name-canonical=true,push=true
 

.github/actions/cache-arduino8266/action.yml

@@ -1,39 +0,0 @@
-name: Cache Arduino ESP8266
-description: >
-  Resolve the pinned Arduino core and xtensa toolchain versions and cache the
-  native ESP8266 install (~110 MB framework + toolchain; no ccache store, the
-  seed job saves before any compile runs). Exports
-  ESPHOME_ARDUINO8266_PREFIX to the job so every later step installs into
-  the cached path; the Python venv must already be restored. Mirrors
-  cache-esp-idf: only dev-branch pushes write the shared cache, everything
-  else restores.
-runs:
-  using: composite
-  steps:
-    - name: Resolve the native toolchain cache key
-      # Versions are pinned in code, not a hashable file; resolve them so a
-      # bump changes the cache key. Assignment form so errexit catches a
-      # resolver failure.
-      id: version
-      shell: bash
-      run: |
-        # One owner for the install prefix: exported here and referenced by
-        # the cache steps below via env, so the caller's install and the
-        # cached path cannot diverge.
-        echo "ESPHOME_ARDUINO8266_PREFIX=$HOME/.esphome-arduino8266" >> "$GITHUB_ENV"
-        . venv/bin/activate
-        key=$(python -c 'from esphome.components.esp8266 import RECOMMENDED_ARDUINO_FRAMEWORK_VERSION as f; from esphome.arduino8266.framework import FRAMEWORK_RELEASES, TOOLCHAIN_VERSION as t; print(f"{FRAMEWORK_RELEASES[f].tag}-{t}")')
-        [ -n "$key" ] || exit 1
-        echo "key=$key" >> "$GITHUB_OUTPUT"
-    - name: Cache the native toolchain (write on dev)
-      if: github.ref == 'refs/heads/dev'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}
-    - name: Restore the native toolchain (off dev)
-      if: github.ref != 'refs/heads/dev'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ env.ESPHOME_ARDUINO8266_PREFIX }}
-        key: ${{ runner.os }}-esp8266-native-${{ steps.version.outputs.key }}

.github/actions/cache-clang-tidy-idedata/action.yml

@@ -1,50 +0,0 @@
-name: Cache clang-tidy idedata
-description: >
-  Cache the clang-tidy idedata and the headers it references under .temp
-  (headers only, about 30MB per env). Run after restore-python and cache-esp-idf.
-inputs:
-  environment:
-    description: 'clang-tidy environment (e.g. esp32-idf-tidy).'
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Compute cache key
-      id: key
-      shell: bash
-      run: |
-        . venv/bin/activate
-        [ -n "${{ inputs.environment }}" ] || { echo "::error::cache-clang-tidy-idedata: 'environment' input is empty"; exit 1; }
-        hash=$(python -c 'import sys; sys.path.insert(0, "script"); from clang_tidy_hash import idedata_cache_hash; print(idedata_cache_hash("${{ inputs.environment }}"))')
-        pyver=$(python -c 'import platform; print(platform.python_version())')
-        # Generating idedata is what installs ESP-IDF; never skip it over a missing
-        # install. This also skips the save, so a dev run that installs ESP-IDF
-        # warms the idedata cache on the next run.
-        if [ -d ~/.esphome-idf/frameworks ]; then
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-        else
-          echo "ESP-IDF install missing, not using the clang-tidy idedata cache"
-          echo "skip=true" >> "$GITHUB_OUTPUT"
-        fi
-        echo "key=${{ runner.os }}-tidy-idedata-${{ inputs.environment }}-$hash-py$pyver" >> "$GITHUB_OUTPUT"
-        {
-          echo "path<<EOF"
-          printf '%s\n' '.temp/idedata-*.json' '.temp/idedata-*.hash'
-          printf '.temp/**/*.%s\n' h hpp hh hxx inc inl ipp tpp
-          echo "EOF"
-        } >> "$GITHUB_OUTPUT"
-    # Mirror cache-esp-idf: write on dev, restore-only on PRs. The post-step
-    # save only runs when the job succeeded, so a failed generation is never saved.
-    # Extend the extension list if a component ships extensionless headers.
-    - name: Cache clang-tidy idedata (write on dev)
-      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && steps.key.outputs.skip != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ steps.key.outputs.path }}
-        key: ${{ steps.key.outputs.key }}
-    - name: Cache clang-tidy idedata (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') && steps.key.outputs.skip != 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ${{ steps.key.outputs.path }}
-        key: ${{ steps.key.outputs.key }}

.github/actions/cache-esp-idf/action.yml

@@ -1,70 +0,0 @@
-name: Cache ESP-IDF
-description: >
-  Resolve the pinned ESP-IDF version and cache the native ESP-IDF install
-  (toolchains + source) at ~/.esphome-idf. Every job that installs ESP-IDF
-  natively (clang-tidy for IDF/Arduino and the component test batches) shares
-  one cache, since the install is identical: ESPHOME_IDF_DEFAULT_TARGETS
-  defaults to "all", and _get_configured_targets() in espidf/toolchain.py
-  skips per-variant narrowing whenever CI is set, so all toolchains are
-  present regardless of the chip a job builds.
-  Callers must set env ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf and have the
-  Python venv already restored.
-inputs:
-  framework:
-    description: 'Which pinned IDF version to key on: "espidf" (recommended) or "arduino".'
-    default: espidf
-  restore-only:
-    description: >
-      When "true", only restore -- never save the cache, even on dev. Use from
-      jobs that may not produce an ESP-IDF install (e.g. a component batch with
-      no esp32 target), so a partial/empty install is never written to the key.
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Resolve ESP-IDF version for cache key
-      # The native-IDF version is pinned in code, not in any file that feeds the
-      # other cache keys, so resolve it explicitly. Keying on it means the cache
-      # invalidates on a version bump (actions/cache never overwrites a key).
-      # Also key on the Python version: the cached IDF venv links to the
-      # runner's toolcache interpreter and is reinstalled every run after a
-      # runner image bump.
-      id: version
-      shell: bash
-      run: |
-        . venv/bin/activate
-        if [ "${{ inputs.framework }}" = "arduino" ]; then
-          version=$(python -c 'from esphome.components.esp32 import ARDUINO_FRAMEWORK_VERSION_LOOKUP as A, ARDUINO_IDF_VERSION_LOOKUP as L; print(L[A["recommended"]])')
-        else
-          version=$(python -c 'from esphome.components.esp32 import ESP_IDF_FRAMEWORK_VERSION_LOOKUP as L; print(L["recommended"])')
-        fi
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-        echo "python-version=$(python -c 'import platform; print(platform.python_version())')" >> "$GITHUB_OUTPUT"
-    # Mirror the adjacent PlatformIO cache: only dev-branch runs write the
-    # shared cache (so it lives in the default-branch scope readable by all
-    # PRs), and PRs are restore-only -- they never push multi-GB artifacts into
-    # their own scope / the repo quota (e.g. on a version-bump PR). The
-    # ci-cache-write label lets a PR write into its own scope to test the hit path;
-    # that costs about 1GB of the repo cache quota per run, so remove it when done.
-    # -slim: bump when prune-esp-idf changes what it removes; a key is never overwritten.
-    - name: Cache ESP-IDF install (write on dev)
-      if: (github.ref == 'refs/heads/dev' || contains(github.event.pull_request.labels.*.name, 'ci-cache-write')) && inputs.restore-only != 'true'
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
-    - name: Cache ESP-IDF install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' && !contains(github.event.pull_request.labels.*.name, 'ci-cache-write') || inputs.restore-only == 'true'
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.esphome-idf
-        key: ${{ runner.os }}-esphome-idf-${{ steps.version.outputs.version }}-py${{ steps.version.outputs.python-version }}-slim
-    # Install explicitly so the prune below sees the toolchains on a cache miss
-    # too, instead of the install happening inside the first build step.
-    - name: Install ESP-IDF
-      shell: bash
-      run: |
-        . venv/bin/activate
-        python -c 'from esphome.espidf.framework import check_esp_idf_install; check_esp_idf_install("${{ steps.version.outputs.version }}")'
-    - name: Prune ESP-IDF install
-      uses: ./.github/actions/prune-esp-idf

.github/actions/cache-sdk-nrf/action.yml

@@ -1,49 +0,0 @@
-name: Cache nRF Connect SDK
-description: >
-  Resolve the pinned sdk-nrf version and cache the native sdk-nrf install
-  (west workspace, Zephyr SDK toolchain, python env) at ~/.esphome-sdk-nrf.
-  Every job that installs sdk-nrf natively (the nrf52 clang-tidy job and,
-  once the component tests build natively, their batches) shares one cache.
-  Callers must set env ESPHOME_SDK_NRF_PREFIX: ~/.esphome-sdk-nrf and have
-  the Python venv already restored.
-inputs:
-  restore-only:
-    description: >
-      When "true", only restore -- never save the cache, even on dev. Use from
-      jobs that may not produce a complete install (e.g. a component batch
-      that fails mid-install), so a partial install is never written.
-    default: "false"
-runs:
-  using: composite
-  steps:
-    - name: Resolve sdk-nrf and toolchain versions for cache key
-      # Both versions are pinned in code, not in any file that feeds the
-      # other cache keys, so resolve them explicitly. Keying on them means
-      # the cache invalidates when either is bumped (actions/cache never
-      # overwrites a key).
-      id: version
-      shell: bash
-      run: |
-        . venv/bin/activate
-        version=$(python -c '
-        from esphome.components.nrf52 import RECOMMENDED_SDK_NRF_VERSION
-        from esphome.components.nrf52.framework import TOOLCHAIN_VERSION
-        print(f"{RECOMMENDED_SDK_NRF_VERSION}-{TOOLCHAIN_VERSION}")')
-        echo "version=$version" >> "$GITHUB_OUTPUT"
-    # Mirror cache-esp-idf: only dev-branch runs write the shared cache (so it
-    # lives in the default-branch scope readable by all PRs); PRs are
-    # restore-only and never push multi-GB artifacts into their own scope.
-    - name: Cache nRF Connect SDK install (write on dev)
-      if: github.ref == 'refs/heads/dev' && inputs.restore-only != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}
-    - name: Cache nRF Connect SDK install (restore-only off dev)
-      if: github.ref != 'refs/heads/dev' || inputs.restore-only == 'true'
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: ~/.esphome-sdk-nrf
-        # yamllint disable-line rule:line-length
-        key: ${{ runner.os }}-esphome-sdk-nrf-${{ steps.version.outputs.version }}-${{ hashFiles('esphome/components/nrf52/requirements.txt') }}

.github/actions/prune-esp-idf/action.yml

@@ -1,34 +0,0 @@
-name: Prune ESP-IDF install
-description: >
-  Remove the picolibc sysroots (1.1GB of the 3.9GB install) from the native
-  ESP-IDF toolchains; IDF 5.x links newlib. Skipped when an IDF 6 install is
-  present, which links picolibc (see esp32/__init__.py).
-runs:
-  using: composite
-  steps:
-    - name: Prune picolibc
-      shell: bash
-      run: |
-        shopt -s nullglob
-        prefix="${ESPHOME_ESP_IDF_PREFIX:-$HOME/.esphome-idf}"
-        prefix="${prefix/#\~/$HOME}"
-        for fw in "$prefix"/frameworks/*/; do
-          case "$(basename "$fw")" in
-            [6-9].*) echo "IDF $(basename "$fw") installed, keeping picolibc"; exit 0 ;;
-          esac
-        done
-        n=0
-        for dir in "$prefix"/tools/*-esp-elf/*/*-esp-elf/picolibc; do
-          echo "Removing $dir ($(du -sh "$dir" | cut -f1))"
-          rm -rf "$dir"
-          n=$((n + 1))
-        done
-        # The marker rides along in the cache entry so a restored slim tree stays quiet.
-        if [ "$n" -gt 0 ]; then
-          touch "$prefix/.picolibc-pruned"
-        elif [ -d "$prefix/tools" ] && [ ! -f "$prefix/.picolibc-pruned" ]; then
-          echo "::warning::no picolibc sysroots matched under $prefix/tools"
-        fi
-        if [ -d "$prefix" ]; then
-          du -sh "$prefix"
-        fi

.github/actions/restore-python/action.yml

@@ -17,31 +17,16 @@ runs:
   steps:
     - name: Set up Python ${{ inputs.python-version }}
       id: python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+      uses: actions/setup-python@v5.6.0
       with:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      uses: actions/cache/restore@v4.2.3
       with:
         path: venv
         # yamllint disable-line rule:line-length
         key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ inputs.cache-key }}
-    - name: Set up uv
-      # Only needed on cache miss to populate the venv. ``uv pip install``
-      # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
-      # downstream jobs rely on is preserved.
-      if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-      with:
-        enable-cache: true
-        # Pull request saves land in per-PR scopes nothing else can
-        # reuse; dev pushes seed the shared copy instead.
-        save-cache: ${{ github.event_name != 'pull_request' }}
-        # Pin uv version so the action does not have to fetch the
-        # manifest from raw.githubusercontent.com on every cache
-        # miss; that fetch flakes on Windows runners.
-        version: "0.11.15"
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os != 'Windows'
       shell: bash
@@ -49,8 +34,8 @@ runs:
         python -m venv venv
         source venv/bin/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
-        uv pip install -e .
+        pip install -r requirements.txt -r requirements_test.txt
+        pip install -e .
     - name: Create Python virtual environment
       if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
       shell: bash
@@ -58,5 +43,5 @@ runs:
         python -m venv venv
         source ./venv/Scripts/activate
         python --version
-        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
-        uv pip install -e .
+        pip install -r requirements.txt -r requirements_test.txt
+        pip install -e .

.github/copilot-instructions.md

@@ -1 +1 @@
-../AGENTS.md
+../.ai/instructions.md

.github/dependabot.yml

@@ -5,7 +5,6 @@ updates:
     directory: "/"
     schedule:
       interval: daily
-    open-pull-requests-limit: 10
     ignore:
       # Hypotehsis is only used for testing and is updated quite often
       - dependency-name: hypothesis

.github/scripts/auto-label-pr/constants.js

@@ -1,59 +0,0 @@
-// Constants and markers for PR auto-labeling
-module.exports = {
-  BOT_COMMENT_MARKER: '<!-- auto-label-pr-bot -->',
-  CODEOWNERS_MARKER: '<!-- codeowners-request -->',
-  TOO_BIG_MARKER: '<!-- too-big-request -->',
-  DEPRECATED_COMPONENT_MARKER: '<!-- deprecated-component-request -->',
-  ORG_FORK_MARKER: '<!-- maintainer-access-warning -->',
-
-  MANAGED_LABELS: [
-    'new-component',
-    'new-platform',
-    'new-target-platform',
-    'merging-to-release',
-    'merging-to-beta',
-    'chained-pr',
-    'stacked-pr',
-    'core',
-    'small-pr',
-    'medium-pr',
-    'dashboard',
-    'github-actions',
-    'by-code-owner',
-    'has-tests',
-    'needs-tests',
-    'needs-docs',
-    'needs-developer-docs',
-    'needs-codeowners',
-    'too-big',
-    'labeller-recheck',
-    'bugfix',
-    'new-feature',
-    'new-feature-developer',
-    'breaking-change',
-    'developer-breaking-change',
-    'undocumented-api-change',
-    'code-quality',
-    'deprecated-component'
-  ],
-
-  DOCS_PR_PATTERNS: [
-    /https:\/\/github\.com\/esphome\/esphome\.io\/pull\/\d+/,
-    /esphome\/esphome\.io#\d+/,
-    // Keep matching the old esphome-docs name during the transition period
-    /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
-    /esphome\/esphome-docs#\d+/
-  ],
-
-  DEVELOPER_DOCS_PR_PATTERNS: [
-    /https:\/\/github\.com\/esphome\/developers\.esphome\.io\/pull\/\d+/,
-    /esphome\/developers\.esphome\.io#\d+/
-  ],
-
-  // Files whose developer-facing changes are documented via Python docstrings
-  // only - developers.esphome.io has no reference page for them yet, so PRs
-  // touching nothing but these files (and tests/) skip needs-developer-docs.
-  DEV_DOCS_EXEMPT_FILES: [
-    'esphome/config_validation.py'
-  ]
-};

.github/scripts/auto-label-pr/detectors.js

@@ -1,467 +0,0 @@
-const { DOCS_PR_PATTERNS, DEVELOPER_DOCS_PR_PATTERNS, DEV_DOCS_EXEMPT_FILES } = require('./constants');
-const {
-  COMPONENT_REGEX,
-  detectComponents,
-  hasCoreChanges,
-  hasDashboardChanges,
-  hasGitHubActionsChanges,
-} = require('../detect-tags');
-const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
-
-// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
-// Ruff/Black enforce exactly one space around `=` and no space before `:`,
-// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
-const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
-
-// Fetch a file's contents from the PR head SHA via the GitHub API.
-// The auto-label workflow runs on `pull_request_target`, which checks out the
-// base branch — files added by the PR don't exist in the workspace, so we have
-// to fetch them from the head SHA. Returns null if the file can't be fetched.
-async function fetchPrFileContent(github, context, path) {
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.repos.getContent({
-      owner,
-      repo,
-      path,
-      ref: context.payload.pull_request.head.sha,
-    });
-    return Buffer.from(data.content, 'base64').toString('utf8');
-  } catch (error) {
-    console.log(`Failed to fetch ${path} from PR head:`, error.message);
-    return null;
-  }
-}
-
-// Check whether a pull request is part of a GitHub stack.
-//
-// GitHub's stacked pull request feature adds a `stack` object to the pull
-// request resource. It is present on every pull request in the stack -
-// including the bottom one, whose base is already `dev` - and is absent
-// entirely on standalone pull requests.
-//
-// The `pull_request_target` webhook payload is not guaranteed to carry this
-// field, so fall back to asking the API when it is missing. Guessing wrong
-// here is costly: a stacked pull request mistaken for a manually chained one
-// gets a label that blocks merging.
-async function isStackedPr(github, context) {
-  const pr = context.payload.pull_request;
-  if (pr.stack != null) {
-    return true;
-  }
-
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.pulls.get({
-      owner,
-      repo,
-      pull_number: pr.number,
-    });
-    return data.stack != null;
-  } catch (error) {
-    // Treat an API failure as "not stacked" so a chained pull request still
-    // gets its blocking label rather than silently slipping through.
-    console.log('Failed to check stack membership:', error.message);
-    return false;
-  }
-}
-
-// Strategy: Merge branch detection
-async function detectMergeBranch(github, context) {
-  const labels = new Set();
-  const baseRef = context.payload.pull_request.base.ref;
-  const defaultBranch = context.payload.repository.default_branch;
-
-  if (baseRef === 'release') {
-    labels.add('merging-to-release');
-  } else if (baseRef === 'beta') {
-    labels.add('merging-to-beta');
-  } else if (await isStackedPr(github, context)) {
-    // GitHub manages the merge order for a stack, so these are not blocked.
-    labels.add('stacked-pr');
-  } else if (baseRef !== defaultBranch) {
-    // A chain built by hand: it must not merge until its base branch does.
-    labels.add('chained-pr');
-  }
-
-  return labels;
-}
-
-// Strategy: Component and platform labeling
-async function detectComponentPlatforms(changedFiles, apiData) {
-  const labels = new Set();
-  const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
-
-  for (const comp of detectComponents(changedFiles)) {
-    labels.add(`component: ${comp}`);
-  }
-
-  for (const file of changedFiles) {
-    const platformMatch = file.match(targetPlatformRegex);
-    if (platformMatch) {
-      labels.add(`platform: ${platformMatch[1]}`);
-    }
-  }
-
-  return labels;
-}
-
-// Strategy: New component detection
-async function detectNewComponents(github, context, prFiles) {
-  const labels = new Set();
-  let hasYamlLoadable = false;
-  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-  for (const file of addedFiles) {
-    const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
-    if (!componentMatch) continue;
-
-    labels.add('new-component');
-    const content = await fetchPrFileContent(github, context, file);
-    if (content === null) {
-      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-      hasYamlLoadable = true;
-      continue;
-    }
-    if (content.includes('IS_TARGET_PLATFORM = True')) {
-      labels.add('new-target-platform');
-    }
-    if (CONFIG_SCHEMA_REGEX.test(content)) {
-      hasYamlLoadable = true;
-    }
-  }
-
-  return { labels, hasYamlLoadable };
-}
-
-// Strategy: New platform detection
-async function detectNewPlatforms(github, context, prFiles, apiData) {
-  const labels = new Set();
-  let hasYamlLoadable = false;
-  const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
-
-  const platformPathPatterns = [
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
-  ];
-
-  const removedFiles = new Set(prFiles.filter(file => file.status === 'removed').map(file => file.filename));
-
-  for (const file of addedFiles) {
-    for (const re of platformPathPatterns) {
-      const match = file.match(re);
-      if (!match) continue;
-      const platform = match[2];
-      if (!apiData.platformComponents.includes(platform)) break;
-
-      // Skip if this is a restructure between flat and subdirectory forms (either direction):
-      //   <component>/<platform>.py  <->  <component>/<platform>/__init__.py
-      const flatEquivalent = `esphome/components/${match[1]}/${platform}.py`;
-      const subdirEquivalent = `esphome/components/${match[1]}/${platform}/__init__.py`;
-      if (removedFiles.has(flatEquivalent) || removedFiles.has(subdirEquivalent)) break;
-
-      labels.add('new-platform');
-      const content = await fetchPrFileContent(github, context, file);
-      if (content === null) {
-        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-        hasYamlLoadable = true;
-      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
-        hasYamlLoadable = true;
-      }
-      break;
-    }
-  }
-
-  return { labels, hasYamlLoadable };
-}
-
-// Strategy: Core files detection
-async function detectCoreChanges(changedFiles) {
-  const labels = new Set();
-  if (hasCoreChanges(changedFiles)) {
-    labels.add('core');
-  }
-  return labels;
-}
-
-// Strategy: PR size detection
-async function detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD) {
-  const labels = new Set();
-
-  const testAdditions = prFiles
-    .filter(file => file.filename.startsWith('tests/'))
-    .reduce((sum, file) => sum + (file.additions || 0), 0);
-  const testDeletions = prFiles
-    .filter(file => file.filename.startsWith('tests/'))
-    .reduce((sum, file) => sum + (file.deletions || 0), 0);
-
-  const nonTestAdditions = totalAdditions - testAdditions;
-  const nonTestDeletions = totalDeletions - testDeletions;
-
-  // small/medium count churn (additions + deletions) so a balanced refactor isn't undersized.
-  const nonTestChurn = nonTestAdditions + nonTestDeletions;
-
-  if (nonTestChurn <= SMALL_PR_THRESHOLD) {
-    labels.add('small-pr');
-    return labels;
-  }
-
-  if (nonTestChurn <= MEDIUM_PR_THRESHOLD) {
-    labels.add('medium-pr');
-    return labels;
-  }
-
-  // too-big uses net line delta (additions - deletions), matching the review message in reviews.js.
-  const nonTestChanges = nonTestAdditions - nonTestDeletions;
-
-  // Don't add too-big if mega-pr label is already present
-  if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
-    labels.add('too-big');
-  }
-
-  return labels;
-}
-
-// Strategy: Dashboard changes
-async function detectDashboardChanges(changedFiles) {
-  const labels = new Set();
-  if (hasDashboardChanges(changedFiles)) {
-    labels.add('dashboard');
-  }
-  return labels;
-}
-
-// Strategy: GitHub Actions changes
-async function detectGitHubActionsChanges(changedFiles) {
-  const labels = new Set();
-  if (hasGitHubActionsChanges(changedFiles)) {
-    labels.add('github-actions');
-  }
-  return labels;
-}
-
-// Strategy: Code owner detection
-async function detectCodeOwner(github, context, changedFiles) {
-  const labels = new Set();
-
-  try {
-    const codeownersPatterns = loadCodeowners();
-    const prAuthor = context.payload.pull_request.user.login;
-
-    // Check if PR author is a codeowner of any changed file
-    const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-    if (effective.users.has(prAuthor)) {
-      labels.add('by-code-owner');
-    }
-  } catch (error) {
-    console.log('Failed to read or parse CODEOWNERS file:', error.message);
-  }
-
-  return labels;
-}
-
-// Strategy: Test detection
-async function detectTests(changedFiles) {
-  const labels = new Set();
-  const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
-
-  if (testFiles.length > 0) {
-    labels.add('has-tests');
-  }
-
-  return labels;
-}
-
-// Strategy: PR Template Checkbox detection
-async function detectPRTemplateCheckboxes(context) {
-  const labels = new Set();
-  const prBody = context.payload.pull_request.body || '';
-
-  console.log('Checking PR template checkboxes...');
-
-  // Check for checked checkboxes in the "Types of changes" section
-  const checkboxPatterns = [
-    { pattern: /- \[x\] Bugfix \(non-breaking change which fixes an issue\)/i, label: 'bugfix' },
-    { pattern: /- \[x\] New feature \(non-breaking change which adds functionality\)/i, label: 'new-feature' },
-    { pattern: /- \[x\] New developer-facing feature \(adds functionality for component developers; no end-user configuration change\)/i, label: 'new-feature-developer' },
-    { pattern: /- \[x\] Breaking change \(fix or feature that would cause existing functionality to not work as expected\)/i, label: 'breaking-change' },
-    { pattern: /- \[x\] Developer breaking change \(an API change that could break external components\)/i, label: 'developer-breaking-change' },
-    { pattern: /- \[x\] Undocumented C\+\+ API change \(removal or change of undocumented public methods that lambda users may depend on\)/i, label: 'undocumented-api-change' },
-    { pattern: /- \[x\] Code quality improvements to existing code or addition of tests/i, label: 'code-quality' }
-  ];
-
-  for (const { pattern, label } of checkboxPatterns) {
-    if (pattern.test(prBody)) {
-      console.log(`Found checked checkbox for: ${label}`);
-      labels.add(label);
-    }
-  }
-
-  return labels;
-}
-
-// Strategy: Deprecated component detection
-async function detectDeprecatedComponents(github, context, changedFiles) {
-  const labels = new Set();
-  const deprecatedInfo = [];
-  const { owner, repo } = context.repo;
-
-  // Compile regex once for better performance
-  const componentFileRegex = COMPONENT_REGEX;
-
-  // Get files that are modified or added in components directory
-  const componentFiles = changedFiles.filter(file => componentFileRegex.test(file));
-
-  if (componentFiles.length === 0) {
-    return { labels, deprecatedInfo };
-  }
-
-  // Extract unique component names using the same regex
-  const components = new Set();
-  for (const file of componentFiles) {
-    const match = file.match(componentFileRegex);
-    if (match) {
-      components.add(match[1]);
-    }
-  }
-
-  // Get base branch ref to check if deprecation already exists for the component
-  // This prevents flagging a PR that simply adds deprecation
-  const baseRef = context.payload.pull_request.base.ref;
-
-  // Check each component's __init__.py for DEPRECATED_COMPONENT constant
-  for (const component of components) {
-    const initFile = `esphome/components/${component}/__init__.py`;
-    try {
-      // Fetch file content from base branch using GitHub API
-      const { data: fileData } = await github.rest.repos.getContent({
-        owner,
-        repo,
-        path: initFile,
-        ref: baseRef
-      });
-
-      // Decode base64 content
-      const content = Buffer.from(fileData.content, 'base64').toString('utf8');
-
-      // Look for DEPRECATED_COMPONENT = "message" or DEPRECATED_COMPONENT = 'message'
-      // Support single quotes, double quotes, and triple quotes (for multiline)
-      const doubleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*"""([\s\S]*?)"""/s) ||
-                              content.match(/DEPRECATED_COMPONENT\s*=\s*"((?:[^"\\]|\\.)*)"/);
-      const singleQuoteMatch = content.match(/DEPRECATED_COMPONENT\s*=\s*'''([\s\S]*?)'''/s) ||
-                              content.match(/DEPRECATED_COMPONENT\s*=\s*'((?:[^'\\]|\\.)*)'/);
-      const deprecatedMatch = doubleQuoteMatch || singleQuoteMatch;
-
-      if (deprecatedMatch) {
-        labels.add('deprecated-component');
-        deprecatedInfo.push({
-          component: component,
-          message: deprecatedMatch[1].trim()
-        });
-        console.log(`Found deprecated component: ${component}`);
-      }
-    } catch (error) {
-      // Only log if it's not a simple "file not found" error (404)
-      if (error.status !== 404) {
-        console.log(`Error reading ${initFile}:`, error.message);
-      }
-    }
-  }
-
-  return { labels, deprecatedInfo };
-}
-
-// Strategy: Detect when maintainers cannot modify the PR branch
-function detectMaintainerAccess(context) {
-  const pr = context.payload.pull_request;
-
-  // Only relevant for cross-repo PRs (forks)
-  if (!pr.head.repo || pr.head.repo.full_name === pr.base.repo.full_name) {
-    return null;
-  }
-
-  if (pr.maintainer_can_modify) {
-    return null;
-  }
-
-  const isOrgFork = pr.head.repo.owner.type === 'Organization';
-  console.log(`Maintainer cannot modify PR branch (${isOrgFork ? 'org fork: ' + pr.head.repo.owner.login : 'user disabled'})`);
-  return { isOrgFork, orgName: pr.head.repo.owner.login };
-}
-
-// Strategy: Requirements detection
-async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
-  const labels = new Set();
-
-  // Check for missing tests
-  if ((allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature') || allLabels.has('new-feature-developer')) && !allLabels.has('has-tests')) {
-    labels.add('needs-tests');
-  }
-
-  // Check for missing docs.
-  // `new-feature` (PR-body checkbox) always counts. `new-feature-developer` is
-  // deliberately excluded here: its docs live on developers.esphome.io and are
-  // checked separately below. `new-component` / `new-platform`
-  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
-  // i.e. the new component/platform is actually loadable from YAML.
-  const docsEligible =
-    allLabels.has('new-feature') ||
-    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
-
-  if (docsEligible) {
-    const prBody = context.payload.pull_request.body || '';
-    const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-    if (!hasDocsLink) {
-      labels.add('needs-docs');
-    }
-  }
-
-  // Check for missing developer docs. `new-feature-developer` requires a
-  // developers.esphome.io PR link, unless every changed file outside tests/ is
-  // in DEV_DOCS_EXEMPT_FILES (core validators documented via docstrings only).
-  if (allLabels.has('new-feature-developer')) {
-    const prBody = context.payload.pull_request.body || '';
-    const nonTestFiles = prFiles
-      .map(file => file.filename)
-      .filter(file => !file.startsWith('tests/'));
-    const onlyExemptFiles = nonTestFiles.every(file => DEV_DOCS_EXEMPT_FILES.includes(file));
-    const hasDevDocsLink = DEVELOPER_DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
-
-    if (!onlyExemptFiles && !hasDevDocsLink) {
-      labels.add('needs-developer-docs');
-    }
-  }
-
-  // Check for missing CODEOWNERS
-  if (allLabels.has('new-component')) {
-    const codeownersModified = prFiles.some(file =>
-      file.filename === 'CODEOWNERS' &&
-      (file.status === 'modified' || file.status === 'added') &&
-      (file.additions || 0) > 0
-    );
-
-    if (!codeownersModified) {
-      labels.add('needs-codeowners');
-    }
-  }
-
-  return labels;
-}
-
-module.exports = {
-  detectMergeBranch,
-  detectComponentPlatforms,
-  detectNewComponents,
-  detectNewPlatforms,
-  detectCoreChanges,
-  detectPRSize,
-  detectDashboardChanges,
-  detectGitHubActionsChanges,
-  detectCodeOwner,
-  detectTests,
-  detectPRTemplateCheckboxes,
-  detectDeprecatedComponents,
-  detectMaintainerAccess,
-  detectRequirements
-};

.github/scripts/auto-label-pr/index.js

@@ -1,201 +0,0 @@
-const { MANAGED_LABELS } = require('./constants');
-const {
-  detectMergeBranch,
-  detectComponentPlatforms,
-  detectNewComponents,
-  detectNewPlatforms,
-  detectCoreChanges,
-  detectPRSize,
-  detectDashboardChanges,
-  detectGitHubActionsChanges,
-  detectCodeOwner,
-  detectTests,
-  detectPRTemplateCheckboxes,
-  detectDeprecatedComponents,
-  detectMaintainerAccess,
-  detectRequirements
-} = require('./detectors');
-const { handleReviews, handleMaintainerAccessComment } = require('./reviews');
-const { applyLabels, removeOldLabels } = require('./labels');
-
-// Fetch API data
-async function fetchApiData() {
-  try {
-    const response = await fetch('https://data.esphome.io/components.json');
-    const componentsData = await response.json();
-    return {
-      targetPlatforms: componentsData.target_platforms || [],
-      platformComponents: componentsData.platform_components || []
-    };
-  } catch (error) {
-    console.log('Failed to fetch components data from API:', error.message);
-    return { targetPlatforms: [], platformComponents: [] };
-  }
-}
-
-module.exports = async ({ github, context }) => {
-  // Environment variables
-  const SMALL_PR_THRESHOLD = parseInt(process.env.SMALL_PR_THRESHOLD);
-  const MEDIUM_PR_THRESHOLD = parseInt(process.env.MEDIUM_PR_THRESHOLD);
-  const MAX_LABELS = parseInt(process.env.MAX_LABELS);
-  const TOO_BIG_THRESHOLD = parseInt(process.env.TOO_BIG_THRESHOLD);
-  const COMPONENT_LABEL_THRESHOLD = parseInt(process.env.COMPONENT_LABEL_THRESHOLD);
-
-  // Global state
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  // Get current labels and PR data
-  const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
-    owner,
-    repo,
-    issue_number: pr_number
-  });
-  const currentLabels = currentLabelsData.map(label => label.name);
-  const managedLabels = currentLabels.filter(label =>
-    label.startsWith('component: ') || label.startsWith('platform: ') || MANAGED_LABELS.includes(label)
-  );
-
-  // Check for mega-PR early - if present, skip most automatic labeling
-  const isMegaPR = currentLabels.includes('mega-pr');
-
-  // Get all PR files with automatic pagination
-  const prFiles = await github.paginate(
-    github.rest.pulls.listFiles,
-    {
-      owner,
-      repo,
-      pull_number: pr_number
-    }
-  );
-
-  // Calculate data from PR files
-  const changedFiles = prFiles.map(file => file.filename);
-  const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
-  const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
-  const totalChanges = totalAdditions + totalDeletions;
-
-  console.log('Current labels:', currentLabels.join(', '));
-  console.log('Changed files:', changedFiles.length);
-  console.log('Total changes:', totalChanges);
-  if (isMegaPR) {
-    console.log('Mega-PR detected - applying limited labeling logic');
-  }
-
-  // Fetch API data
-  const apiData = await fetchApiData();
-  const baseRef = context.payload.pull_request.base.ref;
-
-  // Early exit for release and beta branches only
-  if (baseRef === 'release' || baseRef === 'beta') {
-    const branchLabels = await detectMergeBranch(github, context);
-    const finalLabels = Array.from(branchLabels);
-
-    console.log('Computed labels (merge branch only):', finalLabels.join(', '));
-
-    // Apply labels
-    await applyLabels(github, context, finalLabels);
-
-    // Remove old managed labels
-    await removeOldLabels(github, context, managedLabels, finalLabels);
-
-    return;
-  }
-
-  // Run all strategies
-  const [
-    branchLabels,
-    componentLabels,
-    newComponentResult,
-    newPlatformResult,
-    coreLabels,
-    sizeLabels,
-    dashboardLabels,
-    actionsLabels,
-    codeOwnerLabels,
-    testLabels,
-    checkboxLabels,
-    deprecatedResult,
-    maintainerAccess
-  ] = await Promise.all([
-    detectMergeBranch(github, context),
-    detectComponentPlatforms(changedFiles, apiData),
-    detectNewComponents(github, context, prFiles),
-    detectNewPlatforms(github, context, prFiles, apiData),
-    detectCoreChanges(changedFiles),
-    detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
-    detectDashboardChanges(changedFiles),
-    detectGitHubActionsChanges(changedFiles),
-    detectCodeOwner(github, context, changedFiles),
-    detectTests(changedFiles),
-    detectPRTemplateCheckboxes(context),
-    detectDeprecatedComponents(github, context, changedFiles),
-    detectMaintainerAccess(context)
-  ]);
-
-  // Extract new-component / new-platform results
-  const newComponentLabels = newComponentResult.labels;
-  const newPlatformLabels = newPlatformResult.labels;
-  // Eligible for needs-docs only if any newly added component or platform file
-  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
-  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
-
-  // Extract deprecated component info
-  const deprecatedLabels = deprecatedResult.labels;
-  const deprecatedInfo = deprecatedResult.deprecatedInfo;
-
-  // Combine all labels
-  const allLabels = new Set([
-    ...branchLabels,
-    ...componentLabels,
-    ...newComponentLabels,
-    ...newPlatformLabels,
-    ...coreLabels,
-    ...sizeLabels,
-    ...dashboardLabels,
-    ...actionsLabels,
-    ...codeOwnerLabels,
-    ...testLabels,
-    ...checkboxLabels,
-    ...deprecatedLabels
-  ]);
-
-  // Detect requirements based on all other labels
-  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
-  for (const label of requirementLabels) {
-    allLabels.add(label);
-  }
-
-  let finalLabels = Array.from(allLabels);
-
-  // For mega-PRs, exclude component labels if there are too many
-  if (isMegaPR) {
-    const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
-    if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
-      finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
-      console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
-    }
-  }
-
-  // Handle too many labels (only for non-mega PRs)
-  const tooManyLabels = finalLabels.length > MAX_LABELS;
-  const originalLabelCount = finalLabels.length;
-
-  if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
-    finalLabels = ['too-big'];
-  }
-
-  console.log('Computed labels:', finalLabels.join(', '));
-
-  // Handle reviews and org fork comment
-  await Promise.all([
-    handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD),
-    handleMaintainerAccessComment(github, context, maintainerAccess)
-  ]);
-
-  // Apply labels
-  await applyLabels(github, context, finalLabels);
-
-  // Remove old managed labels
-  await removeOldLabels(github, context, managedLabels, finalLabels);
-};

.github/scripts/auto-label-pr/labels.js

@@ -1,41 +0,0 @@
-// Apply labels to PR
-async function applyLabels(github, context, finalLabels) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  if (finalLabels.length > 0) {
-    console.log(`Adding labels: ${finalLabels.join(', ')}`);
-    await github.rest.issues.addLabels({
-      owner,
-      repo,
-      issue_number: pr_number,
-      labels: finalLabels
-    });
-  }
-}
-
-// Remove old managed labels
-async function removeOldLabels(github, context, managedLabels, finalLabels) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-
-  const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
-  for (const label of labelsToRemove) {
-    console.log(`Removing label: ${label}`);
-    try {
-      await github.rest.issues.removeLabel({
-        owner,
-        repo,
-        issue_number: pr_number,
-        name: label
-      });
-    } catch (error) {
-      console.log(`Failed to remove label ${label}:`, error.message);
-    }
-  }
-}
-
-module.exports = {
-  applyLabels,
-  removeOldLabels
-};

.github/scripts/auto-label-pr/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "auto-label-pr",
-  "private": true,
-  "scripts": {
-    "test": "node --test tests/*.test.js"
-  }
-}

.github/scripts/auto-label-pr/reviews.js

@@ -1,235 +0,0 @@
-const {
-  BOT_COMMENT_MARKER,
-  CODEOWNERS_MARKER,
-  TOO_BIG_MARKER,
-  DEPRECATED_COMPONENT_MARKER,
-  ORG_FORK_MARKER
-} = require('./constants');
-
-// Generate review messages
-function generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD) {
-  const messages = [];
-
-  // Deprecated component message
-  if (finalLabels.includes('deprecated-component') && deprecatedInfo && deprecatedInfo.length > 0) {
-    let message = `${DEPRECATED_COMPONENT_MARKER}\n### ⚠️ Deprecated Component\n\n`;
-    message += `Hey there @${prAuthor},\n`;
-    message += `This PR modifies one or more deprecated components. Please be aware:\n\n`;
-
-    for (const info of deprecatedInfo) {
-      message += `#### Component: \`${info.component}\`\n`;
-      message += `${info.message}\n\n`;
-    }
-
-    message += `Consider migrating to the recommended alternative if applicable.`;
-
-    messages.push(message);
-  }
-
-  // Too big message
-  if (finalLabels.includes('too-big')) {
-    const testAdditions = prFiles
-      .filter(file => file.filename.startsWith('tests/'))
-      .reduce((sum, file) => sum + (file.additions || 0), 0);
-    const testDeletions = prFiles
-      .filter(file => file.filename.startsWith('tests/'))
-      .reduce((sum, file) => sum + (file.deletions || 0), 0);
-    const nonTestChanges = (totalAdditions - testAdditions) - (totalDeletions - testDeletions);
-
-    const tooManyLabels = originalLabelCount > MAX_LABELS;
-    const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
-
-    let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
-
-    message +=
-      `Hey @${prAuthor}, thanks for the contribution. This PR is on the ` +
-      `large side `;
-
-    if (tooManyLabels && tooManyChanges) {
-      message +=
-        `(${nonTestChanges} line changes excluding tests, across ` +
-        `${originalLabelCount} different components/areas)`;
-    } else if (tooManyLabels) {
-      message +=
-        `(it touches ${originalLabelCount} different components/areas)`;
-    } else {
-      message += `(${nonTestChanges} line changes excluding tests)`;
-    }
-
-    message += `, which makes it harder for maintainers to review.\n\n`;
-    let condition;
-    if (tooManyLabels && tooManyChanges) {
-      condition =
-        `is at most ${TOO_BIG_THRESHOLD} lines (excluding tests) and touches ` +
-        `at most ${MAX_LABELS} components/areas`;
-    } else if (tooManyLabels) {
-      condition = `touches at most ${MAX_LABELS} components/areas`;
-    } else {
-      condition = `is at most ${TOO_BIG_THRESHOLD} lines (excluding tests)`;
-    }
-    message +=
-      `**This PR will not be reviewed until it ${condition}.** We know ` +
-      `that is not what you want to hear after this much work, and we want ` +
-      `to be upfront so you do not wait for a review that is not coming: ` +
-      `please split the change. The label is removed automatically once ` +
-      `the PR ${condition}.\n\n`;
-    message +=
-      `There is no exception you can request. Rarely, a maintainer agrees in ` +
-      `\`#devs\` on [Discord](https://esphome.io/chat) to review a change that ` +
-      `genuinely cannot be split as one piece and adds the \`mega-pr\` label, ` +
-      `but that is rare enough that you should plan on splitting rather than ` +
-      `wait for it. Smaller, focused PRs are picked up much faster because ` +
-      `they fit into the short gaps between other maintainer work. For a new ` +
-      `component, the first PR brings the hub and a single platform (for ` +
-      `example \`sensor\`); each further platform is its own PR on top of it.\n\n`;
-    message +=
-      `For more details (including how to split the work up), see: ` +
-      `https://developers.esphome.io/contributing/submitting-your-work/` +
-      `#how-to-approach-large-submissions`;
-
-    messages.push(message);
-  }
-
-  // CODEOWNERS message
-  if (finalLabels.includes('needs-codeowners')) {
-    const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
-      `This way we can notify you if a bug report for this integration is reported.\n\n` +
-      `In \`__init__.py\` of the integration, please add:\n\n` +
-      `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
-      `And run \`script/build_codeowners.py\``;
-
-    messages.push(message);
-  }
-
-  return messages;
-}
-
-// Handle reviews
-async function handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD) {
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-  const prAuthor = context.payload.pull_request.user.login;
-
-  const reviewMessages = generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, prAuthor, MAX_LABELS, TOO_BIG_THRESHOLD);
-  const hasReviewableLabels = finalLabels.some(label =>
-    ['too-big', 'needs-codeowners', 'deprecated-component'].includes(label)
-  );
-
-  const { data: reviews } = await github.rest.pulls.listReviews({
-    owner,
-    repo,
-    pull_number: pr_number
-  });
-
-  const botReviews = reviews.filter(review =>
-    review.user.type === 'Bot' &&
-    review.state === 'CHANGES_REQUESTED' &&
-    review.body && review.body.includes(BOT_COMMENT_MARKER)
-  );
-
-  if (hasReviewableLabels) {
-    const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
-
-    if (botReviews.length > 0) {
-      // Update existing review
-      await github.rest.pulls.updateReview({
-        owner,
-        repo,
-        pull_number: pr_number,
-        review_id: botReviews[0].id,
-        body: reviewBody
-      });
-      console.log('Updated existing bot review');
-    } else {
-      // Create new review
-      await github.rest.pulls.createReview({
-        owner,
-        repo,
-        pull_number: pr_number,
-        body: reviewBody,
-        event: 'REQUEST_CHANGES'
-      });
-      console.log('Created new bot review');
-    }
-  } else if (botReviews.length > 0) {
-    // Dismiss existing reviews
-    for (const review of botReviews) {
-      try {
-        await github.rest.pulls.dismissReview({
-          owner,
-          repo,
-          pull_number: pr_number,
-          review_id: review.id,
-          message: 'Review dismissed: All requirements have been met'
-        });
-        console.log(`Dismissed bot review ${review.id}`);
-      } catch (error) {
-        console.log(`Failed to dismiss review ${review.id}:`, error.message);
-      }
-    }
-  }
-}
-
-// Handle maintainer access warning comment
-async function handleMaintainerAccessComment(github, context, maintainerAccess) {
-  if (!maintainerAccess) {
-    return;
-  }
-
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-  const prAuthor = context.payload.pull_request.user.login;
-
-  // Check if we already posted the warning (iterate pages to exit early)
-  let existingComment;
-  for await (const { data: comments } of github.paginate.iterator(
-    github.rest.issues.listComments,
-    { owner, repo, issue_number: pr_number }
-  )) {
-    existingComment = comments.find(comment =>
-      comment.user.type === 'Bot' &&
-      comment.body && comment.body.includes(ORG_FORK_MARKER)
-    );
-    if (existingComment) {
-      break;
-    }
-  }
-
-  if (existingComment) {
-    console.log('Maintainer access warning comment already exists, skipping');
-    return;
-  }
-
-  let body;
-  if (maintainerAccess.isOrgFork) {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Organization Fork Detected\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR was submitted from a fork owned by the **${maintainerAccess.orgName}** organization. ` +
-      `GitHub does not allow maintainers to push changes to pull request branches when the fork is owned by an organization. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `To allow maintainer collaboration, please re-submit this PR from a personal fork instead.\n\n` +
-      `See: [Setting up the local repository](https://developers.esphome.io/contributing/development-environment/?h=org#set-up-the-local-repository) for more details.`;
-  } else {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Maintainer Access Disabled\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR does not have the "Allow edits from maintainers" option enabled. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `Please enable this option in the PR sidebar to allow maintainer collaboration.`;
-  }
-
-  await github.rest.issues.createComment({
-    owner,
-    repo,
-    issue_number: pr_number,
-    body
-  });
-  console.log('Created maintainer access warning comment');
-}
-
-module.exports = {
-  generateReviewMessages,
-  handleReviews,
-  handleMaintainerAccessComment
-};

.github/scripts/auto-label-pr/tests/detectors.test.js

@@ -1,466 +0,0 @@
-const { describe, it } = require('node:test');
-const assert = require('node:assert/strict');
-const {
-  detectMergeBranch,
-  detectNewPlatforms,
-  detectNewComponents,
-  detectPRSize,
-  detectPRTemplateCheckboxes,
-  detectRequirements,
-} = require('../detectors');
-const { MANAGED_LABELS } = require('../constants');
-
-// Minimal GitHub API mock — only repos.getContent is called by detectNewPlatforms/detectNewComponents
-// to check for CONFIG_SCHEMA in newly added files.
-function makeGithub(content = '') {
-  return {
-    rest: {
-      repos: {
-        getContent: async () => ({
-          data: { content: Buffer.from(content).toString('base64') }
-        })
-      }
-    }
-  };
-}
-
-const CONTEXT = {
-  repo: { owner: 'esphome', repo: 'esphome' },
-  payload: { pull_request: { head: { sha: 'abc123' }, base: { ref: 'dev' } } }
-};
-
-const API_DATA = {
-  targetPlatforms: ['esp32', 'esp8266', 'rp2040'],
-  platformComponents: ['cover', 'sensor', 'binary_sensor', 'switch', 'light', 'fan', 'climate', 'valve']
-};
-
-const WITH_SCHEMA = 'CONFIG_SCHEMA = cv.Schema({})';
-const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';
-
-// ---------------------------------------------------------------------------
-// detectMergeBranch
-// ---------------------------------------------------------------------------
-
-// Builds a fresh context for detectMergeBranch tests instead of mutating the
-// shared CONTEXT fixture above (which other describe blocks rely on).
-function makeMergeContext(baseRef, { stack, defaultBranch = 'dev' } = {}) {
-  const pull_request = { number: 1, base: { ref: baseRef } };
-  if (stack !== undefined) {
-    pull_request.stack = stack;
-  }
-  return {
-    repo: { owner: 'esphome', repo: 'esphome' },
-    payload: { pull_request, repository: { default_branch: defaultBranch } }
-  };
-}
-
-// A GitHub API mock exposing only rest.pulls.get, with a call counter so
-// tests can assert whether the API fallback was actually invoked.
-function makeStackGithub({ stack = null, error = null } = {}) {
-  const state = { calls: 0 };
-  const github = {
-    rest: {
-      pulls: {
-        get: async () => {
-          state.calls++;
-          if (error) throw error;
-          return { data: { stack } };
-        }
-      }
-    }
-  };
-  return { github, state };
-}
-
-const STACK_INFO = { base: { ref: 'dev' }, id: 71540, number: 17978, position: 3, size: 3 };
-
-describe('detectMergeBranch', () => {
-  it('base ref release adds merging-to-release only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('release', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-release']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('base ref beta adds merging-to-beta only and never checks the stack', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('beta', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['merging-to-beta']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack present on the webhook payload adds stacked-pr without calling the API', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('feature-branch', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('stack absent from payload falls back to the API and adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub({ stack: STACK_INFO });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('bottom of a stack (base ref dev, stack present) still adds stacked-pr', async () => {
-    const { github, state } = makeStackGithub();
-    const context = makeMergeContext('dev', { stack: STACK_INFO });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['stacked-pr']);
-    assert.equal(state.calls, 0);
-  });
-
-  it('not stacked, base ref not dev adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-  it('not stacked, base ref dev adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('a failed stack lookup falls back to not-stacked, so a feature-branch base adds chained-pr', async () => {
-    const { github, state } = makeStackGithub({ error: new Error('API unavailable') });
-    const context = makeMergeContext('feature-branch');
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-    assert.equal(state.calls, 1);
-  });
-
-  it('base ref matches default branch adds no labels', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('other', { defaultBranch: 'other' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), []);
-  });
-
-  it('base ref dev when the default branch is main adds chained-pr', async () => {
-    const { github } = makeStackGithub({ stack: null });
-    const context = makeMergeContext('dev', { defaultBranch: 'main' });
-    const labels = await detectMergeBranch(github, context);
-    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
-  });
-
-});
-
-// ---------------------------------------------------------------------------
-// detectNewPlatforms
-// ---------------------------------------------------------------------------
-
-describe('detectNewPlatforms', () => {
-  describe('restructure detection (no false positives)', () => {
-    it('flat .py -> subdir __init__.py is not a new platform', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/endstop/cover.py', status: 'removed' },
-        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-
-    it('subdir __init__.py -> flat .py is not a new platform', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/endstop/cover/__init__.py', status: 'removed' },
-        { filename: 'esphome/components/endstop/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-  });
-
-  describe('genuine new platforms', () => {
-    it('new subdir platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover/__init__.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, true);
-    });
-
-    it('new flat platform with CONFIG_SCHEMA sets new-platform and hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, true);
-    });
-
-    it('new platform without CONFIG_SCHEMA sets new-platform but not hasYamlLoadable', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/cover.py', status: 'added' },
-      ];
-      const result = await detectNewPlatforms(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles, API_DATA);
-      assert.ok(result.labels.has('new-platform'));
-      assert.equal(result.hasYamlLoadable, false);
-    });
-
-    it('non-platform file addition produces no labels', async () => {
-      const prFiles = [
-        { filename: 'esphome/components/my_sensor/sensor.py', status: 'added' },
-      ];
-      // Override platformComponents so 'sensor' is not a recognized platform -> no label expected.
-      const nonPlatformApiData = { ...API_DATA, platformComponents: ['cover'] };
-      const result = await detectNewPlatforms(makeGithub(WITH_SCHEMA), CONTEXT, prFiles, nonPlatformApiData);
-      assert.equal(result.labels.size, 0);
-      assert.equal(result.hasYamlLoadable, false);
-    });
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectNewComponents
-// ---------------------------------------------------------------------------
-
-describe('detectNewComponents', () => {
-  it('new top-level __init__.py sets new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/actuator/__init__.py', status: 'added', },
-    ];
-    const result = await detectNewComponents(makeGithub(WITHOUT_SCHEMA), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.equal(result.hasYamlLoadable, false);
-  });
-
-  it('new top-level __init__.py with CONFIG_SCHEMA sets hasYamlLoadable', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/my_component/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.equal(result.hasYamlLoadable, true);
-  });
-
-  it('new top-level __init__.py with IS_TARGET_PLATFORM sets new-target-platform', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/my_platform/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub('IS_TARGET_PLATFORM = True'), CONTEXT, prFiles);
-    assert.ok(result.labels.has('new-component'));
-    assert.ok(result.labels.has('new-target-platform'));
-  });
-
-  it('modified __init__.py does not set new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/existing/__init__.py', status: 'modified' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.equal(result.labels.size, 0);
-  });
-
-  it('nested __init__.py does not set new-component', async () => {
-    const prFiles = [
-      { filename: 'esphome/components/endstop/cover/__init__.py', status: 'added' },
-    ];
-    const result = await detectNewComponents(makeGithub(WITH_SCHEMA), CONTEXT, prFiles);
-    assert.equal(result.labels.size, 0);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectPRTemplateCheckboxes
-// ---------------------------------------------------------------------------
-
-const NEW_FEATURE_LINE = '- [x] New feature (non-breaking change which adds functionality)';
-const DEV_FEATURE_LINE = '- [x] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-const DEV_FEATURE_LINE_UNTICKED = '- [ ] New developer-facing feature (adds functionality for component developers; no end-user configuration change)';
-
-function makeBodyContext(body) {
-  return { payload: { pull_request: { body } } };
-}
-
-describe('detectPRTemplateCheckboxes', () => {
-  it('ticked developer-facing feature checkbox adds new-feature-developer only', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE));
-    assert.ok(labels.has('new-feature-developer'));
-    assert.ok(!labels.has('new-feature'));
-  });
-
-  it('unticked developer-facing feature checkbox adds no label', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(DEV_FEATURE_LINE_UNTICKED));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-
-  it('ticked new feature checkbox does not add new-feature-developer', async () => {
-    const labels = await detectPRTemplateCheckboxes(makeBodyContext(NEW_FEATURE_LINE));
-    assert.ok(labels.has('new-feature'));
-    assert.ok(!labels.has('new-feature-developer'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectRequirements
-// ---------------------------------------------------------------------------
-
-describe('detectRequirements', () => {
-  // PR body without any docs-PR link.
-  const NO_DOCS_CONTEXT = makeBodyContext('Just a description, no docs link.');
-  const USER_DOCS_CONTEXT = makeBodyContext('Docs: esphome/esphome.io#1234');
-  const DEV_DOCS_CONTEXT = makeBodyContext('Docs: esphome/developers.esphome.io#1234');
-  const DEV_DOCS_URL_CONTEXT = makeBodyContext('Docs: https://github.com/esphome/developers.esphome.io/pull/1234');
-
-  // File sets: a normal source change vs. one confined to the exempt core validators.
-  const SOURCE_FILES = [
-    { filename: 'esphome/components/foo/foo.py' },
-    { filename: 'tests/components/foo/common.yaml' },
-  ];
-  const VALIDATOR_FILES = [
-    { filename: 'esphome/config_validation.py' },
-    { filename: 'tests/unit_tests/test_config_validation.py' },
-  ];
-
-  it('new-feature-developer without has-tests adds needs-tests but not needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-tests'));
-    assert.ok(!labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer with has-tests does not add needs-tests', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-tests'));
-  });
-
-  it('new-feature without a docs link still adds needs-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('new-feature-developer without a developer docs link adds needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io shorthand link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a developers.esphome.io URL link satisfies needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, DEV_DOCS_URL_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('a user docs (esphome.io) link does not satisfy needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), SOURCE_FILES, USER_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-
-  it('a developer docs link does not satisfy needs-docs for new-feature', async () => {
-    const labels = await detectRequirements(new Set(['new-feature', 'has-tests']), [], DEV_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-docs'));
-  });
-
-  it('changes confined to core validator files are exempt from needs-developer-docs', async () => {
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), VALIDATOR_FILES, NO_DOCS_CONTEXT, false);
-    assert.ok(!labels.has('needs-developer-docs'));
-  });
-
-  it('validator changes mixed with other source files are not exempt', async () => {
-    const prFiles = [...VALIDATOR_FILES, { filename: 'esphome/components/foo/foo.py' }];
-    const labels = await detectRequirements(new Set(['new-feature-developer', 'has-tests']), prFiles, NO_DOCS_CONTEXT, false);
-    assert.ok(labels.has('needs-developer-docs'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// MANAGED_LABELS
-// ---------------------------------------------------------------------------
-
-describe('MANAGED_LABELS', () => {
-  it('includes new-feature-developer so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('new-feature-developer'));
-  });
-
-  it('includes needs-developer-docs so the workflow syncs it', () => {
-    assert.ok(MANAGED_LABELS.includes('needs-developer-docs'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// detectPRSize
-// ---------------------------------------------------------------------------
-
-describe('detectPRSize', () => {
-  const SMALL = 30;
-  const MEDIUM = 100;
-  const TOO_BIG = 1000;
-
-  function size(prFiles, isMegaPR = false) {
-    const totalAdditions = prFiles.reduce((sum, file) => sum + (file.additions || 0), 0);
-    const totalDeletions = prFiles.reduce((sum, file) => sum + (file.deletions || 0), 0);
-    return detectPRSize(prFiles, totalAdditions, totalDeletions, isMegaPR, SMALL, MEDIUM, TOO_BIG);
-  }
-
-  it('counts only non-test changes toward small-pr', async () => {
-    // 10 source + 5000 test lines -> non-test churn of 10 is still small.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 10, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('small-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('counts additions and deletions as churn (not net delta)', async () => {
-    // A balanced refactor (40 added, 40 removed) is 80 lines of churn -> medium, not small.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 40, deletions: 40 },
-    ]);
-    assert.ok(labels.has('medium-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('labels medium-pr when non-test changes exceed small threshold', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 60, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('medium-pr'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('uses net delta (not churn) for too-big', async () => {
-    // 600 added + 600 removed: 1200 churn (above too-big) but 0 net delta -> not too-big.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 600, deletions: 600 },
-    ]);
-    assert.equal(labels.size, 0);
-  });
-
-  it('labels too-big when non-test changes exceed the big threshold', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 2000, deletions: 0 },
-      { filename: 'tests/components/foo/test.esp32-idf.yaml', additions: 5000, deletions: 0 },
-    ]);
-    assert.ok(labels.has('too-big'));
-    assert.equal(labels.size, 1);
-  });
-
-  it('does not label too-big when mega-pr is set', async () => {
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 2000, deletions: 0 },
-    ], true);
-    assert.equal(labels.size, 0);
-  });
-
-  it('produces no size label for a large mega-pr in the gap above medium', async () => {
-    // Non-test changes land between MEDIUM and TOO_BIG: not small/medium, and mega-pr suppresses too-big.
-    const labels = await size([
-      { filename: 'esphome/components/foo/foo.cpp', additions: 500, deletions: 0 },
-    ], true);
-    assert.equal(labels.size, 0);
-  });
-});

.github/scripts/auto-label-pr/tests/reviews.test.js

@@ -1,38 +0,0 @@
-const { describe, it } = require('node:test');
-const assert = require('node:assert/strict');
-const { generateReviewMessages } = require('../reviews');
-
-const MAX_LABELS = 15;
-const TOO_BIG_THRESHOLD = 1000;
-
-function tooBigMessage(labelCount, additions) {
-  const files = [{ filename: 'esphome/components/a/a.cpp', additions, deletions: 0 }];
-  const messages = generateReviewMessages(['too-big'], labelCount, null, files, additions, 0, 'someone', MAX_LABELS, TOO_BIG_THRESHOLD);
-  assert.equal(messages.length, 1);
-  return messages[0];
-}
-
-describe('too-big review message', () => {
-  it('names the line cap when the PR is too long', () => {
-    const message = tooBigMessage(3, 1500);
-    assert.match(message, /will not be reviewed until it is at most 1000 lines \(excluding tests\)\./);
-    assert.match(message, /removed automatically once the PR is at most 1000 lines/);
-    assert.doesNotMatch(message, /components\/areas\./);
-  });
-
-  it('names the area cap when the PR touches too many areas but is short', () => {
-    const message = tooBigMessage(20, 200);
-    assert.match(message, /will not be reviewed until it touches at most 15 components\/areas\./);
-    assert.doesNotMatch(message, /until it is at most 1000 lines/);
-  });
-
-  it('names both caps when both are exceeded', () => {
-    const message = tooBigMessage(20, 1500);
-    assert.match(message, /is at most 1000 lines \(excluding tests\) and touches at most 15 components\/areas\./);
-  });
-
-  it('tells new-component authors to bring one platform first', () => {
-    assert.match(tooBigMessage(3, 1500), /hub and a single platform/);
-    assert.match(tooBigMessage(3, 1500), /mega-pr/);
-  });
-});

.github/scripts/codeowners.js

@@ -1,227 +0,0 @@
-// Shared CODEOWNERS parsing and matching utilities.
-//
-// Used by:
-//   - codeowner-review-request.yml
-//   - codeowner-approved-label-update.yml
-//   - auto-label-pr/detectors.js (detectCodeOwner)
-
-/**
- * Convert a CODEOWNERS glob pattern to a RegExp.
- *
- * Handles **, *, and ? wildcards after escaping regex-special characters.
- */
-function globToRegex(pattern) {
-  let regexStr = pattern
-    .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1')
-    .replace(/\*\*/g, '\x00GLOBSTAR\x00')  // protect ** from next replace
-    .replace(/\*/g, '[^/]*')               // single star
-    .replace(/\x00GLOBSTAR\x00/g, '.*')    // restore globstar
-    .replace(/\?/g, '.');
-  return new RegExp('^' + regexStr + '$');
-}
-
-/**
- * Parse raw CODEOWNERS file content into an array of
- * { pattern, regex, owners } objects.
- *
- * Each `owners` entry is the raw string from the file (e.g. "@user" or
- * "@esphome/core").
- */
-function parseCodeowners(content) {
-  const lines = content
-    .split('\n')
-    .map(line => line.trim())
-    .filter(line => line && !line.startsWith('#'));
-
-  const patterns = [];
-  for (const line of lines) {
-    const parts = line.split(/\s+/);
-    if (parts.length < 2) continue;
-
-    const pattern = parts[0];
-    const owners = parts.slice(1);
-    const regex = globToRegex(pattern);
-    patterns.push({ pattern, regex, owners });
-  }
-  return patterns;
-}
-
-/**
- * Fetch and parse the CODEOWNERS file via the GitHub API.
- *
- * @param {object} github  - octokit instance from actions/github-script
- * @param {string} owner   - repo owner
- * @param {string} repo    - repo name
- * @param {string} [ref]   - git ref (SHA / branch) to read from
- * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
- */
-async function fetchCodeowners(github, owner, repo, ref) {
-  const params = { owner, repo, path: 'CODEOWNERS' };
-  if (ref) params.ref = ref;
-
-  const { data: file } = await github.rest.repos.getContent(params);
-  const content = Buffer.from(file.content, 'base64').toString('utf8');
-  return parseCodeowners(content);
-}
-
-/**
- * Classify raw owner strings into individual users and teams.
- *
- * @param {string[]} rawOwners - e.g. ["@user1", "@esphome/core"]
- * @returns {{ users: string[], teams: string[] }}
- *   users  – login names without "@"
- *   teams  – team slugs without the "org/" prefix
- */
-function classifyOwners(rawOwners) {
-  const users = [];
-  const teams = [];
-  for (const o of rawOwners) {
-    const clean = o.startsWith('@') ? o.slice(1) : o;
-    if (clean.includes('/')) {
-      teams.push(clean.split('/')[1]);
-    } else {
-      users.push(clean);
-    }
-  }
-  return { users, teams };
-}
-
-/**
- * For each file, find its effective codeowners using GitHub's
- * "last match wins" semantics, then union across all files.
- *
- * @param {string[]} files              - list of file paths
- * @param {Array}    codeownersPatterns  - from parseCodeowners / fetchCodeowners
- * @returns {{ users: Set<string>, teams: Set<string>, matchedFileCount: number }}
- */
-function getEffectiveOwners(files, codeownersPatterns) {
-  const users = new Set();
-  const teams = new Set();
-  let matchedFileCount = 0;
-
-  for (const file of files) {
-    // Last matching pattern wins for each file
-    let effectiveOwners = null;
-    for (const { regex, owners } of codeownersPatterns) {
-      if (regex.test(file)) {
-        effectiveOwners = owners;
-      }
-    }
-    if (effectiveOwners) {
-      matchedFileCount++;
-      const classified = classifyOwners(effectiveOwners);
-      for (const u of classified.users) users.add(u);
-      for (const t of classified.teams) teams.add(t);
-    }
-  }
-
-  return { users, teams, matchedFileCount };
-}
-
-/**
- * Read and parse the CODEOWNERS file from disk.
- *
- * Use this when the repo is already checked out (avoids an API call).
- *
- * @param {string} [repoRoot='.'] - path to the repo root
- * @returns {Array<{pattern: string, regex: RegExp, owners: string[]}>}
- */
-function loadCodeowners(repoRoot = '.') {
-  const fs = require('fs');
-  const path = require('path');
-  const content = fs.readFileSync(path.join(repoRoot, 'CODEOWNERS'), 'utf8');
-  return parseCodeowners(content);
-}
-
-/** Possible label actions returned by determineLabelAction. */
-const LabelAction = Object.freeze({
-  ADD: 'add',
-  REMOVE: 'remove',
-  NONE: 'none',
-});
-
-/**
- * Determine what label action is needed for a PR based on codeowner approvals.
- *
- * Checks changed files against CODEOWNERS patterns, reviews, and current labels
- * to decide if the label should be added, removed, or left unchanged.
- *
- * @param {object} github              - octokit instance from actions/github-script
- * @param {string} owner               - repo owner
- * @param {string} repo                - repo name
- * @param {number} pr_number           - pull request number
- * @param {Array}  codeownersPatterns   - from loadCodeowners / fetchCodeowners
- * @param {string} labelName           - label to manage
- * @returns {Promise<LabelAction>}
- */
-async function determineLabelAction(github, owner, repo, pr_number, codeownersPatterns, labelName) {
-  // Get the list of changed files in this PR
-  const prFiles = await github.paginate(
-    github.rest.pulls.listFiles,
-    { owner, repo, pull_number: pr_number }
-  );
-
-  const changedFiles = prFiles.map(file => file.filename);
-  console.log(`Found ${changedFiles.length} changed files`);
-
-  if (changedFiles.length === 0) {
-    console.log('No changed files found');
-    return LabelAction.NONE;
-  }
-
-  // Get effective owners using last-match-wins semantics
-  const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-  const componentCodeowners = effective.users;
-
-  console.log(`Component-specific codeowners: ${Array.from(componentCodeowners).join(', ') || '(none)'}`);
-
-  // Get current labels
-  const { data: currentLabels } = await github.rest.issues.listLabelsOnIssue({
-    owner, repo, issue_number: pr_number
-  });
-  const hasLabel = currentLabels.some(label => label.name === labelName);
-
-  if (componentCodeowners.size === 0) {
-    console.log('No component-specific codeowners found');
-    return hasLabel ? LabelAction.REMOVE : LabelAction.NONE;
-  }
-
-  // Get all reviews and find latest per user
-  const reviews = await github.paginate(
-    github.rest.pulls.listReviews,
-    { owner, repo, pull_number: pr_number }
-  );
-
-  const latestReviewByUser = new Map();
-  for (const review of reviews) {
-    if (!review.user || review.user.type === 'Bot' || review.state === 'COMMENTED') continue;
-    latestReviewByUser.set(review.user.login, review);
-  }
-
-  // Check if any component-specific codeowner has an active approval
-  let hasCodeownerApproval = false;
-  for (const [login, review] of latestReviewByUser) {
-    if (review.state === 'APPROVED' && componentCodeowners.has(login)) {
-      console.log(`Codeowner '${login}' has approved`);
-      hasCodeownerApproval = true;
-      break;
-    }
-  }
-
-  if (hasCodeownerApproval && !hasLabel) return LabelAction.ADD;
-  if (!hasCodeownerApproval && hasLabel) return LabelAction.REMOVE;
-
-  console.log(`Label already ${hasLabel ? 'present' : 'absent'}, no change needed`);
-  return LabelAction.NONE;
-}
-
-module.exports = {
-  globToRegex,
-  parseCodeowners,
-  fetchCodeowners,
-  loadCodeowners,
-  classifyOwners,
-  getEffectiveOwners,
-  LabelAction,
-  determineLabelAction
-};

.github/scripts/detect-tags.js

@@ -1,65 +0,0 @@
-/**
- * Shared tag detection from changed file paths.
- * Used by pr-title-check and auto-label-pr workflows.
- */
-
-const COMPONENT_REGEX = /^esphome\/components\/([^\/]+)\//;
-
-/**
- * Detect component names from changed files.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {Set<string>} Set of component names
- */
-function detectComponents(changedFiles) {
-  const components = new Set();
-  for (const file of changedFiles) {
-    const match = file.match(COMPONENT_REGEX);
-    if (match) {
-      components.add(match[1]);
-    }
-  }
-  return components;
-}
-
-/**
- * Detect if core files were changed.
- * Core files are in esphome/core/ or top-level esphome/ directory.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasCoreChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('esphome/core/') ||
-    (file.startsWith('esphome/') && file.split('/').length === 2)
-  );
-}
-
-/**
- * Detect if dashboard files were changed.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasDashboardChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('esphome/components/dashboard_import/')
-  );
-}
-
-/**
- * Detect if GitHub Actions files were changed.
- * @param {string[]} changedFiles - List of changed file paths
- * @returns {boolean}
- */
-function hasGitHubActionsChanges(changedFiles) {
-  return changedFiles.some(file =>
-    file.startsWith('.github/workflows/')
-  );
-}
-
-module.exports = {
-  COMPONENT_REGEX,
-  detectComponents,
-  hasCoreChanges,
-  hasDashboardChanges,
-  hasGitHubActionsChanges,
-};

.github/skills

@@ -1 +0,0 @@
-../.agents/skills

.github/workflows/auto-label-pr.yml

@@ -6,14 +6,12 @@ on:
   pull_request_target:
     types: [labeled, opened, reopened, synchronize, edited]
 
-# All PR/label/review writes are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  contents: read  # actions/checkout reads the workflow source
+  pull-requests: write
+  contents: read
 
 env:
   SMALL_PR_THRESHOLD: 30
-  MEDIUM_PR_THRESHOLD: 100
   MAX_LABELS: 15
   TOO_BIG_THRESHOLD: 1000
   COMPONENT_LABEL_THRESHOLD: 10
@@ -21,26 +19,602 @@ env:
 jobs:
   label:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
+    if: github.event.action != 'labeled' || github.event.sender.type != 'Bot'
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4.2.2
 
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@v2
         with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
-          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
-          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
-          permission-pull-requests: write  # pulls.get, pulls.listFiles, list/create/update/dismissReview
 
       - name: Auto Label PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            const script = require('./.github/scripts/auto-label-pr/index.js');
-            await script({ github, context });
+            const fs = require('fs');
+
+            // Constants
+            const SMALL_PR_THRESHOLD = parseInt('${{ env.SMALL_PR_THRESHOLD }}');
+            const MAX_LABELS = parseInt('${{ env.MAX_LABELS }}');
+            const TOO_BIG_THRESHOLD = parseInt('${{ env.TOO_BIG_THRESHOLD }}');
+            const COMPONENT_LABEL_THRESHOLD = parseInt('${{ env.COMPONENT_LABEL_THRESHOLD }}');
+            const BOT_COMMENT_MARKER = '<!-- auto-label-pr-bot -->';
+            const CODEOWNERS_MARKER = '<!-- codeowners-request -->';
+            const TOO_BIG_MARKER = '<!-- too-big-request -->';
+
+            const MANAGED_LABELS = [
+              'new-component',
+              'new-platform',
+              'new-target-platform',
+              'merging-to-release',
+              'merging-to-beta',
+              'core',
+              'small-pr',
+              'dashboard',
+              'github-actions',
+              'by-code-owner',
+              'has-tests',
+              'needs-tests',
+              'needs-docs',
+              'needs-codeowners',
+              'too-big',
+              'labeller-recheck'
+            ];
+
+            const DOCS_PR_PATTERNS = [
+              /https:\/\/github\.com\/esphome\/esphome-docs\/pull\/\d+/,
+              /esphome\/esphome-docs#\d+/
+            ];
+
+            // Global state
+            const { owner, repo } = context.repo;
+            const pr_number = context.issue.number;
+
+            // Get current labels and PR data
+            const { data: currentLabelsData } = await github.rest.issues.listLabelsOnIssue({
+              owner,
+              repo,
+              issue_number: pr_number
+            });
+            const currentLabels = currentLabelsData.map(label => label.name);
+            const managedLabels = currentLabels.filter(label =>
+              label.startsWith('component: ') || MANAGED_LABELS.includes(label)
+            );
+
+            // Check for mega-PR early - if present, skip most automatic labeling
+            const isMegaPR = currentLabels.includes('mega-pr');
+
+            // Get all PR files with automatic pagination
+            const prFiles = await github.paginate(
+              github.rest.pulls.listFiles,
+              {
+                owner,
+                repo,
+                pull_number: pr_number
+              }
+            );
+
+            // Calculate data from PR files
+            const changedFiles = prFiles.map(file => file.filename);
+            const totalChanges = prFiles.reduce((sum, file) => sum + (file.additions || 0) + (file.deletions || 0), 0);
+
+            console.log('Current labels:', currentLabels.join(', '));
+            console.log('Changed files:', changedFiles.length);
+            console.log('Total changes:', totalChanges);
+            if (isMegaPR) {
+              console.log('Mega-PR detected - applying limited labeling logic');
+            }
+
+            // Fetch API data
+            async function fetchApiData() {
+              try {
+                const response = await fetch('https://data.esphome.io/components.json');
+                const componentsData = await response.json();
+                return {
+                  targetPlatforms: componentsData.target_platforms || [],
+                  platformComponents: componentsData.platform_components || []
+                };
+              } catch (error) {
+                console.log('Failed to fetch components data from API:', error.message);
+                return { targetPlatforms: [], platformComponents: [] };
+              }
+            }
+
+            // Strategy: Merge branch detection
+            async function detectMergeBranch() {
+              const labels = new Set();
+              const baseRef = context.payload.pull_request.base.ref;
+
+              if (baseRef === 'release') {
+                labels.add('merging-to-release');
+              } else if (baseRef === 'beta') {
+                labels.add('merging-to-beta');
+              }
+
+              return labels;
+            }
+
+            // Strategy: Component and platform labeling
+            async function detectComponentPlatforms(apiData) {
+              const labels = new Set();
+              const componentRegex = /^esphome\/components\/([^\/]+)\//;
+              const targetPlatformRegex = new RegExp(`^esphome\/components\/(${apiData.targetPlatforms.join('|')})/`);
+
+              for (const file of changedFiles) {
+                const componentMatch = file.match(componentRegex);
+                if (componentMatch) {
+                  labels.add(`component: ${componentMatch[1]}`);
+                }
+
+                const platformMatch = file.match(targetPlatformRegex);
+                if (platformMatch) {
+                  labels.add(`platform: ${platformMatch[1]}`);
+                }
+              }
+
+              return labels;
+            }
+
+            // Strategy: New component detection
+            async function detectNewComponents() {
+              const labels = new Set();
+              const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+              for (const file of addedFiles) {
+                const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
+                if (componentMatch) {
+                  try {
+                    const content = fs.readFileSync(file, 'utf8');
+                    if (content.includes('IS_TARGET_PLATFORM = True')) {
+                      labels.add('new-target-platform');
+                    }
+                  } catch (error) {
+                    console.log(`Failed to read content of ${file}:`, error.message);
+                  }
+                  labels.add('new-component');
+                }
+              }
+
+              return labels;
+            }
+
+            // Strategy: New platform detection
+            async function detectNewPlatforms(apiData) {
+              const labels = new Set();
+              const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
+
+              for (const file of addedFiles) {
+                const platformFileMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/);
+                if (platformFileMatch) {
+                  const [, component, platform] = platformFileMatch;
+                  if (apiData.platformComponents.includes(platform)) {
+                    labels.add('new-platform');
+                  }
+                }
+
+                const platformDirMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/);
+                if (platformDirMatch) {
+                  const [, component, platform] = platformDirMatch;
+                  if (apiData.platformComponents.includes(platform)) {
+                    labels.add('new-platform');
+                  }
+                }
+              }
+
+              return labels;
+            }
+
+            // Strategy: Core files detection
+            async function detectCoreChanges() {
+              const labels = new Set();
+              const coreFiles = changedFiles.filter(file =>
+                file.startsWith('esphome/core/') ||
+                (file.startsWith('esphome/') && file.split('/').length === 2)
+              );
+
+              if (coreFiles.length > 0) {
+                labels.add('core');
+              }
+
+              return labels;
+            }
+
+            // Strategy: PR size detection
+            async function detectPRSize() {
+              const labels = new Set();
+              const testChanges = prFiles
+                .filter(file => file.filename.startsWith('tests/'))
+                .reduce((sum, file) => sum + (file.additions || 0) + (file.deletions || 0), 0);
+
+              const nonTestChanges = totalChanges - testChanges;
+
+              if (totalChanges <= SMALL_PR_THRESHOLD) {
+                labels.add('small-pr');
+              }
+
+              // Don't add too-big if mega-pr label is already present
+              if (nonTestChanges > TOO_BIG_THRESHOLD && !isMegaPR) {
+                labels.add('too-big');
+              }
+
+              return labels;
+            }
+
+            // Strategy: Dashboard changes
+            async function detectDashboardChanges() {
+              const labels = new Set();
+              const dashboardFiles = changedFiles.filter(file =>
+                file.startsWith('esphome/dashboard/') ||
+                file.startsWith('esphome/components/dashboard_import/')
+              );
+
+              if (dashboardFiles.length > 0) {
+                labels.add('dashboard');
+              }
+
+              return labels;
+            }
+
+            // Strategy: GitHub Actions changes
+            async function detectGitHubActionsChanges() {
+              const labels = new Set();
+              const githubActionsFiles = changedFiles.filter(file =>
+                file.startsWith('.github/workflows/')
+              );
+
+              if (githubActionsFiles.length > 0) {
+                labels.add('github-actions');
+              }
+
+              return labels;
+            }
+
+            // Strategy: Code owner detection
+            async function detectCodeOwner() {
+              const labels = new Set();
+
+              try {
+                const { data: codeownersFile } = await github.rest.repos.getContent({
+                  owner,
+                  repo,
+                  path: 'CODEOWNERS',
+                });
+
+                const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
+                const prAuthor = context.payload.pull_request.user.login;
+
+                const codeownersLines = codeownersContent.split('\n')
+                  .map(line => line.trim())
+                  .filter(line => line && !line.startsWith('#'));
+
+                const codeownersRegexes = codeownersLines.map(line => {
+                  const parts = line.split(/\s+/);
+                  const pattern = parts[0];
+                  const owners = parts.slice(1);
+
+                  let regex;
+                  if (pattern.endsWith('*')) {
+                    const dir = pattern.slice(0, -1);
+                    regex = new RegExp(`^${dir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`);
+                  } else if (pattern.includes('*')) {
+                    // First escape all regex special chars except *, then replace * with .*
+                    const regexPattern = pattern
+                      .replace(/[.+?^${}()|[\]\\]/g, '\\$&')
+                      .replace(/\*/g, '.*');
+                    regex = new RegExp(`^${regexPattern}$`);
+                  } else {
+                    regex = new RegExp(`^${pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`);
+                  }
+
+                  return { regex, owners };
+                });
+
+                for (const file of changedFiles) {
+                  for (const { regex, owners } of codeownersRegexes) {
+                    if (regex.test(file) && owners.some(owner => owner === `@${prAuthor}`)) {
+                      labels.add('by-code-owner');
+                      return labels;
+                    }
+                  }
+                }
+              } catch (error) {
+                console.log('Failed to read or parse CODEOWNERS file:', error.message);
+              }
+
+              return labels;
+            }
+
+            // Strategy: Test detection
+            async function detectTests() {
+              const labels = new Set();
+              const testFiles = changedFiles.filter(file => file.startsWith('tests/'));
+
+              if (testFiles.length > 0) {
+                labels.add('has-tests');
+              }
+
+              return labels;
+            }
+
+            // Strategy: Requirements detection
+            async function detectRequirements(allLabels) {
+              const labels = new Set();
+
+              // Check for missing tests
+              if ((allLabels.has('new-component') || allLabels.has('new-platform')) && !allLabels.has('has-tests')) {
+                labels.add('needs-tests');
+              }
+
+              // Check for missing docs
+              if (allLabels.has('new-component') || allLabels.has('new-platform')) {
+                const prBody = context.payload.pull_request.body || '';
+                const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
+
+                if (!hasDocsLink) {
+                  labels.add('needs-docs');
+                }
+              }
+
+              // Check for missing CODEOWNERS
+              if (allLabels.has('new-component')) {
+                const codeownersModified = prFiles.some(file =>
+                  file.filename === 'CODEOWNERS' &&
+                  (file.status === 'modified' || file.status === 'added') &&
+                  (file.additions || 0) > 0
+                );
+
+                if (!codeownersModified) {
+                  labels.add('needs-codeowners');
+                }
+              }
+
+              return labels;
+            }
+
+            // Generate review messages
+            function generateReviewMessages(finalLabels) {
+              const messages = [];
+              const prAuthor = context.payload.pull_request.user.login;
+
+              // Too big message
+              if (finalLabels.includes('too-big')) {
+                const testChanges = prFiles
+                  .filter(file => file.filename.startsWith('tests/'))
+                  .reduce((sum, file) => sum + (file.additions || 0) + (file.deletions || 0), 0);
+                const nonTestChanges = totalChanges - testChanges;
+
+                const tooManyLabels = finalLabels.length > MAX_LABELS;
+                const tooManyChanges = nonTestChanges > TOO_BIG_THRESHOLD;
+
+                let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
+
+                if (tooManyLabels && tooManyChanges) {
+                  message += `This PR is too large with ${nonTestChanges} line changes (excluding tests) and affects ${finalLabels.length} different components/areas.`;
+                } else if (tooManyLabels) {
+                  message += `This PR affects ${finalLabels.length} different components/areas.`;
+                } else {
+                  message += `This PR is too large with ${nonTestChanges} line changes (excluding tests).`;
+                }
+
+                message += ` Please consider breaking it down into smaller, focused PRs to make review easier and reduce the risk of conflicts.\n\n`;
+                message += `For guidance on breaking down large PRs, see: https://developers.esphome.io/contributing/submitting-your-work/#how-to-approach-large-submissions`;
+
+                messages.push(message);
+              }
+
+              // CODEOWNERS message
+              if (finalLabels.includes('needs-codeowners')) {
+                const message = `${CODEOWNERS_MARKER}\n### 👥 Code Ownership\n\n` +
+                  `Hey there @${prAuthor},\n` +
+                  `Thanks for submitting this pull request! Can you add yourself as a codeowner for this integration? ` +
+                  `This way we can notify you if a bug report for this integration is reported.\n\n` +
+                  `In \`__init__.py\` of the integration, please add:\n\n` +
+                  `\`\`\`python\nCODEOWNERS = ["@${prAuthor}"]\n\`\`\`\n\n` +
+                  `And run \`script/build_codeowners.py\``;
+
+                messages.push(message);
+              }
+
+              return messages;
+            }
+
+            // Handle reviews
+            async function handleReviews(finalLabels) {
+              const reviewMessages = generateReviewMessages(finalLabels);
+              const hasReviewableLabels = finalLabels.some(label =>
+                ['too-big', 'needs-codeowners'].includes(label)
+              );
+
+              const { data: reviews } = await github.rest.pulls.listReviews({
+                owner,
+                repo,
+                pull_number: pr_number
+              });
+
+              const botReviews = reviews.filter(review =>
+                review.user.type === 'Bot' &&
+                review.state === 'CHANGES_REQUESTED' &&
+                review.body && review.body.includes(BOT_COMMENT_MARKER)
+              );
+
+              if (hasReviewableLabels) {
+                const reviewBody = `${BOT_COMMENT_MARKER}\n\n${reviewMessages.join('\n\n---\n\n')}`;
+
+                if (botReviews.length > 0) {
+                  // Update existing review
+                  await github.rest.pulls.updateReview({
+                    owner,
+                    repo,
+                    pull_number: pr_number,
+                    review_id: botReviews[0].id,
+                    body: reviewBody
+                  });
+                  console.log('Updated existing bot review');
+                } else {
+                  // Create new review
+                  await github.rest.pulls.createReview({
+                    owner,
+                    repo,
+                    pull_number: pr_number,
+                    body: reviewBody,
+                    event: 'REQUEST_CHANGES'
+                  });
+                  console.log('Created new bot review');
+                }
+              } else if (botReviews.length > 0) {
+                // Dismiss existing reviews
+                for (const review of botReviews) {
+                  try {
+                    await github.rest.pulls.dismissReview({
+                      owner,
+                      repo,
+                      pull_number: pr_number,
+                      review_id: review.id,
+                      message: 'Review dismissed: All requirements have been met'
+                    });
+                    console.log(`Dismissed bot review ${review.id}`);
+                  } catch (error) {
+                    console.log(`Failed to dismiss review ${review.id}:`, error.message);
+                  }
+                }
+              }
+            }
+
+            // Main execution
+            const apiData = await fetchApiData();
+            const baseRef = context.payload.pull_request.base.ref;
+
+            // Early exit for non-dev branches
+            if (baseRef !== 'dev') {
+              const branchLabels = await detectMergeBranch();
+              const finalLabels = Array.from(branchLabels);
+
+              console.log('Computed labels (merge branch only):', finalLabels.join(', '));
+
+              // Apply labels
+              if (finalLabels.length > 0) {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: pr_number,
+                  labels: finalLabels
+                });
+              }
+
+              // Remove old managed labels
+              const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
+              for (const label of labelsToRemove) {
+                try {
+                  await github.rest.issues.removeLabel({
+                    owner,
+                    repo,
+                    issue_number: pr_number,
+                    name: label
+                  });
+                } catch (error) {
+                  console.log(`Failed to remove label ${label}:`, error.message);
+                }
+              }
+
+              return;
+            }
+
+            // Run all strategies
+            const [
+              branchLabels,
+              componentLabels,
+              newComponentLabels,
+              newPlatformLabels,
+              coreLabels,
+              sizeLabels,
+              dashboardLabels,
+              actionsLabels,
+              codeOwnerLabels,
+              testLabels
+            ] = await Promise.all([
+              detectMergeBranch(),
+              detectComponentPlatforms(apiData),
+              detectNewComponents(),
+              detectNewPlatforms(apiData),
+              detectCoreChanges(),
+              detectPRSize(),
+              detectDashboardChanges(),
+              detectGitHubActionsChanges(),
+              detectCodeOwner(),
+              detectTests()
+            ]);
+
+            // Combine all labels
+            const allLabels = new Set([
+              ...branchLabels,
+              ...componentLabels,
+              ...newComponentLabels,
+              ...newPlatformLabels,
+              ...coreLabels,
+              ...sizeLabels,
+              ...dashboardLabels,
+              ...actionsLabels,
+              ...codeOwnerLabels,
+              ...testLabels
+            ]);
+
+            // Detect requirements based on all other labels
+            const requirementLabels = await detectRequirements(allLabels);
+            for (const label of requirementLabels) {
+              allLabels.add(label);
+            }
+
+            let finalLabels = Array.from(allLabels);
+
+            // For mega-PRs, exclude component labels if there are too many
+            if (isMegaPR) {
+              const componentLabels = finalLabels.filter(label => label.startsWith('component: '));
+              if (componentLabels.length > COMPONENT_LABEL_THRESHOLD) {
+                finalLabels = finalLabels.filter(label => !label.startsWith('component: '));
+                console.log(`Mega-PR detected - excluding ${componentLabels.length} component labels (threshold: ${COMPONENT_LABEL_THRESHOLD})`);
+              }
+            }
+
+            // Handle too many labels (only for non-mega PRs)
+            const tooManyLabels = finalLabels.length > MAX_LABELS;
+
+            if (tooManyLabels && !isMegaPR && !finalLabels.includes('too-big')) {
+              finalLabels = ['too-big'];
+            }
+
+            console.log('Computed labels:', finalLabels.join(', '));
+
+            // Handle reviews
+            await handleReviews(finalLabels);
+
+            // Apply labels
+            if (finalLabels.length > 0) {
+              console.log(`Adding labels: ${finalLabels.join(', ')}`);
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: pr_number,
+                labels: finalLabels
+              });
+            }
+
+            // Remove old managed labels
+            const labelsToRemove = managedLabels.filter(label => !finalLabels.includes(label));
+            for (const label of labelsToRemove) {
+              console.log(`Removing label: ${label}`);
+              try {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: pr_number,
+                  name: label
+                });
+              } catch (error) {
+                console.log(`Failed to remove label ${label}:`, error.message);
+              }
+            }

.github/workflows/ci-api-proto.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-api-proto.yml"
 
 permissions:
-  contents: read        # actions/checkout for the PR head
-  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale
+  contents: read
+  pull-requests: write
 
 jobs:
   check:
@@ -21,55 +21,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v5.6.0
         with:
-          python-version: "3.12"
-      - name: Set up uv
-        # ``--system`` (below) installs into the setup-python interpreter;
-        # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          enable-cache: true
-          # Pull-request-only workflow: a save could never be shared and
-          # would only consume quota.
-          save-cache: "false"
-          # Pin uv version so the action does not have to fetch the
-          # manifest from raw.githubusercontent.com on every cache
-          # miss; that fetch flakes on Windows runners.
-          version: "0.11.15"
+          python-version: "3.11"
 
       - name: Install apt dependencies
-        # PR-only workflow, so nothing on dev could seed a shared apt cache
-        # entry; the cached apt action would save one copy per PR. Plain apt
-        # with every call bounded: the apt.conf.d timeouts make a dead
-        # mirror fail over in seconds, and timeout runs under sudo so it can
-        # kill apt-get itself. Install without update first: image lists are
-        # fresh, and the index refresh is what a congested mirror makes slow.
-        timeout-minutes: 15
         run: |
-          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
-          Acquire::Retries "1";
-          Acquire::http::Timeout "15";
-          Acquire::https::Timeout "15";
-          EOF
-          # Common path: the image's package lists are fresh enough.
-          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
-              apt-get install -y protobuf-compiler; then
-            protoc --version
-            exit 0
-          fi
-          # Rescue path: refresh the lists once with a generous bound; the
-          # apt config already fails a stalled mirror over quickly.
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
-            dpkg --configure -a || true
-          sudo timeout -k 15 300 apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
-            apt-get install -y protobuf-compiler
+          sudo apt update
+          sudo apt-cache show protobuf-compiler
+          sudo apt install -y protobuf-compiler
           protoc --version
       - name: Install python dependencies
-        run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt
+        run: pip install aioesphomeapi -c requirements.txt -r requirements_dev.txt
       - name: Generate files
         run: script/api_protobuf/api_protobuf.py
       - name: Check for changes
@@ -82,7 +47,7 @@ jobs:
           fi
       - if: failure()
         name: Review PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -97,7 +62,7 @@ jobs:
         run: git diff
       - if: failure()
         name: Archive artifacts
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: generated-proto-files
           path: |
@@ -105,7 +70,7 @@ jobs:
             esphome/components/api/api_pb2_service.*
       - if: success()
         name: Dismiss review
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({

.github/workflows/ci-clang-tidy-hash.yml

@@ -0,0 +1,75 @@
+name: Clang-tidy Hash CI
+
+on:
+  pull_request:
+    paths:
+      - ".clang-tidy"
+      - "platformio.ini"
+      - "requirements_dev.txt"
+      - ".clang-tidy.hash"
+      - "script/clang_tidy_hash.py"
+      - ".github/workflows/ci-clang-tidy-hash.yml"
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  verify-hash:
+    name: Verify clang-tidy hash
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.2
+
+      - name: Set up Python
+        uses: actions/setup-python@v5.6.0
+        with:
+          python-version: "3.11"
+
+      - name: Verify hash
+        run: |
+          python script/clang_tidy_hash.py --verify
+
+      - if: failure()
+        name: Show hash details
+        run: |
+          python script/clang_tidy_hash.py
+          echo "## Job Failed" | tee -a $GITHUB_STEP_SUMMARY
+          echo "You have modified clang-tidy configuration but have not updated the hash." | tee -a $GITHUB_STEP_SUMMARY
+          echo "Please run 'script/clang_tidy_hash.py --update' and commit the changes." | tee -a $GITHUB_STEP_SUMMARY
+
+      - if: failure()
+        name: Request changes
+        uses: actions/github-script@v7.0.1
+        with:
+          script: |
+            await github.rest.pulls.createReview({
+              pull_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: 'REQUEST_CHANGES',
+              body: 'You have modified clang-tidy configuration but have not updated the hash.\nPlease run `script/clang_tidy_hash.py --update` and commit the changes.'
+            })
+
+      - if: success()
+        name: Dismiss review
+        uses: actions/github-script@v7.0.1
+        with:
+          script: |
+            let reviews = await github.rest.pulls.listReviews({
+              pull_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo
+            });
+            for (let review of reviews.data) {
+              if (review.user.login === 'github-actions[bot]' && review.state === 'CHANGES_REQUESTED') {
+                await github.rest.pulls.dismissReview({
+                  pull_number: context.issue.number,
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  review_id: review.id,
+                  message: 'Clang-tidy hash now matches configuration.'
+                });
+              }
+            }

.github/workflows/ci-docker.yml

@@ -1,40 +1,29 @@
 ---
 name: CI for docker images
 
-# Only run on PRs that touch the docker image, its build inputs, or any code
-# whose toolchain the compile smoke test exercises (core + target platforms).
+# Only run when docker paths change
 
 on:
-  pull_request:
+  push:
+    branches: [dev, beta, release]
     paths:
-      # Docker image and its build inputs.
       - "docker/**"
       - ".github/workflows/ci-docker.yml"
       - "requirements*.txt"
-      - "pyproject.toml"
-      - "esphome/idf_component.yml"
-      # Core, build pipeline, toolchain, and target-platform changes can change
-      # how a toolchain is set up or built, so re-run the per-toolchain compile
-      # smoke test when they change.
-      - "esphome/core/**"
-      - "esphome/writer.py"
-      - "esphome/build_gen/**"
-      - "esphome/build_helpers/**"
-      - "esphome/espidf/**"
-      - "esphome/platformio/**"
-      - "esphome/components/bk72xx/**"
-      - "esphome/components/esp32/**"
-      - "esphome/components/esp8266/**"
-      - "esphome/components/host/**"
-      - "esphome/components/libretiny/**"
-      - "esphome/components/ln882x/**"
-      - "esphome/components/nrf52/**"
-      - "esphome/components/rp2040/**"
-      - "esphome/components/rtl87xx/**"
-      - "esphome/components/zephyr/**"
+      - "platformio.ini"
+      - "script/platformio_install_deps.py"
+
+  pull_request:
+    paths:
+      - "docker/**"
+      - ".github/workflows/ci-docker.yml"
+      - "requirements*.txt"
+      - "platformio.ini"
+      - "script/platformio_install_deps.py"
 
 permissions:
-  contents: read  # actions/checkout only
+  contents: read
+  packages: read
 
 concurrency:
   # yamllint disable-line rule:line-length
@@ -45,9 +34,6 @@ jobs:
   check-docker:
     name: Build docker containers
     runs-on: ${{ matrix.os }}
-    permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # push branch-tagged images to ghcr.io for local testing
     strategy:
       fail-fast: false
       matrix:
@@ -56,169 +42,23 @@ jobs:
           - "ha-addon"
           - "docker"
           # - "lint"
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
-      push: ${{ steps.tag.outputs.push }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v5.6.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@v3.11.1
 
-      - name: Determine tag and whether to push
-        id: tag
-        env:
-          HEAD_REF: ${{ github.head_ref || github.ref_name }}
+      - name: Set TAG
         run: |
-          # Sanitize the branch name into a valid docker tag: replace invalid
-          # characters, ensure the first character is valid (tags must start
-          # with [A-Za-z0-9_]), and cap the length at 128 characters.
-          branch="$HEAD_REF"
-          tag="${branch//[^a-zA-Z0-9_.-]/-}"
-          case "$tag" in
-            [a-zA-Z0-9_]*) ;;
-            *) tag="pr-${tag}" ;;
-          esac
-          tag="${tag:0:128}"
-          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
-          # Only push branch images for same-repo pull requests. Push events
-          # only fire for dev/beta/release, whose images are owned by the
-          # release pipeline -- never overwrite those from here.
-          if [ "${{ github.event_name }}" = "pull_request" ] \
-            && [ "${{ github.repository }}" = "esphome/esphome" ] \
-            && [ "${{ github.event.pull_request.head.repo.full_name }}" = "esphome/esphome" ]; then
-            echo "push=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "push=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Log in to the GitHub container registry
-        if: steps.tag.outputs.push == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          echo "TAG=check" >> $GITHUB_ENV
 
       - name: Run build
         run: |
           docker/build.py \
-            --tag "${{ steps.tag.outputs.tag }}" \
+            --tag "${TAG}" \
             --arch "${{ matrix.os == 'ubuntu-24.04-arm' && 'aarch64' || 'amd64' }}" \
             --build-type "${{ matrix.build_type }}" \
-            --registry ghcr \
-            build ${{ steps.tag.outputs.push == 'true' && '--push --no-cache-to' || '' }} ${{ (matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker') && '--load' || '' }}
-
-      # The amd64 "docker" image is also loaded locally (above) and handed to
-      # compile-test as an artifact, so the smoke test reuses this build instead
-      # of building the image a second time. Using an artifact (rather than the
-      # pushed image) keeps it working for fork PRs, which never push to ghcr.io.
-      - name: Export image for compile-test
-        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
-        # zstd over gzip: docker save is on the critical path for every
-        # compile-test job, and zstd -T0 is multithreaded (export 50s -> 9s).
-        # docker load auto-detects the format; its time is layer extraction,
-        # not decompression, so it is unchanged. shell: bash adds pipefail so
-        # a failed docker save cannot upload a truncated artifact.
-        shell: bash
-        run: docker save "ghcr.io/esphome/esphome-amd64:${{ steps.tag.outputs.tag }}" | zstd -T0 -3 > compile-test-image.tar.zst
-
-      - name: Upload compile-test image artifact
-        if: matrix.os == 'ubuntu-24.04' && matrix.build_type == 'docker'
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          # The tar is already compressed, so upload it as-is. archive: false
-          # skips the redundant zip and makes the file name the artifact name
-          # (the `name` input is ignored in that mode).
-          path: compile-test-image.tar.zst
-          retention-days: 1
-          archive: false
-
-  manifest:
-    name: Push ${{ matrix.build_type }} manifest to ghcr.io
-    needs: [check-docker]
-    if: needs.check-docker.outputs.push == 'true'
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read   # actions/checkout to run docker/build.py
-      packages: write  # buildx imagetools writes the multi-arch tag to ghcr.io
-    strategy:
-      fail-fast: false
-      matrix:
-        build_type:
-          - "ha-addon"
-          - "docker"
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
-
-      - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Create and push manifest
-        run: |
-          docker/build.py \
-            --tag "${{ needs.check-docker.outputs.tag }}" \
-            --build-type "${{ matrix.build_type }}" \
-            --registry ghcr \
-            manifest
-
-  # Smoke-test the built image by compiling one minimal config per target
-  # platform / toolchain. This catches missing system dependencies in the image
-  # that only surface when a given toolchain is downloaded and run. The image is
-  # the amd64 "docker" build produced by check-docker (shared as an artifact).
-  compile-test:
-    name: Compile ${{ matrix.id }}
-    needs: check-docker
-    runs-on: ubuntu-24.04
-    permissions:
-      contents: read  # actions/checkout to load the test configs
-    strategy:
-      fail-fast: false
-      matrix:
-        # One entry per distinct toolchain. ESP32 variants (c3/c6/s2/s3/p4)
-        # share a toolchain bundle, so esp32 is exercised on the base variant
-        # across the full framework x toolchain cross-product (arduino/esp-idf
-        # framework, each built with the platformio and native esp-idf
-        # toolchains) so both toolchains stay covered regardless of which one is
-        # the default.
-        id:
-          - esp8266-arduino
-          - esp8266-arduino-native
-          - esp32-arduino-platformio
-          - esp32-arduino-esp-idf
-          - esp32-idf-platformio
-          - esp32-idf-esp-idf
-          - rp2040-arduino
-          - bk72xx-arduino
-          - rtl87xx-arduino
-          - ln882x-arduino
-          - nrf52
-          - host
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Download image artifact
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: compile-test-image.tar.zst
-      - name: Load image
-        run: docker load --input compile-test-image.tar.zst
-      - name: Compile ${{ matrix.id }}
-        run: |
-          docker run --rm \
-            -v "${{ github.workspace }}/docker/test_configs:/config" \
-            -e ESPHOME_LDGEN_STRICT=1 \
-            "ghcr.io/esphome/esphome-amd64:${{ needs.check-docker.outputs.tag }}" \
-            compile "${{ matrix.id }}.yaml"
+            build

.github/workflows/ci-github-scripts.yml

@@ -1,27 +0,0 @@
-name: CI - GitHub Scripts
-
-on:
-  push:
-    branches: [dev, beta, release]
-    paths:
-      - ".github/scripts/**"
-      - ".github/workflows/ci-github-scripts.yml"
-  pull_request:
-    paths:
-      - ".github/scripts/**"
-      - ".github/workflows/ci-github-scripts.yml"
-
-permissions:
-  contents: read
-
-jobs:
-  test-auto-label-pr:
-    name: Test auto-label-pr scripts
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run tests
-        working-directory: .github/scripts/auto-label-pr
-        run: npm test

.github/workflows/ci-memory-impact-comment.yml

@@ -1,111 +0,0 @@
----
-name: Memory Impact Comment (Forks)
-
-on:
-  workflow_run:
-    workflows: ["CI"]
-    types: [completed]
-
-permissions:
-  contents: read        # actions/checkout of the base repo at the PR's target branch
-  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
-  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
-
-jobs:
-  memory-impact-comment:
-    name: Post memory impact comment (fork PRs only)
-    runs-on: ubuntu-24.04
-    # Only run for PRs from forks that had successful CI runs
-    if: >
-      github.event.workflow_run.event == 'pull_request' &&
-      github.event.workflow_run.conclusion == 'success' &&
-      github.event.workflow_run.head_repository.full_name != github.repository
-    env:
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      - name: Get PR details
-        id: pr
-        run: |
-          # Get PR details by searching for PR with matching head SHA
-          # The workflow_run.pull_requests field is often empty for forks
-          # Use paginate to handle repos with many open PRs
-          head_sha="${{ github.event.workflow_run.head_sha }}"
-          pr_data=$(gh api --paginate "/repos/${{ github.repository }}/pulls" \
-            --jq ".[] | select(.head.sha == \"$head_sha\") | {number: .number, base_ref: .base.ref}" \
-            | head -n 1)
-
-          if [ -z "$pr_data" ]; then
-            echo "No PR found for SHA $head_sha, skipping"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          pr_number=$(echo "$pr_data" | jq -r '.number')
-          base_ref=$(echo "$pr_data" | jq -r '.base_ref')
-
-          echo "pr_number=$pr_number" >> "$GITHUB_OUTPUT"
-          echo "base_ref=$base_ref" >> "$GITHUB_OUTPUT"
-          echo "Found PR #$pr_number targeting base branch: $base_ref"
-
-      - name: Check out code from base repository
-        if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          # Always check out from the base repository (esphome/esphome), never from forks
-          # Use the PR's target branch to ensure we run trusted code from the main repo
-          repository: ${{ github.repository }}
-          ref: ${{ steps.pr.outputs.base_ref }}
-
-      - name: Restore Python
-        if: steps.pr.outputs.skip != 'true'
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: "3.12"
-          cache-key: ${{ hashFiles('.cache-key') }}
-
-      - name: Download memory analysis artifacts
-        if: steps.pr.outputs.skip != 'true'
-        run: |
-          run_id="${{ github.event.workflow_run.id }}"
-          echo "Downloading artifacts from workflow run $run_id"
-
-          mkdir -p memory-analysis
-
-          # Download target analysis artifact
-          if gh run download --name "memory-analysis-target" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
-            echo "Downloaded memory-analysis-target artifact."
-          else
-            echo "No memory-analysis-target artifact found."
-          fi
-
-          # Download PR analysis artifact
-          if gh run download --name "memory-analysis-pr" --dir memory-analysis --repo "${{ github.repository }}" "$run_id"; then
-            echo "Downloaded memory-analysis-pr artifact."
-          else
-            echo "No memory-analysis-pr artifact found."
-          fi
-
-      - name: Check if artifacts exist
-        id: check
-        if: steps.pr.outputs.skip != 'true'
-        run: |
-          if [ -f ./memory-analysis/memory-analysis-target.json ] && [ -f ./memory-analysis/memory-analysis-pr.json ]; then
-            echo "found=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "found=false" >> "$GITHUB_OUTPUT"
-            echo "Memory analysis artifacts not found, skipping comment"
-          fi
-
-      - name: Post or update PR comment
-        if: steps.pr.outputs.skip != 'true' && steps.check.outputs.found == 'true'
-        env:
-          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
-        run: |
-          . venv/bin/activate
-          # Pass PR number and JSON file paths directly to Python script
-          # Let Python parse the JSON to avoid shell injection risks
-          # The script will validate and sanitize all inputs
-          python script/ci_memory_impact_comment.py \
-            --pr-number "$PR_NUMBER" \
-            --target-json ./memory-analysis/memory-analysis-target.json \
-            --pr-json ./memory-analysis/memory-analysis-pr.json

.github/workflows/close-pr-from-fork-default-branch.yml

@@ -1,72 +0,0 @@
-name: Close PR From Fork Default Branch
-
-on:
-  # pull_request_target is required so we have permission to comment and close PRs from forks.
-  pull_request_target:
-    types: [opened, reopened]
-
-permissions:
-  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
-  issues: write         # issues.createComment to explain to the contributor why the PR was closed
-
-jobs:
-  close:
-    name: Close PR opened from fork's default branch
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-      && github.event.pull_request.head.ref == github.event.repository.default_branch
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.payload.pull_request.number;
-            const author = context.payload.pull_request.user.login;
-            const defaultBranch = context.payload.repository.default_branch;
-            const headRepo = context.payload.pull_request.head.repo.full_name;
-
-            const body = [
-              `Hi @${author}, thanks for opening a pull request! :tada:`,
-              ``,
-              `It looks like this PR was opened from the \`${defaultBranch}\` branch of your fork (\`${headRepo}\`), which is the same name as this repository's default branch. Working directly on \`${defaultBranch}\` in your fork causes a few problems:`,
-              ``,
-              `- Your fork's \`${defaultBranch}\` branch will permanently diverge from \`esphome/esphome:${defaultBranch}\`, making it hard to keep your fork up to date.`,
-              `- Any additional commits you push to \`${defaultBranch}\` will be added to this PR, so you can't easily work on multiple changes at once.`,
-              `- Pushing maintainer fixes to your branch is awkward, since it means committing directly to your fork's default branch.`,
-              `- It makes local collaboration painful — \`${defaultBranch}\` in a checkout becomes ambiguous between upstream and your fork, and maintainers end up with naming collisions when fetching your branch.`,
-              ``,
-              `Please re-open this as a new PR from a dedicated feature branch. The usual flow looks like:`,
-              ``,
-              `\`\`\`bash`,
-              `# Make sure your fork's ${defaultBranch} is up to date with upstream`,
-              `git remote add upstream https://github.com/${owner}/${repo}.git  # if you haven't already`,
-              `git fetch upstream`,
-              `git checkout ${defaultBranch}`,
-              `git reset --hard upstream/${defaultBranch}`,
-              `git push --force-with-lease origin ${defaultBranch}`,
-              ``,
-              `# Create a new branch for your change and cherry-pick / re-apply your commits there`,
-              `git checkout -b my-feature-branch upstream/${defaultBranch}`,
-              `# ...re-apply your changes, then:`,
-              `git push origin my-feature-branch`,
-              `\`\`\``,
-              ``,
-              `Then open a new pull request from \`my-feature-branch\` into \`${owner}/${repo}:${defaultBranch}\`.`,
-              ``,
-              `Closing this PR for now — sorry for the friction, and thanks again for contributing! :heart:`,
-            ].join('\n');
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body,
-            });
-
-            await github.rest.pulls.update({
-              owner,
-              repo,
-              pull_number: prNumber,
-              state: 'closed',
-            });

.github/workflows/codeowner-approved-label-update.yml

@@ -1,81 +0,0 @@
-# Adds/removes a 'code-owner-approved' label when a component-specific
-# codeowner approves (or dismisses) a PR.
-#
-# Uses pull_request_target so that fork PRs do not require workflow approval.
-# The label is reconciled on every PR update; for review events specifically,
-# this means the label is applied on the next push after a codeowner review.
-
-name: Codeowner Approved Label
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, ready_for_review]
-    branches-ignore:
-      - release
-      - beta
-
-permissions:
-  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
-  pull-requests: read  # listReviews to determine whether a codeowner has approved
-  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
-
-jobs:
-  codeowner-approved:
-    name: Run
-    if: ${{ github.repository == 'esphome/esphome' }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          sparse-checkout: |
-            .github/scripts/codeowners.js
-            CODEOWNERS
-
-      - name: Check codeowner approval and update label
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        with:
-          script: |
-            const { loadCodeowners, determineLabelAction, LabelAction } = require('./.github/scripts/codeowners.js');
-
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const pr_number = parseInt(process.env.PR_NUMBER, 10);
-            const LABEL_NAME = 'code-owner-approved';
-
-            console.log(`Processing PR #${pr_number} for codeowner approval label`);
-
-            const codeownersPatterns = loadCodeowners();
-            const action = await determineLabelAction(
-              github, owner, repo, pr_number, codeownersPatterns, LABEL_NAME
-            );
-
-            if (action === LabelAction.NONE) {
-              console.log('No label change needed');
-              return;
-            }
-
-            try {
-              if (action === LabelAction.ADD) {
-                await github.rest.issues.addLabels({
-                  owner, repo, issue_number: pr_number, labels: [LABEL_NAME]
-                });
-                console.log(`Added '${LABEL_NAME}' label`);
-              } else if (action === LabelAction.REMOVE) {
-                await github.rest.issues.removeLabel({
-                  owner, repo, issue_number: pr_number, name: LABEL_NAME
-                });
-                console.log(`Removed '${LABEL_NAME}' label`);
-              }
-            } catch (error) {
-              if (error.status === 403) {
-                console.log(`Warning: insufficient permissions to update label (expected for fork PRs)`);
-              } else if (error.status === 404) {
-                console.log(`Label '${LABEL_NAME}' not present, nothing to remove`);
-              } else {
-                throw error;
-              }
-            }

.github/workflows/codeowner-review-request.yml

@@ -13,43 +13,21 @@ on:
   # Needs to be pull_request_target to get write permissions
   pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review]
-    branches-ignore:
-      - release
-      - beta
 
-# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+  pull-requests: write
+  contents: read
 
 jobs:
   request-codeowner-reviews:
     name: Run
-    if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
+    if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout base branch
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by the github-script step below.
-          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
-          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
-
       - name: Request reviews from component codeowners
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
-            const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
-
             const owner = context.repo.owner;
             const repo = context.repo.repo;
             const pr_number = context.payload.pull_request.number;
@@ -60,15 +38,12 @@ jobs:
             const BOT_COMMENT_MARKER = '<!-- codeowner-review-request-bot -->';
 
             try {
-              // Get the list of changed files in this PR (with pagination)
-              const files = await github.paginate(
-                github.rest.pulls.listFiles,
-                {
-                  owner,
-                  repo,
-                  pull_number: pr_number
-                }
-              );
+              // Get the list of changed files in this PR
+              const { data: files } = await github.rest.pulls.listFiles({
+                owner,
+                repo,
+                pull_number: pr_number
+              });
 
               const changedFiles = files.map(file => file.filename);
               console.log(`Found ${changedFiles.length} changed files`);
@@ -78,10 +53,32 @@ jobs:
                 return;
               }
 
-              // Parse CODEOWNERS from the checked-out base branch
-              const codeownersPatterns = loadCodeowners();
+              // Fetch CODEOWNERS file from root
+              const { data: codeownersFile } = await github.rest.repos.getContent({
+                owner,
+                repo,
+                path: 'CODEOWNERS',
+                ref: context.payload.pull_request.base.sha
+              });
+              const codeownersContent = Buffer.from(codeownersFile.content, 'base64').toString('utf8');
 
-              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
+              // Parse CODEOWNERS file to extract all patterns and their owners
+              const codeownersLines = codeownersContent.split('\n')
+                .map(line => line.trim())
+                .filter(line => line && !line.startsWith('#'));
+
+              const codeownersPatterns = [];
+
+              // Convert CODEOWNERS pattern to regex (robust glob handling)
+              function globToRegex(pattern) {
+                // Escape regex special characters except for glob wildcards
+                let regexStr = pattern
+                  .replace(/([.+^=!:${}()|[\]\\])/g, '\\$1') // escape regex chars
+                  .replace(/\*\*/g, '.*') // globstar
+                  .replace(/\*/g, '[^/]*') // single star
+                  .replace(/\?/g, '.'); // question mark
+                return new RegExp('^' + regexStr + '$');
+              }
 
               // Helper function to create comment body
               function createCommentBody(reviewersList, teamsList, matchedFileCount, isSuccessful = true) {
@@ -96,11 +93,50 @@ jobs:
                 }
               }
 
-              // Match changed files against CODEOWNERS patterns using last-match-wins semantics
-              const effective = getEffectiveOwners(changedFiles, codeownersPatterns);
-              const matchedOwners = effective.users;
-              const matchedTeams = effective.teams;
-              const matchedFileCount = effective.matchedFileCount;
+              for (const line of codeownersLines) {
+                const parts = line.split(/\s+/);
+                if (parts.length < 2) continue;
+
+                const pattern = parts[0];
+                const owners = parts.slice(1);
+
+                // Use robust glob-to-regex conversion
+                const regex = globToRegex(pattern);
+                codeownersPatterns.push({ pattern, regex, owners });
+              }
+
+              console.log(`Parsed ${codeownersPatterns.length} codeowner patterns`);
+
+              // Match changed files against CODEOWNERS patterns
+              const matchedOwners = new Set();
+              const matchedTeams = new Set();
+              const fileMatches = new Map(); // Track which files matched which patterns
+
+              for (const file of changedFiles) {
+                for (const { pattern, regex, owners } of codeownersPatterns) {
+                  if (regex.test(file)) {
+                    console.log(`File '${file}' matches pattern '${pattern}' with owners: ${owners.join(', ')}`);
+
+                    if (!fileMatches.has(file)) {
+                      fileMatches.set(file, []);
+                    }
+                    fileMatches.get(file).push({ pattern, owners });
+
+                    // Add owners to the appropriate set (remove @ prefix)
+                    for (const owner of owners) {
+                      const cleanOwner = owner.startsWith('@') ? owner.slice(1) : owner;
+                      if (cleanOwner.includes('/')) {
+                        // Team mention (org/team-name)
+                        const teamName = cleanOwner.split('/')[1];
+                        matchedTeams.add(teamName);
+                      } else {
+                        // Individual user
+                        matchedOwners.add(cleanOwner);
+                      }
+                    }
+                  }
+                }
+              }
 
               if (matchedOwners.size === 0 && matchedTeams.size === 0) {
                 console.log('No codeowners found for any changed files');
@@ -134,14 +170,11 @@ jobs:
               }
 
               // Check for completed reviews to avoid re-requesting users who have already reviewed
-              const reviews = await github.paginate(
-                github.rest.pulls.listReviews,
-                {
-                  owner,
-                  repo,
-                  pull_number: pr_number
-                }
-              );
+              const { data: reviews } = await github.rest.pulls.listReviews({
+                owner,
+                repo,
+                pull_number: pr_number
+              });
 
               const reviewedUsers = new Set();
               reviews.forEach(review => {
@@ -214,7 +247,7 @@ jobs:
               }
 
               const totalReviewers = reviewersList.length + teamsList.length;
-              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${matchedFileCount} matched files`);
+              console.log(`Requesting reviews from ${reviewersList.length} users and ${teamsList.length} teams for ${fileMatches.size} matched files`);
 
               // Request reviews
               try {
@@ -246,7 +279,7 @@ jobs:
 
                 // Only add a comment if there are new codeowners to mention (not previously pinged)
                 if (reviewersList.length > 0 || teamsList.length > 0) {
-                  const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, true);
+                  const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, true);
 
                   await github.rest.issues.createComment({
                     owner,
@@ -264,7 +297,7 @@ jobs:
 
                   // Only try to add a comment if there are new codeowners to mention
                   if (reviewersList.length > 0 || teamsList.length > 0) {
-                    const commentBody = createCommentBody(reviewersList, teamsList, matchedFileCount, false);
+                    const commentBody = createCommentBody(reviewersList, teamsList, fileMatches.size, false);
 
                     try {
                       await github.rest.issues.createComment({

.github/workflows/codeql.yml

@@ -16,9 +16,6 @@ on:
   schedule:
     - cron: "30 18 * * 4"
 
-# Deny by default; the analyze job opts in to exactly what it needs.
-permissions: {}
-
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -29,10 +26,15 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
-      packages: read          # fetch internal or private CodeQL query packs
-      actions: read           # required by codeql-action when run from a private repo
-      contents: read          # actions/checkout to scan the repository
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
 
     strategy:
       fail-fast: false
@@ -52,11 +54,11 @@ jobs:
             # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@v3
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/external-component-bot.yml

@@ -4,29 +4,20 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
-# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
-# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
-permissions: {}
+permissions:
+  contents: read       #  Needed to fetch PR details
+  issues: write        #  Needed to create and update comments (PR comments are managed via the issues REST API)
+  pull-requests: write  # also needed?
 
 jobs:
   external-comment:
     name: External component comment
     runs-on: ubuntu-latest
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
-          # the issues.*Comment APIs require the pull-requests scope, not issues.
-          permission-pull-requests: write
-
       - name: Add external component comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             // Generate external component usage instructions
             function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {
@@ -125,20 +116,14 @@ jobs:
             }
 
             async function getEsphomeAndComponentChanges(github, owner, repo, prNumber) {
-                const changedFiles = await github.paginate(
-                    github.rest.pulls.listFiles,
-                    {
-                        owner: owner,
-                        repo: repo,
-                        pull_number: prNumber,
-                        per_page: 100,
-                    }
-                );
+                const changedFiles = await github.rest.pulls.listFiles({
+                    owner: owner,
+                    repo: repo,
+                    pull_number: prNumber,
+                });
 
-                // Files used only for development and CI, which do not affect use as an external component
-                const ignoredFiles = ["esphome/core/defines.h", "esphome/idf_component.yml"];
-                const esphomeChanges = changedFiles
-                    .filter(file => !ignoredFiles.includes(file.filename) && file.filename.startsWith('esphome/'))
+                const esphomeChanges = changedFiles.data
+                    .filter(file => file.filename !== "esphome/core/defines.h" && file.filename.startsWith('esphome/'))
                     .map(file => {
                         const match = file.filename.match(/esphome\/([^/]+)/);
                         return match ? match[1] : null;
@@ -150,7 +135,7 @@ jobs:
                 }
 
                 const uniqueEsphomeChanges = [...new Set(esphomeChanges)];
-                const componentChanges = changedFiles
+                const componentChanges = changedFiles.data
                     .filter(file => file.filename.startsWith('esphome/components/'))
                     .map(file => {
                         const match = file.filename.match(/esphome\/components\/([^/]+)\//);

.github/workflows/issue-codeowner-notify.yml

@@ -9,8 +9,8 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
-  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
+  issues: write
+  contents: read
 
 jobs:
   notify-codeowners:
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify codeowners for component issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
           script: |
             const owner = context.repo.owner;

.github/workflows/lock.yml

@@ -6,12 +6,6 @@ on:
     - cron: "30 0 * * *"  # Run daily at 00:30 UTC
   workflow_dispatch:
 
-# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
-permissions: {}
-
 jobs:
   lock:
-    permissions:
-      issues: write         # issues.lock on closed issues
-      pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@cc3e76de337dc59bc1cba8da58d963cd23b873f1  # 2026.9.0
+    uses: esphome/workflows/.github/workflows/lock.yml@main

.github/workflows/needs-docs.yml

@@ -0,0 +1,24 @@
+name: Needs Docs
+
+on:
+  pull_request:
+    types: [labeled, unlabeled]
+
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check for needs-docs label
+        uses: actions/github-script@v7.0.1
+        with:
+          script: |
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number
+            });
+            const needsDocs = labels.find(label => label.name === 'needs-docs');
+            if (needsDocs) {
+              core.setFailed('Pull request needs docs');
+            }

.github/workflows/pr-title-check.yml

@@ -1,98 +0,0 @@
-name: PR Title Check
-
-on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened]
-    branches-ignore:
-      - release
-      - beta
-
-permissions:
-  contents: read       # actions/checkout to load detect-tags.js
-  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
-
-jobs:
-  check:
-    name: Validate PR title
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const {
-              detectComponents,
-              hasCoreChanges,
-              hasDashboardChanges,
-              hasGitHubActionsChanges,
-            } = require('./.github/scripts/detect-tags.js');
-
-            const title = context.payload.pull_request.title;
-            const user = context.payload.pull_request.user;
-
-            // Skip bot PRs (e.g. dependabot, esphome[bot] device-class sync) -
-            // they have their own title formats.
-            if (user.type === 'Bot') {
-              return;
-            }
-
-            // Block titles starting with "word:" or "word(scope):" patterns
-            const commitStylePattern = /^\w+(\(.*?\))?[!]?\s*:/;
-            if (commitStylePattern.test(title)) {
-              core.setFailed(
-                `PR title should not start with a "prefix:" style format.\n` +
-                `Please use the format: [component] Brief description\n`
-              );
-              return;
-            }
-
-            // Get changed files to detect tags
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-            });
-            const filenames = files.map(f => f.filename);
-
-            // Detect tags from changed files using shared logic
-            const tags = new Set();
-
-            for (const comp of detectComponents(filenames)) {
-              tags.add(comp);
-            }
-            if (hasCoreChanges(filenames)) tags.add('core');
-            if (hasDashboardChanges(filenames)) tags.add('dashboard');
-            if (hasGitHubActionsChanges(filenames)) tags.add('ci');
-
-            if (tags.size === 0) {
-              return;
-            }
-
-            // Check for MDX syntax characters not wrapped in backticks.
-            // Astro docs MDX treats bare `<` as JSX component opening tags and
-            // bare `{` as JS expressions, so both must be escaped in changelog entries.
-            const stripped = title.replace(/`[^`]*`/g, '');
-            if (/[<>{}]/.test(stripped)) {
-              core.setFailed(
-                'PR title contains `<`, `>`, `{`, or `}` not wrapped in backticks.\n' +
-                'Astro docs MDX interprets bare `<` as JSX components and bare `{` as JS expressions.\n' +
-                'Please wrap these characters with backticks, e.g.: [component] Add `<feature>` support'
-              );
-              return;
-            }
-
-            // Check title starts with [tag] prefix
-            const bracketPattern = /^\[\w+\]/;
-            if (!bracketPattern.test(title)) {
-              const suggestion = [...tags].map(c => `[${c}]`).join('');
-              // Skip if the suggested prefix would be too long for a readable title
-              if (suggestion.length > 40) {
-                return;
-              }
-              core.setFailed(
-                `PR modifies: ${[...tags].join(', ')}\n` +
-                `Title must start with a [tag] prefix.\n` +
-                `Suggested: ${suggestion} <description>`
-              );
-            }

.github/workflows/release-nightly.yml

@@ -1,38 +0,0 @@
----
-name: Nightly Dev Release
-
-# Works out the dated dev tag and starts the release workflow with it, so that
-# the release run is named after the tag it builds. A workflow run name is
-# fixed when the run starts and cannot read a file or the current date.
-
-on:
-  schedule:
-    - cron: "0 2 * * *"
-
-permissions:
-  contents: read  # actions/checkout to read the version from esphome/const.py
-
-jobs:
-  trigger:
-    name: Start release build
-    if: github.repository == 'esphome/esphome'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read  # actions/checkout to read the version from esphome/const.py
-      actions: write  # gh workflow run starts release.yml
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Start the release workflow
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          VERSION=$(sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p" esphome/const.py)
-          if [[ -z "$VERSION" ]]; then
-            echo "::error::Could not read __version__ from esphome/const.py"
-            exit 1
-          fi
-          TAG="${VERSION}$(date --utc '+%Y%m%d')"
-          echo "Starting release build for ${TAG}"
-          gh workflow run release.yml --ref "${GITHUB_REF_NAME}" --field tag="${TAG}"

.github/workflows/release.yml

@@ -1,26 +1,15 @@
 ---
 name: Publish Release
 
-# Releases (production and beta) are named after the version they publish.
-# Dev builds are named after the dated dev tag, which is passed in by the
-# nightly workflow because a run name cannot compute it itself.
-run-name: ${{ github.event.inputs.tag || github.event.release.tag_name || format('Manual build ({0})', github.ref_name) }}
-
 on:
   workflow_dispatch:
-    inputs:
-      tag:
-        description: >-
-          Tag to build. Only supported on dev, where the nightly workflow
-          uses it. Leave empty to build the version from esphome/const.py
-          with today's date appended.
-        required: false
-        default: ""
   release:
     types: [published]
+  schedule:
+    - cron: "0 2 * * *"
 
 permissions:
-  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
+  contents: read
 
 jobs:
   init:
@@ -31,11 +20,9 @@ jobs:
       branch_build: ${{ steps.tag.outputs.branch_build }}
       deploy_env: ${{ steps.tag.outputs.deploy_env }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4.2.2
       - name: Get tag
         id: tag
-        env:
-          INPUT_TAG: ${{ github.event.inputs.tag }}
         # yamllint disable rule:line-length
         run: |
           if [[ "${{ github.event_name }}" = "release" ]]; then
@@ -47,23 +34,12 @@ jobs:
               ENVIRONMENT="production"
             fi
           else
+            TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
+            today="$(date --utc '+%Y%m%d')"
+            TAG="${TAG}${today}"
             BRANCH=${GITHUB_REF#refs/heads/}
-            # The nightly workflow passes the finished tag so that the run name
-            # matches what is built. Without it, work it out here.
-            TAG="${INPUT_TAG}"
-            if [[ -n "$TAG" && "$BRANCH" != "dev" ]]; then
-              echo "::error::The tag input is only supported on dev. A build from ${BRANCH} has to use the tag worked out here, which carries the branch name, so that it cannot publish over the dev, beta, latest or stable images."
-              exit 1
-            fi
-            if [[ -z "$TAG" ]]; then
-              TAG=$(cat esphome/const.py | sed -n -E "s/^__version__\s+=\s+\"(.+)\"$/\1/p")
-              today="$(date --utc '+%Y%m%d')"
-              TAG="${TAG}${today}"
-              if [[ "$BRANCH" != "dev" ]]; then
-                TAG="${TAG}-${BRANCH}"
-              fi
-            fi
             if [[ "$BRANCH" != "dev" ]]; then
+              TAG="${TAG}-${BRANCH}"
               BRANCH_BUILD="true"
               ENVIRONMENT=""
             else
@@ -81,12 +57,12 @@ jobs:
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
-      contents: read   # actions/checkout to build the sdist/wheel
-      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v5.6.0
         with:
           python-version: "3.x"
       - name: Build
@@ -94,7 +70,7 @@ jobs:
           pip3 install build
           python3 -m build
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@v1.12.4
         with:
           skip-existing: true
 
@@ -102,8 +78,8 @@ jobs:
     name: Build ESPHome ${{ matrix.platform.arch }}
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
+      contents: read
+      packages: write
     runs-on: ${{ matrix.platform.os }}
     needs: [init]
     strategy:
@@ -116,22 +92,22 @@ jobs:
             os: "ubuntu-24.04-arm"
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4.2.2
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v5.6.0
         with:
-          python-version: "3.12"
+          python-version: "3.11"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@v3.11.1
 
       - name: Log in to docker hub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v3.4.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -162,7 +138,7 @@ jobs:
       #     version: ${{ needs.init.outputs.tag }}
 
       - name: Upload digests
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: digests-${{ matrix.platform.arch }}
           path: /tmp/digests
@@ -176,8 +152,8 @@ jobs:
       - deploy-docker
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -192,27 +168,27 @@ jobs:
           - ghcr
           - dockerhub
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v4.2.2
 
       - name: Download digests
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        uses: actions/download-artifact@v4.3.0
         with:
           pattern: digests-*
           path: /tmp/digests
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@v3.11.1
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v3.4.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
         if: matrix.registry == 'ghcr'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -236,32 +212,48 @@ jobs:
           docker buildx imagetools create $(jq -Rcnr 'inputs | . / "," | map("-t " + .) | join(" ")' <<< "${{ steps.tags.outputs.tags}}") \
             $(printf '${{ steps.tags.outputs.image }}@sha256:%s ' *)
 
-  version-notifier:
+  deploy-ha-addon-repo:
     if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
     runs-on: ubuntu-latest
     needs:
       - init
       - deploy-manifest
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          owner: esphome
-          repositories: version-notifier
-          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
-
       - name: Trigger Workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@v7.0.1
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
+          github-token: ${{ secrets.DEPLOY_HA_ADDON_REPO_TOKEN }}
           script: |
-            await github.rest.actions.createWorkflowDispatch({
+            let description = "ESPHome";
+            if (context.eventName == "release") {
+              description = ${{ toJSON(github.event.release.body) }};
+            }
+            github.rest.actions.createWorkflowDispatch({
               owner: "esphome",
-              repo: "version-notifier",
-              workflow_id: "notify.yml",
+              repo: "home-assistant-addon",
+              workflow_id: "bump-version.yml",
+              ref: "main",
+              inputs: {
+                version: "${{ needs.init.outputs.tag }}",
+                content: description
+              }
+            })
+
+  deploy-esphome-schema:
+    if: github.repository == 'esphome/esphome' && needs.init.outputs.branch_build == 'false'
+    runs-on: ubuntu-latest
+    needs: [init]
+    environment: ${{ needs.init.outputs.deploy_env }}
+    steps:
+      - name: Trigger Workflow
+        uses: actions/github-script@v7.0.1
+        with:
+          github-token: ${{ secrets.DEPLOY_ESPHOME_SCHEMA_REPO_TOKEN }}
+          script: |
+            github.rest.actions.createWorkflowDispatch({
+              owner: "esphome",
+              repo: "esphome-schema",
+              workflow_id: "generate-schemas.yml",
               ref: "main",
               inputs: {
                 version: "${{ needs.init.outputs.tag }}",

.github/workflows/stale.yml

@@ -6,60 +6,45 @@ on:
     - cron: "30 0 * * *"
   workflow_dispatch:
 
-# The reusable workflow authenticates as the ESPHome GitHub App, so GITHUB_TOKEN
-# needs no permissions at all.
-permissions: {}
+permissions:
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: lock
 
 jobs:
   stale:
-    if: github.repository_owner == 'esphome'
-    # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
-    # GitHub App token so the labels, comments and closures come from
-    # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@4fbce13026c393d6eb6b247e394dcd9ef1af76c2  # main
-    secrets:
-      ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-    with:
-      # Live only on dev: a workflow_dispatch from any other branch is a dry run
-      dry-run: ${{ github.ref != 'refs/heads/dev' }}
-      days-before-stale: 90
-      days-before-stale-conflicting: 30
-      days-before-close: 7
-      stale-label: stale
-      exempt-label: not-stale
-      conflict-label: needs-rebase
-      ignored-users: esphbot,codecov-commenter
-      stale-pr-message: >
-        There hasn't been any activity on this pull request recently. This
-        pull request has been automatically marked as stale because of that
-        and will be closed if no further activity occurs within 7 days.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9.1.0
+        with:
+          days-before-pr-stale: 90
+          days-before-pr-close: 7
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
+          remove-stale-when-updated: true
+          stale-pr-label: "stale"
+          exempt-pr-labels: "not-stale"
+          stale-pr-message: >
+            There hasn't been any activity on this pull request recently. This
+            pull request has been automatically marked as stale because of that
+            and will be closed if no further activity occurs within 7 days.
+            Thank you for your contributions.
 
-        If you are the author of this PR, please leave a comment if you want
-        to keep it open. Also, please merge the latest dev branch into your
-        branch to ensure that it's up to date with the latest changes.
-
-        Thank you for your contribution!
-      conflict-pr-message: >
-        This pull request has merge conflicts. Please merge the latest dev
-        branch into your branch to resolve them.
-      stale-conflicting-pr-message: >
-        The merge conflicts on this pull request have not been resolved for
-        30 days, so it has been marked as stale and will be closed if they
-        are not resolved within 7 days.
-
-        Please merge the latest dev branch into your branch. Once the pull
-        request is mergeable again the stale label is removed.
-
-        Thank you for your contribution!
-      stale-issue-message: >
-        There hasn't been any activity on this issue recently. Due to the
-        high number of incoming GitHub notifications, we have to clean some
-        of the old issues, as many of them have already been resolved with
-        the latest updates.
-
-        Please make sure to update to the latest ESPHome version and
-        check if that solves the issue. Let us know if that works for you by
-        adding a comment 👍
-
-        This issue has now been marked as stale and will be closed if no
-        further activity occurs. Thank you for your contributions.
+  # Use stale to automatically close issues with a
+  # reference to the issue tracker
+  close-issues:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9.1.0
+        with:
+          days-before-pr-stale: -1
+          days-before-pr-close: -1
+          days-before-issue-stale: 1
+          days-before-issue-close: 1
+          remove-stale-when-updated: true
+          stale-issue-label: "stale"
+          exempt-issue-labels: "not-stale"
+          stale-issue-message: >
+            https://github.com/esphome/esphome/issues/430

.github/workflows/status-check-labels.yml

@@ -1,29 +0,0 @@
-name: Status check labels
-
-on:
-  pull_request:
-    types: [opened, reopened, labeled, unlabeled, synchronize]
-
-permissions:
-  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, needs-developer-docs, merge-after-release, chained-pr)
-
-jobs:
-  check:
-    name: Check blocking labels
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check for blocking labels
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const blockingLabels = ['needs-docs', 'needs-developer-docs', 'merge-after-release', 'chained-pr'];
-            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number
-            });
-            const labelNames = labels.map(l => l.name);
-            const found = blockingLabels.filter(bl => labelNames.includes(bl));
-            if (found.length > 0) {
-              core.setFailed(`Pull request cannot be merged, it has blocking label(s): ${found.join(', ')}`);
-            }

.github/workflows/sync-dependency-versions.yml

@@ -1,96 +0,0 @@
-# Keeps pre-commit hook revs in sync with the requirements files.
-#
-# Dependabot only bumps the pins in requirements*.txt. Some of those tools
-# are pinned again as hook revs in .pre-commit-config.yaml. This workflow
-# runs script/sync_dependency_versions.py against the pull request branch
-# and pushes a commit with the revs updated.
-
-name: Sync dependency versions
-
-on:
-  # pull_request_target rather than pull_request so the App secret is
-  # available on Dependabot pull requests (pull_request runs opened by
-  # Dependabot only see Dependabot secrets). The job below only touches
-  # branches in this repository and only ever executes the script from the
-  # base branch checkout, so fork code never runs with the token.
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-    branches:
-      - dev
-    paths:
-      - requirements_dev.txt
-      - requirements_test.txt
-      - .pre-commit-config.yaml
-      - script/sync_dependency_versions.py
-
-# The push to the pull request branch uses the App token minted below, so
-# the workflow's GITHUB_TOKEN does not need any scopes.
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  sync:
-    name: Sync pinned versions
-    runs-on: ubuntu-latest
-    # Same-repository branches only: a push to a fork is not possible with
-    # this token, and it keeps untrusted heads out of a privileged job.
-    if: >-
-      github.repository == 'esphome/esphome'
-      && github.event.pull_request.head.repo.full_name == github.repository
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # A push made with the workflow's own GITHUB_TOKEN would not start
-          # CI on the new commit; a push with the App token does.
-          permission-contents: write  # git push of the sync commit to the pull request branch
-
-      - name: Check out base branch
-        # Provides the script that runs below. Deliberately the base branch
-        # so the pull request cannot change what executes here.
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.base.sha }}
-          persist-credentials: false
-
-      - name: Check out pull request branch
-        # No allow-unsafe-pr-checkout here on purpose: checkout v7 only
-        # refuses heads that live in a different repository, and the job
-        # condition above already limits runs to same-repository branches.
-        # Leaving it off keeps that refusal as a backstop for fork heads.
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          path: pull-request
-          token: ${{ steps.generate-token.outputs.token }}
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.12"
-
-      - name: Install yamlrocks
-        # The script edits YAML through yamlrocks. Take the pin from the
-        # base branch requirements so this workflow has no copy of its own.
-        run: pip install "$(grep -E '^yamlrocks==' requirements_test.txt | cut -d'#' -f1)"
-
-      - name: Sync pinned versions
-        run: python script/sync_dependency_versions.py --root pull-request
-
-      - name: Push changes
-        working-directory: pull-request
-        run: |
-          if git diff --quiet; then
-            echo "All pinned versions already match the requirements files."
-            exit 0
-          fi
-          git config user.name "esphome[bot]"
-          git config user.email "115708604+esphome[bot]@users.noreply.github.com"
-          git commit -am "Sync pinned tool versions with requirements files"
-          git push

.github/workflows/sync-device-classes.yml

@@ -6,100 +6,43 @@ on:
   schedule:
     - cron: "45 6 * * *"
 
-# Repo writes (branch push, PR open) happen via the App token minted below,
-# so the workflow's GITHUB_TOKEN does not need any write scopes.
-permissions:
-  contents: read  # actions/checkout for this repo and home-assistant/core
-
 jobs:
   sync:
     name: Sync Device Classes
     runs-on: ubuntu-latest
     if: github.repository == 'esphome/esphome'
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
-          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
-          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
-
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4.2.2
 
       - name: Checkout Home Assistant
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v4.2.2
         with:
           repository: home-assistant/core
           path: lib/home-assistant
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@v5.6.0
         with:
-          python-version: "3.14"
-
-      - name: Set up uv
-        # An order of magnitude faster than pip on cold boots, with its
-        # own wheel cache. ``--system`` (below) installs into the
-        # setup-python interpreter so subsequent ``prek`` /
-        # ``script/run-in-env.py`` steps find the deps without a
-        # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
-        with:
-          enable-cache: true
-          # Pin uv version so the action does not have to fetch the
-          # manifest from raw.githubusercontent.com on every cache
-          # miss; that fetch flakes on Windows runners.
-          version: "0.11.15"
+          python-version: 3.13
 
       - name: Install Home Assistant
         run: |
-          uv pip install --system -e lib/home-assistant
-          uv pip install --system -r requirements.txt -r requirements_test.txt
+          python -m pip install --upgrade pip
+          pip install -e lib/home-assistant
 
       - name: Sync
         run: |
           python ./script/sync-device_class.py
 
-      - name: Apply prek auto-fixes
-        # First pass: let formatters (ruff, end-of-file-fixer, etc.) modify
-        # files. prek exits non-zero whenever a hook touches anything,
-        # which would otherwise abort the workflow before the auto-fixes
-        # can flow into the sync PR.
-        #
-        # PREK_SKIP:
-        #   - no-commit-to-branch is a local guard against committing on
-        #     dev/release/beta; CI runs on dev by definition, and
-        #     peter-evans/create-pull-request creates the branch itself.
-        #   - pylint surfaces import-error / relative-beyond-top-level
-        #     noise here because this workflow installs only a subset of
-        #     the runtime deps (HA + requirements*.txt); main CI already
-        #     gates pylint on real PRs.
-        env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files || true
-
-      - name: Verify prek clean
-        # Second pass: re-run all hooks against the now-fixed tree.
-        # Auto-fixers exit 0 (nothing to change); any remaining failure
-        # from a check-only hook (flake8 / yamllint / ci-custom) is a
-        # real issue and fails the workflow loudly. Same PREK_SKIP list as
-        # above for the same reasons.
-        env:
-          PREK_SKIP: pylint,no-commit-to-branch
-        run: python script/run-in-env.py prek run --all-files
-
       - name: Commit changes
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@v7.0.8
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
-          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
+          committer: esphomebot <esphome@openhomefoundation.org>
+          author: esphomebot <esphome@openhomefoundation.org>
           branch: sync/device-classes
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"
           body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}

.github/workflows/sync-integration-durations.yml

@@ -1,98 +0,0 @@
----
-name: Refresh integration test durations
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "45 5 * * 1"
-
-# Repo writes (branch push, PR open) happen via the App token minted below,
-# so the workflow's GITHUB_TOKEN does not need any write scopes.
-permissions:
-  contents: read
-  actions: read  # gh api / gh run download for the CI junit artifacts
-
-jobs:
-  sync:
-    name: Refresh integration test durations
-    runs-on: ubuntu-latest
-    if: github.repository == 'esphome/esphome'
-    steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          permission-contents: write       # push the sync branch
-          permission-pull-requests: write  # open or refresh the sync PR
-
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.13"
-
-      - name: Refresh from the newest usable dev run
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          # Only full matrix dev runs upload junit-integration-* artifacts
-          # (see the integration-tests job); the merge script re-checks
-          # coverage regardless.
-          # Newest-first candidates via their bucket-0 artifact. Fork PRs run
-          # their own ci.yml, so name and branch are spoofable; require
-          # same-repo. Assignment failures trip set -e and fail loudly.
-          candidates=$(
-            gh api "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=junit-integration-0&per_page=100" \
-              --jq '.artifacts[] | select(.expired | not) | .workflow_run
-                    | select(.head_branch == "dev" and .head_repository_id != null
-                             and .head_repository_id == .repository_id)
-                    | .id'
-          )
-          # Green runs first, then the rest newest first; a run missing a
-          # bucket fails the coverage check and the next one is tried
-          green=""
-          rest=""
-          for id in ${candidates}; do
-            conclusion=$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${id}" --jq '.conclusion // ""')
-            if [ "${conclusion}" = "success" ]; then
-              green="${green} ${id}"
-            elif [ -n "${conclusion}" ]; then
-              rest="${rest} ${id}"
-            fi
-          done
-          # helpers.py imports colorama; the script needs nothing else
-          pip install colorama
-          for id in ${green} ${rest}; do
-            rm -rf /tmp/junit
-            if ! gh run download "${id}" --repo "${GITHUB_REPOSITORY}" -p "junit-integration-*" -D /tmp/junit; then
-              echo "::warning::Could not download artifacts for run ${id}; trying the next"
-              continue
-            fi
-            status=0
-            python script/update_integration_test_durations.py /tmp/junit || status=$?
-            if [ "${status}" -eq 0 ]; then
-              echo "Refreshed from run ${id}"
-              exit 0
-            fi
-            # Only EXIT_LOW_COVERAGE (3) from the script advances to the next run
-            [ "${status}" -eq 3 ] || exit 1
-            echo "::warning::Run ${id} covers too few test files; trying the next"
-          done
-          echo "::error::No dev CI run with usable junit artifacts in range; the feed is starved"
-          exit 1
-
-      - name: Commit changes
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          commit-message: "[ci] Refresh integration test durations"
-          committer: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          author: esphome[bot] <115708604+esphome[bot]@users.noreply.github.com>
-          branch: sync/integration-durations
-          delete-branch: true
-          title: "[ci] Refresh integration test durations"
-          body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ steps.generate-token.outputs.token }}

.gitignore

@@ -91,10 +91,6 @@ venv-*/
 # mypy
 .mypy_cache/
 
-# nix
-/default.nix
-/shell.nix
-
 .pioenvs
 .piolibdeps
 .pio
@@ -133,24 +129,18 @@ CTestTestfile.cmake
 .gcc-flags.json
 
 config/
-# Test fixture config/ directories are tracked (the rule above is the dashboard dir)
-!tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
-# Output kept by failing tests for inspection; uploaded by CI
-test_artifacts/
 /.temp-clang-tidy.cpp
 /.temp/
 .pio/
 
 sdkconfig.*
 !sdkconfig.defaults
-!sdkconfig.defaults.*
 
 .tests/
 
 /components
 /managed_components
-/dependencies.lock
 
 api-docs/

.pre-commit-config.yaml

@@ -1,16 +1,17 @@
 ---
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
+
 ci:
   autoupdate_commit_msg: 'pre-commit: autoupdate'
   autoupdate_schedule: off  # Disabled until ruff versions are synced between deps and pre-commit
   # Skip hooks that have issues in pre-commit CI environment
-  skip: [pylint]
+  skip: [pylint, clang-tidy-hash]
 
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.17.0
+    rev: v0.12.5
     hooks:
       # Run the linter.
       - id: ruff
@@ -18,7 +19,7 @@ repos:
       # Run the formatter.
       - id: ruff-format
   - repo: https://github.com/PyCQA/flake8
-    rev: 7.4.1
+    rev: 7.3.0
     hooks:
       - id: flake8
         additional_dependencies:
@@ -36,12 +37,12 @@ repos:
       - id: end-of-file-fixer
       - id: trailing-whitespace
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.22.0
+    rev: v3.20.0
     hooks:
       - id: pyupgrade
-        args: [--py312-plus]
+        args: [--py311-plus]
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.38.0
+    rev: v1.37.1
     hooks:
       - id: yamllint
         exclude: ^(\.clang-format|\.clang-tidy)$
@@ -54,11 +55,13 @@ repos:
     hooks:
       - id: pylint
         name: pylint
-        entry: python script/run-in-env.py pylint
+        entry: python3 script/run-in-env.py pylint
         language: system
         types: [python]
-        files: ^esphome/.+\.py$
-      - id: ci-custom
-        name: ci-custom
-        entry: python script/run-in-env.py script/ci-custom.py
-        language: system
+      - id: clang-tidy-hash
+        name: Update clang-tidy hash
+        entry: python script/clang_tidy_hash.py --update-if-changed
+        language: python
+        files: ^(\.clang-tidy|platformio\.ini|requirements_dev\.txt)$
+        pass_filenames: false
+        additional_dependencies: []

CLAUDE.md

@@ -1 +1 @@
-AGENTS.md
+.ai/instructions.md

CODEOWNERS

@@ -19,15 +19,15 @@ esphome/components/ac_dimmer/* @glmnet
 esphome/components/adc/* @esphome/core
 esphome/components/adc128s102/* @DeerMaximum
 esphome/components/addressable_light/* @justfalter
+esphome/components/ade7880/* @kpfleming
 esphome/components/ade7953/* @angelnu
-esphome/components/ade7953_base/* @angelnu
 esphome/components/ade7953_i2c/* @angelnu
 esphome/components/ade7953_spi/* @angelnu
 esphome/components/ads1118/* @solomondg1
 esphome/components/ags10/* @mak-42
 esphome/components/aic3204/* @kbx81
 esphome/components/airthings_ble/* @jeromelaban
-esphome/components/airthings_wave_base/* @jeromelaban @ncareau
+esphome/components/airthings_wave_base/* @jeromelaban @kpfleming @ncareau
 esphome/components/airthings_wave_mini/* @ncareau
 esphome/components/airthings_wave_plus/* @jeromelaban @precurse
 esphome/components/alarm_control_panel/* @grahambrown11 @hwstar
@@ -39,16 +39,12 @@ esphome/components/am43/sensor/* @buxtronix
 esphome/components/analog_threshold/* @ianchi
 esphome/components/animation/* @syndlex
 esphome/components/anova/* @buxtronix
-esphome/components/apc1/* @ademuri
 esphome/components/apds9306/* @aodrenah
-esphome/components/apds9930/* @iyesin
-esphome/components/api/* @esphome/core
-esphome/components/aqi/* @freekode @jasstrong @ximex
-esphome/components/aranet/* @patrickod
+esphome/components/api/* @OttoWinter
 esphome/components/as5600/* @ammmze
 esphome/components/as5600/sensor/* @ammmze
 esphome/components/as7341/* @mrgnr
-esphome/components/async_tcp/* @esphome/core
+esphome/components/async_tcp/* @OttoWinter
 esphome/components/at581x/* @X-Ryl669
 esphome/components/atc_mithermometer/* @ahpohl
 esphome/components/atm90e26/* @danieltwagner
@@ -56,9 +52,6 @@ esphome/components/atm90e32/* @circuitsetup @descipher
 esphome/components/audio/* @kahrendt
 esphome/components/audio_adc/* @kbx81
 esphome/components/audio_dac/* @kbx81
-esphome/components/audio_file/* @kahrendt
-esphome/components/audio_file/media_source/* @kahrendt
-esphome/components/audio_http/* @kahrendt
 esphome/components/axs15231/* @clydebarrow
 esphome/components/b_parasite/* @rbaron
 esphome/components/ballu/* @bazuchan
@@ -68,30 +61,21 @@ esphome/components/bedjet/climate/* @jhansche
 esphome/components/bedjet/fan/* @jhansche
 esphome/components/bedjet/sensor/* @javawizard @jhansche
 esphome/components/beken_spi_led_strip/* @Mat931
-esphome/components/bh1745/* @latonita
 esphome/components/bh1750/* @OttoWinter
-esphome/components/bh1900nux/* @B48D81EFCC
 esphome/components/binary_sensor/* @esphome/core
 esphome/components/bk72xx/* @kuba2k2
-esphome/components/bk72xx_ble/* @Bl00d-B0b
-esphome/components/bk72xx_ble_tracker/* @Bl00d-B0b
 esphome/components/bl0906/* @athom-tech @jesserockz @tarontop
 esphome/components/bl0939/* @ziceva
-esphome/components/bl0940/* @dan-s-github @tobias-
+esphome/components/bl0940/* @tobias-
 esphome/components/bl0942/* @dbuezas @dwmw2
 esphome/components/ble_client/* @buxtronix @clydebarrow
-esphome/components/ble_device_base/* @Bl00d-B0b
-esphome/components/ble_nus/* @tomaszduda23
-esphome/components/bluetooth_connection/* @bdraco @jesserockz
-esphome/components/bluetooth_proxy/* @bdraco @jesserockz
-esphome/components/bm8563/* @abmantis
+esphome/components/bluetooth_proxy/* @jesserockz
 esphome/components/bme280_base/* @esphome/core
 esphome/components/bme280_spi/* @apbodrov
 esphome/components/bme680_bsec/* @trvrnrth
 esphome/components/bme68x_bsec2/* @kbx81 @neffs
 esphome/components/bme68x_bsec2_i2c/* @kbx81 @neffs
 esphome/components/bmi160/* @flaviut
-esphome/components/bmi270/* @clydebarrow
 esphome/components/bmp280_base/* @ademuri
 esphome/components/bmp280_i2c/* @ademuri
 esphome/components/bmp280_spi/* @ademuri
@@ -99,30 +83,18 @@ esphome/components/bmp3xx/* @latonita
 esphome/components/bmp3xx_base/* @latonita @martgras
 esphome/components/bmp3xx_i2c/* @latonita
 esphome/components/bmp3xx_spi/* @latonita
-esphome/components/bmp581_base/* @danielkent-net @kahrendt
-esphome/components/bmp581_i2c/* @danielkent-net @kahrendt
-esphome/components/bmp581_spi/* @danielkent-net @kahrendt
+esphome/components/bmp581/* @kahrendt
 esphome/components/bp1658cj/* @Cossid
 esphome/components/bp5758d/* @Cossid
-esphome/components/bq25186/* @Rapsssito
-esphome/components/bq27220/* @rggammon
-esphome/components/bq76972/* @limpkin
-esphome/components/bridge/* @kbx81
-esphome/components/bthome_mithermometer/* @nagyrobi
 esphome/components/button/* @esphome/core
 esphome/components/bytebuffer/* @clydebarrow
-esphome/components/camera/* @bdraco @DT-art1
-esphome/components/camera_encoder/* @DT-art1
+esphome/components/camera/* @DT-art1 @bdraco
 esphome/components/canbus/* @danielschramm @mvturnho
 esphome/components/cap1188/* @mreditor97
-esphome/components/captive_portal/* @esphome/core
-esphome/components/cc1101/* @gabest11 @lygris
+esphome/components/captive_portal/* @OttoWinter
 esphome/components/ccs811/* @habbie
 esphome/components/cd74hc4067/* @asoehlke
-esphome/components/cdc_acm_uart/* @kbx81
-esphome/components/cdc_acm_uart/bridge/* @kbx81
 esphome/components/ch422g/* @clydebarrow @jesterret
-esphome/components/ch423/* @dwmw2
 esphome/components/chsc6x/* @kkosik20
 esphome/components/climate/* @esphome/core
 esphome/components/climate_ir/* @glmnet
@@ -132,17 +104,13 @@ esphome/components/combination/* @Cat-Ion @kahrendt
 esphome/components/const/* @esphome/core
 esphome/components/coolix/* @glmnet
 esphome/components/copy/* @OttoWinter
-esphome/components/counter/* @clydebarrow
 esphome/components/cover/* @esphome/core
 esphome/components/cs5460a/* @balrog-kun
 esphome/components/cse7761/* @berfenger
 esphome/components/cst226/* @clydebarrow
-esphome/components/cst328/* @latonita
 esphome/components/cst816/* @clydebarrow
-esphome/components/cst9220/* @clydebarrow
 esphome/components/ct_clamp/* @jesserockz
 esphome/components/current_based/* @djwmarcx
-esphome/components/d01/* @ch604
 esphome/components/dac7678/* @NickB1
 esphome/components/daikin_arc/* @MagicBear
 esphome/components/daikin_brc/* @hagak
@@ -150,72 +118,54 @@ esphome/components/dallas_temp/* @ssieb
 esphome/components/daly_bms/* @s1lvi0
 esphome/components/dashboard_import/* @esphome/core
 esphome/components/datetime/* @jesserockz @rfdarter
-esphome/components/debug/* @esphome/core
+esphome/components/debug/* @OttoWinter
 esphome/components/delonghi/* @grob6000
-esphome/components/dew_point/* @CFlix
 esphome/components/dfplayer/* @glmnet
 esphome/components/dfrobot_sen0395/* @niklasweber
 esphome/components/dht/* @OttoWinter
 esphome/components/display_menu_base/* @numo68
-esphome/components/dlms_meter/* @latonita @PolarGoose @SimonFischer04 @Tomer27cz
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
-esphome/components/ds1603l/* @JakeLC15
 esphome/components/ds2484/* @mrk-its
-esphome/components/ds248x/* @tomwellnitz
-esphome/components/ds3231/* @linkedupbits
-esphome/components/dsmr/* @glmnet @PolarGoose
+esphome/components/dsmr/* @glmnet @zuidwijk
 esphome/components/duty_time/* @dudanov
-esphome/components/ecocomfort2/* @gledian
 esphome/components/ee895/* @Stock-M
 esphome/components/ektf2232/touchscreen/* @jesserockz
 esphome/components/emc2101/* @ellull
 esphome/components/emmeti/* @E440QF
-esphome/components/emontx/* @FredM67 @glynhudson @TrystanLea
 esphome/components/ens160/* @latonita
 esphome/components/ens160_base/* @latonita @vincentscode
 esphome/components/ens160_i2c/* @latonita
 esphome/components/ens160_spi/* @latonita
 esphome/components/ens210/* @itn3rd77
-esphome/components/epaper_spi/* @esphome/core
 esphome/components/es7210/* @kahrendt
 esphome/components/es7243e/* @kbx81
 esphome/components/es8156/* @kbx81
 esphome/components/es8311/* @kahrendt @kroimon
 esphome/components/es8388/* @P4uLT
 esphome/components/esp32/* @esphome/core
-esphome/components/esp32_ble/* @bdraco @jesserockz @Rapsssito
-esphome/components/esp32_ble_client/* @bdraco @jesserockz
-esphome/components/esp32_ble_server/* @clydebarrow @jesserockz @Rapsssito
-esphome/components/esp32_ble_tracker/* @bdraco
+esphome/components/esp32_ble/* @Rapsssito @jesserockz
+esphome/components/esp32_ble_client/* @jesserockz
+esphome/components/esp32_ble_server/* @Rapsssito @clydebarrow @jesserockz
 esphome/components/esp32_camera_web_server/* @ayufan
 esphome/components/esp32_can/* @Sympatron
 esphome/components/esp32_hosted/* @swoboda1337
-esphome/components/esp32_hosted/update/* @swoboda1337
-esphome/components/esp32_power_management/* @rwrozelle
+esphome/components/esp32_improv/* @jesserockz
 esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
 esphome/components/esp_ldo/* @clydebarrow
-esphome/components/espectre/* @francescopace
-esphome/components/esphome/ota/* @esphome/core
-esphome/components/espnow/* @jesserockz
-esphome/components/espnow/packet_transport/* @EasilyBoredEngineer
 esphome/components/ethernet_info/* @gtjadsonsantos
 esphome/components/event/* @nohat
-esphome/components/exponential_moving_average/* @clydebarrow
+esphome/components/event_emitter/* @Rapsssito
 esphome/components/exposure_notifications/* @OttoWinter
 esphome/components/ezo/* @ssieb
 esphome/components/ezo_pmp/* @carlos-sarmiento
-esphome/components/ezsp_proxy_tap/* @kbx81 @puddly
 esphome/components/factory_reset/* @anatoly-savchenkov
 esphome/components/fastled_base/* @OttoWinter
 esphome/components/feedback/* @ianchi
-esphome/components/file/* @esphome/core
-esphome/components/filter_lifetime/* @tuct
-esphome/components/fingerprint_grow/* @alexborro @loongyh @OnFreund
+esphome/components/fingerprint_grow/* @OnFreund @alexborro @loongyh
 esphome/components/font/* @clydebarrow @esphome/core
-esphome/components/friedrich/* @rwrozelle
 esphome/components/fs3000/* @kahrendt
 esphome/components/ft5x06/* @clydebarrow
 esphome/components/ft63x6/* @gpambrozio
@@ -224,18 +174,16 @@ esphome/components/gdk101/* @Szewcson
 esphome/components/gl_r01_i2c/* @pkejval
 esphome/components/globals/* @esphome/core
 esphome/components/gp2y1010au0f/* @zry98
-esphome/components/gp8403/* @jesserockz @sebydocky
+esphome/components/gp8403/* @jesserockz
 esphome/components/gpio/* @esphome/core
 esphome/components/gpio/one_wire/* @ssieb
 esphome/components/gps/* @coogle @ximex
 esphome/components/graph/* @synco
 esphome/components/graphical_display_menu/* @MrMDavidson
 esphome/components/gree/* @orestismers
-esphome/components/gree/switch/* @nagyrobi
 esphome/components/grove_gas_mc_v2/* @YorkshireIoT
 esphome/components/grove_tb6612fng/* @max246
 esphome/components/growatt_solar/* @leeuwte
-esphome/components/gsl3670/* @clydebarrow
 esphome/components/gt911/* @clydebarrow @jesserockz
 esphome/components/haier/* @paveldn
 esphome/components/haier/binary_sensor/* @paveldn
@@ -243,32 +191,18 @@ esphome/components/haier/button/* @paveldn
 esphome/components/haier/sensor/* @paveldn
 esphome/components/haier/switch/* @paveldn
 esphome/components/haier/text_sensor/* @paveldn
-esphome/components/haier_tundra/* @fauxpark
-esphome/components/haier_tundra/button/* @fauxpark
-esphome/components/haier_tundra/switch/* @fauxpark
 esphome/components/havells_solar/* @sourabhjaiswal
 esphome/components/hbridge/fan/* @WeekendWarrior
 esphome/components/hbridge/light/* @DotNetDann
 esphome/components/hbridge/switch/* @dwmw2
-esphome/components/hc8/* @omartijn
-esphome/components/hdc2010/* @optimusprimespace @ssieb
-esphome/components/hdc2080/* @G-Pereira @jesserockz
-esphome/components/hdc302x/* @joshuasing
 esphome/components/he60r/* @clydebarrow
 esphome/components/heatpumpir/* @rob-deutsch
 esphome/components/hitachi_ac424/* @sourabhjaiswal
-esphome/components/hlk_fm22x/* @OnFreund
-esphome/components/hlw8032/* @rici4kubicek
 esphome/components/hm3301/* @freekode
 esphome/components/hmac_md5/* @dwmw2
-esphome/components/hmac_sha256/* @dwmw2
-esphome/components/hoermann_hcp/* @zweckj
-esphome/components/homeassistant/* @esphome/core @OttoWinter
-esphome/components/homeassistant/button/* @jesserockz
+esphome/components/homeassistant/* @OttoWinter @esphome/core
 esphome/components/homeassistant/number/* @landonr
-esphome/components/homeassistant/select/* @jesserockz
 esphome/components/homeassistant/switch/* @Links2004
-esphome/components/homeassistant/text/* @jesserockz
 esphome/components/honeywell_hih_i2c/* @Benichou34
 esphome/components/honeywellabp/* @RubyBailey
 esphome/components/honeywellabp2_i2c/* @jpfaff
@@ -279,39 +213,30 @@ esphome/components/hte501/* @Stock-M
 esphome/components/http_request/ota/* @oarcher
 esphome/components/http_request/update/* @jesserockz
 esphome/components/htu31d/* @betterengineering
-esphome/components/hub75/* @stuartparmenter
-esphome/components/husb238/* @latonita
 esphome/components/hydreon_rgxx/* @functionpointer
 esphome/components/hyt271/* @Philippe12
 esphome/components/i2c/* @esphome/core
 esphome/components/i2c_device/* @gabest11
 esphome/components/i2s_audio/* @jesserockz
+esphome/components/i2s_audio/media_player/* @jesserockz
 esphome/components/i2s_audio/microphone/* @jesserockz
 esphome/components/i2s_audio/speaker/* @jesserockz @kahrendt
-esphome/components/i2s_clockless_led_strip/* @j9brown
 esphome/components/iaqcore/* @yozik04
-esphome/components/icm20689/* @lboue
-esphome/components/icnt86/* @danepowell
 esphome/components/ili9xxx/* @clydebarrow @nielsnl68
 esphome/components/improv_base/* @esphome/core
-esphome/components/improv_ble/* @jesserockz
 esphome/components/improv_serial/* @esphome/core
-esphome/components/ina226/* @latonita @Sergio303
+esphome/components/ina226/* @Sergio303 @latonita
 esphome/components/ina260/* @mreditor97
 esphome/components/ina2xx_base/* @latonita
 esphome/components/ina2xx_i2c/* @latonita
 esphome/components/ina2xx_spi/* @latonita
-esphome/components/infrared/* @kbx81
 esphome/components/inkbird_ibsth1_mini/* @fkirill
-esphome/components/inkplate/* @jesserockz @JosipKuci
+esphome/components/inkplate6/* @jesserockz
 esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
-esphome/components/ir_rf_base/* @bdraco @kbx81
-esphome/components/ir_rf_proxy/* @kbx81
-esphome/components/it8951/* @koosoli @limengdu @Passific
 esphome/components/jsn_sr04t/* @Mafus1
-esphome/components/json/* @esphome/core
+esphome/components/json/* @OttoWinter
 esphome/components/kamstrup_kmp/* @cfeenstra1024
 esphome/components/key_collector/* @ssieb
 esphome/components/key_provider/* @ssieb
@@ -319,33 +244,20 @@ esphome/components/kuntze/* @ssieb
 esphome/components/lc709203f/* @ilikecake
 esphome/components/lcd_menu/* @numo68
 esphome/components/ld2410/* @regevbr @sebcaps
-esphome/components/ld2410s/* @NovakIrs
-esphome/components/ld2412/* @Rihan9
 esphome/components/ld2420/* @descipher
 esphome/components/ld2450/* @hareeshmu
-esphome/components/ld2460/* @jesusvallejo
 esphome/components/ld24xx/* @kbx81
-esphome/components/ld6002b/* @hepter
 esphome/components/ledc/* @OttoWinter
 esphome/components/libretiny/* @kuba2k2
 esphome/components/libretiny_pwm/* @kuba2k2
 esphome/components/light/* @esphome/core
 esphome/components/lightwaverf/* @max246
 esphome/components/lilygo_t5_47/touchscreen/* @jesserockz
-esphome/components/lis2dw12/* @latonita
-esphome/components/lis2dw12_i2c/* @latonita
-esphome/components/lis2dw12_spi/* @latonita
-esphome/components/lis3dh/* @zebble
-esphome/components/lm75b/* @beormund
-esphome/components/ln882h_ble/* @Bl00d-B0b
-esphome/components/ln882h_ble_tracker/* @Bl00d-B0b
 esphome/components/ln882x/* @lamauny
 esphome/components/lock/* @esphome/core
 esphome/components/logger/* @esphome/core
 esphome/components/logger/select/* @clydebarrow
-esphome/components/lp5562/* @DennisGaida
 esphome/components/lps22/* @nagisa
-esphome/components/lsm6ds/* @clydebarrow
 esphome/components/ltr390/* @latonita @sjtrny
 esphome/components/ltr501/* @latonita
 esphome/components/ltr_als_ps/* @latonita
@@ -354,50 +266,42 @@ esphome/components/m5stack_8angle/* @rnauber
 esphome/components/mapping/* @clydebarrow
 esphome/components/matrix_keypad/* @ssieb
 esphome/components/max17043/* @blacknell
-esphome/components/max17048/* @B48D81EFCC
 esphome/components/max31865/* @DAVe3283
-esphome/components/max31888/* @JiriPrchal
 esphome/components/max44009/* @berfenger
 esphome/components/max6956/* @looping40
 esphome/components/max7219digit/* @rspaargaren
 esphome/components/max9611/* @mckaymatthew
 esphome/components/mcp23008/* @jesserockz
 esphome/components/mcp23017/* @jesserockz
-esphome/components/mcp23s08/* @jesserockz @SenexCrenshaw
-esphome/components/mcp23s17/* @jesserockz @SenexCrenshaw
+esphome/components/mcp23s08/* @SenexCrenshaw @jesserockz
+esphome/components/mcp23s17/* @SenexCrenshaw @jesserockz
 esphome/components/mcp23x08_base/* @jesserockz
 esphome/components/mcp23x17_base/* @jesserockz
 esphome/components/mcp23xxx_base/* @jesserockz
 esphome/components/mcp2515/* @danielschramm @mvturnho
 esphome/components/mcp3204/* @rsumner
-esphome/components/mcp3221/* @philippderdiedas
 esphome/components/mcp4461/* @p1ngb4ck
 esphome/components/mcp4728/* @berfenger
 esphome/components/mcp47a1/* @jesserockz
 esphome/components/mcp9600/* @mreditor97
+esphome/components/mcp9808/* @k7hpn
 esphome/components/md5/* @esphome/core
 esphome/components/mdns/* @esphome/core
 esphome/components/media_player/* @jesserockz
-esphome/components/media_source/* @kahrendt
 esphome/components/micro_wake_word/* @jesserockz @kahrendt
-esphome/components/micronova/* @edenhaus @jorre05
+esphome/components/micronova/* @jorre05
 esphome/components/microphone/* @jesserockz @kahrendt
 esphome/components/mics_4514/* @jesserockz
 esphome/components/midea/* @dudanov
 esphome/components/midea_ir/* @dudanov
 esphome/components/mipi_dsi/* @clydebarrow
-esphome/components/mipi_rgb/* @clydebarrow
 esphome/components/mipi_spi/* @clydebarrow
-esphome/components/mistral_ir/* @lerhum
 esphome/components/mitsubishi/* @RubyBailey
-esphome/components/mitsubishi_cn105/* @crnjan
 esphome/components/mixer/speaker/* @kahrendt
-esphome/components/mk2pvrouter/* @FredM67
 esphome/components/mlx90393/* @functionpointer
 esphome/components/mlx90614/* @jesserockz
 esphome/components/mmc5603/* @benhoff
 esphome/components/mmc5983/* @agoode
-esphome/components/modbus_client/* @exciton
 esphome/components/modbus_controller/* @martgras
 esphome/components/modbus_controller/binary_sensor/* @martgras
 esphome/components/modbus_controller/number/* @martgras
@@ -406,11 +310,9 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
-esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
-esphome/components/motion/* @esphome/core
 esphome/components/mpl3115a2/* @kbickar
 esphome/components/mpu6886/* @fabaff
 esphome/components/ms8607/* @e28eta
@@ -424,11 +326,8 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
-esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
-esphome/components/ns2009/* @tchilov
-esphome/components/ns2009/touchscreen/* @tchilov
 esphome/components/number/* @esphome/core
 esphome/components/one_wire/* @ssieb
 esphome/components/online_image/* @clydebarrow @guillempages
@@ -439,73 +338,52 @@ esphome/components/ota/* @esphome/core
 esphome/components/output/* @esphome/core
 esphome/components/packet_transport/* @clydebarrow
 esphome/components/pca6416a/* @Mat931
-esphome/components/pca9505/* @ajfriesen @ssieb
-esphome/components/pca9554/* @bdraco @clydebarrow @hwstar
+esphome/components/pca9554/* @clydebarrow @hwstar
 esphome/components/pcf85063/* @brogon
 esphome/components/pcf8563/* @KoenBreeman
-esphome/components/pcm5122/* @remcom
-esphome/components/pd_pioneer_ir/* @martinsah
 esphome/components/pi4ioe5v6408/* @jesserockz
 esphome/components/pid/* @OttoWinter
 esphome/components/pipsolar/* @andreashergert1984
-esphome/components/pixoo/* @jesserockz
 esphome/components/pm1006/* @habbie
 esphome/components/pm2005/* @andrewjswan
 esphome/components/pmsa003i/* @sjtrny
 esphome/components/pmsx003/* @ximex
 esphome/components/pmwcs3/* @SeByDocKy
-esphome/components/pn532/* @jesserockz @OttoWinter
-esphome/components/pn532_i2c/* @jesserockz @OttoWinter
-esphome/components/pn532_spi/* @jesserockz @OttoWinter
+esphome/components/pn532/* @OttoWinter @jesserockz
+esphome/components/pn532_i2c/* @OttoWinter @jesserockz
+esphome/components/pn532_spi/* @OttoWinter @jesserockz
 esphome/components/pn7150/* @jesserockz @kbx81
 esphome/components/pn7150_i2c/* @jesserockz @kbx81
 esphome/components/pn7160/* @jesserockz @kbx81
 esphome/components/pn7160_i2c/* @jesserockz @kbx81
 esphome/components/pn7160_spi/* @jesserockz @kbx81
-esphome/components/pn71xx/* @jesserockz @kbx81
-esphome/components/power_management/* @rwrozelle
 esphome/components/power_supply/* @esphome/core
 esphome/components/preferences/* @esphome/core
-esphome/components/provisioning/* @esphome/core
 esphome/components/psram/* @esphome/core
-esphome/components/pulse_meter/* @cstaahl @stevebaxter @TrentHouliston
+esphome/components/pulse_meter/* @TrentHouliston @cstaahl @stevebaxter
 esphome/components/pvvx_mithermometer/* @pasiz
 esphome/components/pylontech/* @functionpointer
-esphome/components/pzem6l24/* @nuttytree
-esphome/components/qmi8658/* @clydebarrow
 esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
 esphome/components/qspi_dbi/* @clydebarrow
 esphome/components/qwiic_pir/* @kahrendt
-esphome/components/radio_frequency/* @kbx81
 esphome/components/radon_eye_ble/* @jeffeb3
 esphome/components/radon_eye_rd200/* @jeffeb3
 esphome/components/rc522/* @glmnet
 esphome/components/rc522_i2c/* @glmnet
 esphome/components/rc522_spi/* @glmnet
-esphome/components/rd03d/* @jasstrong
-esphome/components/remko_ar715/* @naKruul
-esphome/components/renogy_inverter_ble/* @emilioaray-dev
 esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
-esphome/components/ring_buffer/* @kahrendt
-esphome/components/router/speaker/* @kahrendt
-esphome/components/rp2/* @jesserockz
-esphome/components/rp2040_ble/* @bdraco
+esphome/components/rp2040/* @jesserockz
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
 esphome/components/rp2040_pwm/* @jesserockz
-esphome/components/rp2_ble_tracker/* @bdraco
 esphome/components/rpi_dpi_rgb/* @clydebarrow
 esphome/components/rtl87xx/* @kuba2k2
-esphome/components/rtttl/* @glmnet @ximex
-esphome/components/runtime_image/* @clydebarrow @guillempages @kahrendt
+esphome/components/rtttl/* @glmnet
 esphome/components/runtime_stats/* @bdraco
-esphome/components/rx8025t/* @remcom
-esphome/components/rx8130/* @beormund
 esphome/components/safe_mode/* @jsuanet @kbx81 @paulmonigatti
-esphome/components/samsung/* @jorofi
 esphome/components/scd4x/* @martgras @sjtrny
 esphome/components/script/* @esphome/core
 esphome/components/sdl/* @bdm310 @clydebarrow
@@ -519,29 +397,15 @@ esphome/components/select/* @esphome/core
 esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
-esphome/components/sen6x/* @martgras @mebner86 @tuct
-esphome/components/sendspin/* @kahrendt
-esphome/components/sendspin/image/* @kahrendt
-esphome/components/sendspin/media_player/* @kahrendt
-esphome/components/sendspin/media_source/* @kahrendt
-esphome/components/sendspin/sensor/* @kahrendt
-esphome/components/sendspin/switch/* @kahrendt
-esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
-esphome/components/serial_proxy/* @kbx81
 esphome/components/sfa30/* @ghsensdev
-esphome/components/sfa40/* @NoQuarrel
 esphome/components/sgp40/* @SenexCrenshaw
-esphome/components/sgp4x/* @martgras @SenexCrenshaw
-esphome/components/sh1122_base/* @pl4nkton
-esphome/components/sh1122_spi/* @pl4nkton
-esphome/components/sha256/* @esphome/core
+esphome/components/sgp4x/* @SenexCrenshaw @martgras
 esphome/components/shelly_dimmer/* @edge90 @rnauber
 esphome/components/sht3xd/* @mrtoy-me
 esphome/components/sht4x/* @sjtrny
 esphome/components/shutdown/* @esphome/core @jsuanet
-esphome/components/siemens_ira211/* @fonix232
 esphome/components/sigma_delta_output/* @Cat-Ion
 esphome/components/sim800l/* @glmnet
 esphome/components/sm10bit_base/* @Cossid
@@ -551,21 +415,14 @@ esphome/components/sm2335/* @Cossid
 esphome/components/sml/* @alengwenus
 esphome/components/smt100/* @piechade
 esphome/components/sn74hc165/* @jesserockz
-esphome/components/snapshot/* @clydebarrow
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
 esphome/components/sound_level/* @kahrendt
-esphome/components/spa06_base/* @danielkent-net
-esphome/components/spa06_i2c/* @danielkent-net
-esphome/components/spa06_spi/* @danielkent-net
-esphome/components/spd2010/* @grischard
 esphome/components/speaker/* @jesserockz @kahrendt
 esphome/components/speaker/media_player/* @kahrendt @synesthesiam
-esphome/components/speaker_source/* @kahrendt
 esphome/components/spi/* @clydebarrow @esphome/core
 esphome/components/spi_device/* @clydebarrow
 esphome/components/spi_led_strip/* @clydebarrow
-esphome/components/split_buffer/* @jesserockz
 esphome/components/sprinkler/* @kbx81
 esphome/components/sps30/* @martgras
 esphome/components/ssd1322_base/* @kbx81
@@ -579,7 +436,6 @@ esphome/components/ssd1331_base/* @kbx81
 esphome/components/ssd1331_spi/* @kbx81
 esphome/components/ssd1351_base/* @kbx81
 esphome/components/ssd1351_spi/* @kbx81
-esphome/components/st7123/* @miniskipper
 esphome/components/st7567_base/* @latonita
 esphome/components/st7567_i2c/* @latonita
 esphome/components/st7567_spi/* @latonita
@@ -588,8 +444,6 @@ esphome/components/st7735/* @SenexCrenshaw
 esphome/components/st7789v/* @kbx81
 esphome/components/st7920/* @marsjan155
 esphome/components/statsd/* @Links2004
-esphome/components/stcc4/* @j9brown
-esphome/components/stts22h/* @B48D81EFCC
 esphome/components/substitutions/* @esphome/core
 esphome/components/sun/* @OttoWinter
 esphome/components/sun_gtil2/* @Mat931
@@ -597,40 +451,28 @@ esphome/components/switch/* @esphome/core
 esphome/components/switch/binary_sensor/* @ssieb
 esphome/components/sx126x/* @swoboda1337
 esphome/components/sx127x/* @swoboda1337
-esphome/components/sy6970/* @linkedupbits
 esphome/components/syslog/* @clydebarrow
-esphome/components/systa_bus/* @Mat931
 esphome/components/t6615/* @tylermenezes
-esphome/components/tas2780/* @remcom
-esphome/components/tas58xx/* @mrtoy-me @remcom
 esphome/components/tc74/* @sethgirvan
-esphome/components/tca8418/* @zebble
 esphome/components/tca9548a/* @andreashergert1984
 esphome/components/tca9555/* @mobrembski
 esphome/components/tcl112/* @glmnet
-esphome/components/tcp_uart/* @Bascht74
 esphome/components/tee501/* @Stock-M
-esphome/components/teleinfo/* @0hax @FredM67
+esphome/components/teleinfo/* @0hax
 esphome/components/tem3200/* @bakerkj
 esphome/components/template/alarm_control_panel/* @grahambrown11 @hwstar
 esphome/components/template/datetime/* @rfdarter
 esphome/components/template/event/* @nohat
 esphome/components/template/fan/* @ssieb
 esphome/components/text/* @mauritskorse
-esphome/components/tfluna/* @candrews
-esphome/components/thermopro_ble/* @sittner
 esphome/components/thermostat/* @kbx81
-esphome/components/time/* @esphome/core
-esphome/components/tinyusb/* @kbx81
-esphome/components/tinyusb_keyboard/* @frederikbolding
+esphome/components/time/* @OttoWinter
 esphome/components/tlc5947/* @rnauber
 esphome/components/tlc5971/* @IJIJI
 esphome/components/tm1621/* @Philippe12
 esphome/components/tm1637/* @glmnet
 esphome/components/tm1638/* @skykingjwc
-esphome/components/tm1651/* @mrtoy-me
-esphome/components/tmc2209/* @remcom
-esphome/components/tmc22xx/* @remcom
+esphome/components/tm1651/* @freekode
 esphome/components/tmp102/* @timsavage
 esphome/components/tmp1075/* @sybrenstuvel
 esphome/components/tmp117/* @Azimath
@@ -647,22 +489,15 @@ esphome/components/tuya/select/* @bearpawmaxim
 esphome/components/tuya/sensor/* @jesserockz
 esphome/components/tuya/switch/* @jesserockz
 esphome/components/tuya/text_sensor/* @dentra
-esphome/components/tuya/water_heater/* @iago-veiga
 esphome/components/uart/* @esphome/core
 esphome/components/uart/button/* @ssieb
-esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
-esphome/components/uart_mux/* @kbx81
-esphome/components/uart_tcp/* @Bascht74
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
-esphome/components/ufm01/* @ljungqvist
-esphome/components/ultrasonic/* @ssieb @swoboda1337
-esphome/components/unicode/* @esphome/core
+esphome/components/ultrasonic/* @OttoWinter
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
-esphome/components/usb_cdc_acm/* @kbx81
 esphome/components/usb_host/* @clydebarrow
 esphome/components/usb_uart/* @clydebarrow
 esphome/components/valve/* @esphome/core
@@ -673,16 +508,14 @@ esphome/components/version/* @esphome/core
 esphome/components/voice_assistant/* @jesserockz @kahrendt
 esphome/components/wake_on_lan/* @clydebarrow @willwill2will54
 esphome/components/watchdog/* @oarcher
-esphome/components/water_heater/* @dhoeben
 esphome/components/waveshare_epaper/* @clydebarrow
-esphome/components/waveshare_io_ch32v003/* @latonita
 esphome/components/web_server/ota/* @esphome/core
-esphome/components/web_server_base/* @esphome/core
+esphome/components/web_server_base/* @OttoWinter
 esphome/components/web_server_idf/* @dentra
 esphome/components/weikai/* @DrCoolZic
 esphome/components/weikai_i2c/* @DrCoolZic
 esphome/components/weikai_spi/* @DrCoolZic
-esphome/components/whirlpool/* @arpena @glmnet
+esphome/components/whirlpool/* @glmnet
 esphome/components/whynter/* @aeonsablaze
 esphome/components/wiegand/* @ssieb
 esphome/components/wireguard/* @droscy @lhoracek @thomas0bernard
@@ -695,15 +528,11 @@ esphome/components/wk2204_spi/* @DrCoolZic
 esphome/components/wk2212_i2c/* @DrCoolZic
 esphome/components/wk2212_spi/* @DrCoolZic
 esphome/components/wl_134/* @hobbypunk90
-esphome/components/wts01/* @alepee
 esphome/components/x9c/* @EtienneMD
-esphome/components/xdb401/* @RT530
 esphome/components/xgzp68xx/* @gcormier
-esphome/components/xiaomi_body_scale/* @dckiller51
 esphome/components/xiaomi_hhccjcy10/* @fariouche
 esphome/components/xiaomi_lywsd02mmc/* @juanluss31
 esphome/components/xiaomi_lywsd03mmc/* @ahpohl
-esphome/components/xiaomi_mccgq02hl/* @ahpohl @morph027
 esphome/components/xiaomi_mhoc303/* @drug123
 esphome/components/xiaomi_mhoc401/* @vevsvevs
 esphome/components/xiaomi_rtcgq02lm/* @jesserockz
@@ -712,9 +541,5 @@ esphome/components/xl9535/* @mreditor97
 esphome/components/xpt2046/touchscreen/* @nielsnl68 @numo68
 esphome/components/xxtea/* @clydebarrow
 esphome/components/zephyr/* @tomaszduda23
-esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
-esphome/components/zephyr_pwm/* @wiomoc
 esphome/components/zhlt01/* @cfeenstra1024
-esphome/components/zigbee/* @luar123 @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt
-esphome/components/zwave_proxy/* @kbx81

CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 We welcome contributions to the ESPHome suite of code and documentation!
 
-Please read our [contributing guide](https://developers.esphome.io/contributing/code/) if you wish to contribute to the
+Please read our [contributing guide](https://esphome.io/guides/contributing.html) if you wish to contribute to the
 project and be sure to join us on [Discord](https://discord.gg/KhAMKrd).
 
 **See also:**

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.11.0-dev
+PROJECT_NUMBER         = 2025.8.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

GEMINI.md

@@ -1 +1 @@
-AGENTS.md
+.ai/instructions.md

MANIFEST.in

@@ -1,9 +1,6 @@
 include LICENSE
 include README.md
 include requirements.txt
-recursive-include esphome *.yaml
 recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
-recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt
-recursive-include esphome requirements.txt

README.md

@@ -1,9 +1,9 @@
-# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/) [![CodSpeed](https://img.shields.io/endpoint?url=https://codspeed.io/badge.json)](https://codspeed.io/esphome/esphome)
+# ESPHome [![Discord Chat](https://img.shields.io/discord/429907082951524364.svg)](https://discord.gg/KhAMKrd) [![GitHub release](https://img.shields.io/github/release/esphome/esphome.svg)](https://GitHub.com/esphome/esphome/releases/)
 
 <a href="https://esphome.io/">
   <picture>
-    <source media="(prefers-color-scheme: dark)" srcset="https://media.esphome.io/logo/logo-text-on-dark.svg">
-    <img src="https://media.esphome.io/logo/logo-text-on-light.svg" alt="ESPHome Logo">
+    <source media="(prefers-color-scheme: dark)" srcset="https://esphome.io/_static/logo-text-on-dark.svg", alt="ESPHome Logo">
+    <img src="https://esphome.io/_static/logo-text-on-light.svg" alt="ESPHome Logo">
   </picture>
 </a>
 

THREAT_MODEL.md

@@ -1,197 +0,0 @@
-# ESPHome Threat Model
-
-This document defines the trust boundary for the **ESPHome** repository — the
-Python compiler/CLI and the device firmware it generates — so that real security
-bugs can be told apart from defense-in-depth improvements. It gives contributors,
-reviewers, and security researchers a clear answer to one question:
-**does this issue let an _unauthenticated_ attacker do something they shouldn't?**
-
-Related documents:
-
-- Deployment guidance for operators:
-  https://esphome.io/guides/security_best_practices/
-- The **Device Builder dashboard** (the web UI, its authentication, ingress,
-  Origin/Host gates, and peer-link pairing) lives in a separate repository and
-  has its own threat model. If your report concerns any of that, please read and
-  report there instead:
-  https://github.com/esphome/device-builder/blob/main/docs/THREAT_MODEL.md
-
-## The trust boundary
-
-For this repository there are two trusted inputs by design:
-
-1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
-   (see below).
-2. **Authenticated peers of a running device** — clients holding the device's
-   API/OTA encryption key, API password, OTA password, or web server
-   credentials.
-
-The security boundary is therefore **unauthenticated network traffic vs. those
-trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
-security bug.
-
-## Config authors are host-equivalent by design
-
-Anyone who can supply or edit a configuration is **trusted with full code
-execution on the host that runs `esphome`**, on purpose. This is what the product
-does, not a flaw. A config author can already, through fully supported features:
-
-- Run arbitrary **Python** at validation/compile time via `external_components:`
-  (and other component-import mechanisms) — ESPHome imports those packages as
-  ordinary Python.
-- Run arbitrary **shell** commands through the compile/validate/flash toolchain
-  that ESPHome invokes as subprocesses.
-- Read and write arbitrary files reachable by the process (e.g. via `!include`,
-  `packages:`, `dashboard_import:`, and generated build output).
-
-Because of this, a malicious config author is equivalent to shell access on the
-host running the build.
-
-## What is *not* a security vulnerability
-
-If exploiting an issue requires the ability to supply or edit configuration, it
-is **not** a vulnerability in ESPHome, because that ability already grants host
-code execution. This explicitly includes, among others:
-
-- Template / expression injection in substitutions or any YAML string value
-  (e.g. Jinja `${...}` evaluation reaching Python internals). This grants no
-  capability a config author lacks.
-- `!include` / `packages:` / `dashboard_import:` reading or fetching content
-  from surprising or remote locations.
-- The validator or compiler crashing or behaving unexpectedly on adversarial
-  YAML.
-- ESPHome running as root in the official container — that is the documented
-  deployment posture, reachable by the same caller through the features above.
-
-These do not warrant a CVE or coordinated disclosure. Hardening in these areas
-(for example, sandboxing template evaluation as least-surprise defense-in-depth)
-is welcome as a normal enhancement PR, framed as cleanliness rather than a
-security fix — not as a vulnerability remediation.
-
-## What we do defend
-
-These *are* security bugs in this repo, and we want to hear about them privately:
-
-- Memory-safety or protocol bugs in the generated **device firmware** that are
-  remotely triggerable over the network (native API, web server, OTA, BLE,
-  captive portal, etc.) **without** valid credentials.
-- Authentication or encryption bypass on the device — reaching API calls, OTA
-  updates, or the web server without the configured key/password.
-- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
-  web server auth below their documented guarantees.
-
-## The web server is an open HTTP API by design
-
-The `web_server` component exposes a plain HTTP interface for viewing and
-controlling entities, and, when the `web_server` OTA platform is enabled, for
-uploading firmware at `/update`. Its only access controls are the optional
-`web_server` `auth:` credentials and the network the device sits on.
-
-When `auth:` is not configured, every endpoint is reachable by any client that
-can reach the device. This is intentional; enabling `web_server` without `auth:`
-is choosing an open control surface, in the same way that running native OTA
-without a password leaves OTA open. The API is documented and is meant to be
-called by other devices, scripts, and pages.
-
-As defense-in-depth, the web server checks the `Origin` header on browser requests
-to its entity control and state endpoints: a request whose `Origin` does not match
-the address the device is served on is rejected, and the `allowed_origins` option
-widens that list. This blocks the common "confused deputy" (CSRF) case where a page
-the operator visits drives the device through their browser. It is **not** an
-authentication boundary: it only constrains browsers. Any client that omits the
-`Origin` header — `curl`, scripts, or other non-browser callers on the same
-network — reaches every endpoint exactly as before. The check also does not cover
-the web OTA `/update` endpoint. The device performs no CSRF-token or `Referer`
-validation. The following are therefore **not** vulnerabilities in this repository:
-
-- Requests without an `Origin` header (for example `curl`) reaching the control
-  endpoints, whether or not `web_server` `auth:` is set.
-- Requests from an origin the operator added to `allowed_origins`.
-- Cross-origin or CSRF firmware upload through the web OTA endpoint (`/update`) when
-  web OTA is enabled without `web_server` `auth:`. The `/update` endpoint is not
-  covered by the `Origin` check; this is the same exposure as running OTA without a
-  password.
-
-The supported defenses are `web_server` `auth:`, protecting OTA (a web password or
-a native OTA password), and keeping devices on a trusted, segmented network. See
-the security best practices guide linked above.
-
-What remains in scope is bypassing `web_server` `auth:` when it *is* configured,
-and any memory-safety or protocol bug in the server reachable without credentials.
-
-This section documents the current design and scope; it is not a judgment that the
-design is optimal or that it will not change.
-
-## OTA update encryption
-
-The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. A device
-whose `api:` block has an encryption key, static in the YAML or provisioned at
-runtime, compiles in the transport and offers it on every OTA connection once
-it holds a key, so an uploader presenting that key gets the guarantees below
-even without an `ota: encryption:` block; only that block makes the device
-require encryption. The guarantees are: the firmware image is confidential in
-transit, the uploader is authenticated by the pre-shared key, and the plaintext
-negotiation preceding the handshake is bound into the handshake prologue, so
-stripping or tampering with it fails the first MAC. With `ota: encryption:`
-configured both ends fail closed with no override: the device refuses
-plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured. Without that block the CLI tries a static api key when the device
-offers and, until 2027.3.0, falls back to plaintext with a warning when the
-offer is missing or the handshake fails; a runtime provisioned key never
-reaches the CLI, so those uploads stay plaintext.
-
-Defeating any of that without the key is in scope: a device that requires
-encryption accepting a plaintext or downgraded upload, getting past the MAC,
-or recovering image contents from captured traffic.
-
-The following are **not** vulnerabilities, by design:
-
-- Plaintext OTA on a device with no `ota: encryption:` block, including one
-  that offers encryption because it has an api key. That is the documented
-  default, authenticated (if at all) by the OTA password. An uploader that
-  takes the offer skips the password; the key authenticates it. With a
-  runtime provisioned key and no `provisioning:` window, whoever provisions
-  the key gains that upload path too; validation warns about the pair.
-- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
-  active attacker who strips the offer or breaks the handshake can make a
-  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
-  device that requires encryption still refuses that upload.
-- The enablement window: firmware built with a static api key already offers
-  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
-  Older firmware needs one last plaintext upload of an offering build, with
-  the pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. With the `web_server`
-  or `prometheus` component the shared listener is always up, so the endpoint
-  stays reachable and validation warns about that combination;
-  `captive_portal:` alone brings the listener up only for the fallback AP
-  window, which is the intended recovery path, so that is not warned about.
-- CLI retry behavior on transport or MAC failures; every attempt renegotiates
-  a fresh handshake with fresh ephemerals, so retrying does not weaken
-  authentication.
-
-## Explicitly out of scope
-
-- Local attackers who already have shell access on the host that runs `esphome`.
-- Supply-chain attacks against ESPHome or its dependencies.
-- Operator-supplied hostile YAML (covered above — config authoring is trusted).
-- Attacks that require an already-authenticated device peer (someone who already
-  holds the API key / OTA / web credentials).
-- Access to the device web server or its web OTA endpoint by non-browser clients
-  (those that send no `Origin` header). The web server is an open HTTP API by
-  design (see above); browser cross-origin requests are blocked by default, but the
-  real controls are `web_server` `auth:` and network isolation.
-- Anything in the dashboard / device-builder — report that in its own repository
-  (linked at the top).
-- Deployments where the operator removed protections or exposed credentials. See
-  the security best practices guide:
-  https://esphome.io/guides/security_best_practices/
-
-## Reporting a vulnerability
-
-If you believe you've found an issue that crosses the unauthenticated boundary
-above, please report it privately via GitHub Security Advisories rather than a
-public issue. For issues that require config-write access, please review this
-document first — they are very likely out of scope by design. For dashboard /
-device-builder issues, report against that repository and consult its threat
-model (linked at the top).

codecov.yml

@@ -1,18 +0,0 @@
-coverage:
-  status:
-    patch:
-      default:
-        target: 100%
-        threshold: 0%
-    project:
-      default:
-        informational: true
-
-ignore:
-  - "esphome/components/**/*"
-  - "esphome/analyze_memory/**/*"
-  - "tests/integration/**/*"
-
-comment:
-  layout: "reach, diff, flags, files"
-  require_changes: true

docker/Dockerfile

@@ -1,19 +1,19 @@
 ARG BUILD_VERSION=dev
-ARG BUILD_BASE_VERSION=2026.06.1
+ARG BUILD_OS=alpine
+ARG BUILD_BASE_VERSION=2025.04.0
 ARG BUILD_TYPE=docker
 
-FROM ghcr.io/esphome/docker-base:debian-${BUILD_BASE_VERSION} AS base-source-docker
-FROM ghcr.io/esphome/docker-base:debian-ha-addon-${BUILD_BASE_VERSION} AS base-source-ha-addon
+FROM ghcr.io/esphome/docker-base:${BUILD_OS}-${BUILD_BASE_VERSION} AS base-source-docker
+FROM ghcr.io/esphome/docker-base:${BUILD_OS}-ha-addon-${BUILD_BASE_VERSION} AS base-source-ha-addon
 
 ARG BUILD_TYPE
 FROM base-source-${BUILD_TYPE} AS base
 
-RUN git config --system --add safe.directory "*" \
-    && git config --system advice.detachedHead false
+RUN git config --system --add safe.directory "*"
 
 ENV PIP_DISABLE_PIP_VERSION_CHECK=1
 
-RUN pip install --no-cache-dir -U pip uv==0.10.1
+RUN pip install --no-cache-dir -U pip uv==0.6.14
 
 COPY requirements.txt /
 
@@ -21,14 +21,14 @@ RUN \
     uv pip install --no-cache-dir \
     -r /requirements.txt
 
-# Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.23.1
-
 RUN \
     platformio settings set enable_telemetry No \
     && platformio settings set check_platformio_interval 1000000 \
     && mkdir -p /piolibs
 
+COPY script/platformio_install_deps.py platformio.ini /
+RUN /platformio_install_deps.py /platformio.ini --libraries
+
 ARG BUILD_VERSION
 
 LABEL \

docker/build.py

@@ -20,10 +20,6 @@ TYPE_HA_ADDON = "ha-addon"
 TYPE_LINT = "lint"
 TYPES = [TYPE_DOCKER, TYPE_HA_ADDON, TYPE_LINT]
 
-REGISTRY_GHCR = "ghcr"
-REGISTRY_DOCKERHUB = "dockerhub"
-REGISTRIES = [REGISTRY_GHCR, REGISTRY_DOCKERHUB]
-
 
 parser = argparse.ArgumentParser()
 parser.add_argument(
@@ -38,12 +34,6 @@ parser.add_argument(
 parser.add_argument(
     "--build-type", choices=TYPES, required=True, help="The type of build to run"
 )
-parser.add_argument(
-    "--registry",
-    choices=REGISTRIES,
-    action="append",
-    help="Restrict to specific registries (default: all). May be passed multiple times.",
-)
 parser.add_argument(
     "--dry-run", action="store_true", help="Don't run any commands, just print them"
 )
@@ -55,11 +45,6 @@ build_parser.add_argument("--push", help="Also push the images", action="store_t
 build_parser.add_argument(
     "--load", help="Load the docker image locally", action="store_true"
 )
-build_parser.add_argument(
-    "--no-cache-to",
-    help="Don't write the build cache (avoids polluting the shared cache)",
-    action="store_true",
-)
 manifest_parser = subparsers.add_parser(
     "manifest", help="Create a manifest from already pushed images"
 )
@@ -105,19 +90,16 @@ def main():
     def run_command(*cmd, ignore_error: bool = False):
         print(f"$ {shlex.join(list(cmd))}")
         if not args.dry_run:
-            rc = subprocess.call(list(cmd), close_fds=False)
+            rc = subprocess.call(list(cmd))
             if rc != 0 and not ignore_error:
                 print("Command failed")
                 sys.exit(1)
 
-    registries = args.registry or REGISTRIES
-
     # detect channel from tag
     match = re.match(r"^(\d+\.\d+)(?:\.\d+)?(b\d+)?$", args.tag)
     major_minor_version = None
     if match is None:
-        # Custom tag (e.g. a branch name) -- push only the tag itself
-        channel = None
+        channel = CHANNEL_DEV
     elif match.group(2) is None:
         major_minor_version = match.group(1)
         channel = CHANNEL_RELEASE
@@ -146,18 +128,11 @@ def main():
             CHANNEL_DEV: "cache-dev",
             CHANNEL_BETA: "cache-beta",
             CHANNEL_RELEASE: "cache-latest",
-        }.get(channel, "cache-dev")
-        # Cache images live alongside the pushed images; prefer GHCR when it is
-        # one of the selected registries, otherwise fall back to Docker Hub so a
-        # registry-restricted build doesn't need GHCR auth.
-        cache_prefix = "ghcr.io/" if REGISTRY_GHCR in registries else ""
-        cache_img = f"{cache_prefix}{params.build_to}:{cache_tag}"
+        }[channel]
+        cache_img = f"ghcr.io/{params.build_to}:{cache_tag}"
 
-        imgs = []
-        if REGISTRY_DOCKERHUB in registries:
-            imgs += [f"{params.build_to}:{tag}" for tag in tags_to_push]
-        if REGISTRY_GHCR in registries:
-            imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]
+        imgs = [f"{params.build_to}:{tag}" for tag in tags_to_push]
+        imgs += [f"ghcr.io/{params.build_to}:{tag}" for tag in tags_to_push]
 
         # 3. build
         cmd = [
@@ -180,9 +155,7 @@ def main():
         for img in imgs:
             cmd += ["--tag", img]
         if args.push:
-            cmd += ["--push"]
-            if not args.no_cache_to:
-                cmd += ["--cache-to", f"type=registry,ref={cache_img},mode=max"]
+            cmd += ["--push", "--cache-to", f"type=registry,ref={cache_img},mode=max"]
         if args.load:
             cmd += ["--load"]
 
@@ -190,22 +163,20 @@ def main():
     elif args.command == "manifest":
         manifest = DockerParams.for_type_arch(args.build_type, ARCH_AMD64).manifest_to
 
-        targets = []
-        if REGISTRY_DOCKERHUB in registries:
-            targets += [f"{manifest}:{tag}" for tag in tags_to_push]
-        if REGISTRY_GHCR in registries:
-            targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
-        # Use buildx imagetools (not `docker manifest`) so the per-arch sources,
-        # which buildx pushes as single-platform manifest lists, are combined
-        # and pushed correctly in one step.
+        targets = [f"{manifest}:{tag}" for tag in tags_to_push]
+        targets += [f"ghcr.io/{manifest}:{tag}" for tag in tags_to_push]
+        # 1. Create manifests
         for target in targets:
-            cmd = ["docker", "buildx", "imagetools", "create", "--tag", target]
+            cmd = ["docker", "manifest", "create", target]
             for arch in ARCHS:
                 src = f"{DockerParams.for_type_arch(args.build_type, arch).build_to}:{args.tag}"
                 if target.startswith("ghcr.io"):
                     src = f"ghcr.io/{src}"
                 cmd.append(src)
             run_command(*cmd)
+        # 2. Push manifests
+        for target in targets:
+            run_command("docker", "manifest", "push", target)
 
 
 if __name__ == "__main__":

docker/docker_entrypoint.sh

@@ -21,27 +21,10 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs and compiler caches on the persistent
-# cache root, not the container's user cache dir: it is lost on every
-# restart, and not writable when the container runs as a non-root user.
-export ESPHOME_ESP_IDF_PREFIX="$(dirname "${pio_cache_base}")/idf"
-export ESPHOME_SDK_NRF_PREFIX="$(dirname "${pio_cache_base}")/sdk-nrf"
-export ESPHOME_ARDUINO8266_PREFIX="$(dirname "${pio_cache_base}")/arduino8266"
-export ESPHOME_HOST_PREFIX="$(dirname "${pio_cache_base}")/host"
-export ESPHOME_PLATFORMIO_CCACHE_DIR="$(dirname "${pio_cache_base}")/platformio-ccache"
-
 # If /build is mounted, use that as the build path
 # otherwise use path in /config (so that builds aren't lost on container restart)
 if [[ -d /build ]]; then
     export ESPHOME_BUILD_PATH=/build
 fi
 
-# The default CMD is "dashboard /config". Route the dashboard to the new
-# Device Builder, but pass every other subcommand (compile, run, config,
-# logs, ...) straight through to the esphome CLI so direct CLI use keeps working.
-if [[ "$1" == "dashboard" ]]; then
-    shift
-    exec esphome-device-builder "$@"
-fi
-
 exec esphome "$@"

docker/generate_tags.py

@@ -1,6 +1,5 @@
 #!/usr/bin/env python3
 import argparse
-import os
 import re
 
 CHANNEL_DEV = "dev"
@@ -65,10 +64,7 @@ def main():
 
     suffix = f"-{args.suffix}" if args.suffix else ""
 
-    repository = (
-        (os.environ.get("GITHUB_REPOSITORY") or "esphome/esphome").strip().lower()
-    )
-    image_name = f"{repository}{suffix}"
+    image_name = f"esphome/esphome{suffix}"
 
     print(f"channel={channel}")
 

docker/ha-addon-rootfs/etc/nginx/includes/mime.types

@@ -0,0 +1,96 @@
+types {
+    text/html                                        html htm shtml;
+    text/css                                         css;
+    text/xml                                         xml;
+    image/gif                                        gif;
+    image/jpeg                                       jpeg jpg;
+    application/javascript                           js;
+    application/atom+xml                             atom;
+    application/rss+xml                              rss;
+
+    text/mathml                                      mml;
+    text/plain                                       txt;
+    text/vnd.sun.j2me.app-descriptor                 jad;
+    text/vnd.wap.wml                                 wml;
+    text/x-component                                 htc;
+
+    image/png                                        png;
+    image/svg+xml                                    svg svgz;
+    image/tiff                                       tif tiff;
+    image/vnd.wap.wbmp                               wbmp;
+    image/webp                                       webp;
+    image/x-icon                                     ico;
+    image/x-jng                                      jng;
+    image/x-ms-bmp                                   bmp;
+
+    font/woff                                        woff;
+    font/woff2                                       woff2;
+
+    application/java-archive                         jar war ear;
+    application/json                                 json;
+    application/mac-binhex40                         hqx;
+    application/msword                               doc;
+    application/pdf                                  pdf;
+    application/postscript                           ps eps ai;
+    application/rtf                                  rtf;
+    application/vnd.apple.mpegurl                    m3u8;
+    application/vnd.google-earth.kml+xml             kml;
+    application/vnd.google-earth.kmz                 kmz;
+    application/vnd.ms-excel                         xls;
+    application/vnd.ms-fontobject                    eot;
+    application/vnd.ms-powerpoint                    ppt;
+    application/vnd.oasis.opendocument.graphics      odg;
+    application/vnd.oasis.opendocument.presentation  odp;
+    application/vnd.oasis.opendocument.spreadsheet   ods;
+    application/vnd.oasis.opendocument.text          odt;
+    application/vnd.openxmlformats-officedocument.presentationml.presentation
+                                                     pptx;
+    application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
+                                                     xlsx;
+    application/vnd.openxmlformats-officedocument.wordprocessingml.document
+                                                     docx;
+    application/vnd.wap.wmlc                         wmlc;
+    application/x-7z-compressed                      7z;
+    application/x-cocoa                              cco;
+    application/x-java-archive-diff                  jardiff;
+    application/x-java-jnlp-file                     jnlp;
+    application/x-makeself                           run;
+    application/x-perl                               pl pm;
+    application/x-pilot                              prc pdb;
+    application/x-rar-compressed                     rar;
+    application/x-redhat-package-manager             rpm;
+    application/x-sea                                sea;
+    application/x-shockwave-flash                    swf;
+    application/x-stuffit                            sit;
+    application/x-tcl                                tcl tk;
+    application/x-x509-ca-cert                       der pem crt;
+    application/x-xpinstall                          xpi;
+    application/xhtml+xml                            xhtml;
+    application/xspf+xml                             xspf;
+    application/zip                                  zip;
+
+    application/octet-stream                         bin exe dll;
+    application/octet-stream                         deb;
+    application/octet-stream                         dmg;
+    application/octet-stream                         iso img;
+    application/octet-stream                         msi msp msm;
+
+    audio/midi                                       mid midi kar;
+    audio/mpeg                                       mp3;
+    audio/ogg                                        ogg;
+    audio/x-m4a                                      m4a;
+    audio/x-realaudio                                ra;
+
+    video/3gpp                                       3gpp 3gp;
+    video/mp2t                                       ts;
+    video/mp4                                        mp4;
+    video/mpeg                                       mpeg mpg;
+    video/quicktime                                  mov;
+    video/webm                                       webm;
+    video/x-flv                                      flv;
+    video/x-m4v                                      m4v;
+    video/x-mng                                      mng;
+    video/x-ms-asf                                   asx asf;
+    video/x-ms-wmv                                   wmv;
+    video/x-msvideo                                  avi;
+}

docker/ha-addon-rootfs/etc/nginx/includes/proxy_params.conf

@@ -0,0 +1,16 @@
+proxy_http_version          1.1;
+proxy_ignore_client_abort   off;
+proxy_read_timeout          86400s;
+proxy_redirect              off;
+proxy_send_timeout          86400s;
+proxy_max_temp_file_size    0;
+
+proxy_set_header Accept-Encoding "";
+proxy_set_header Connection $connection_upgrade;
+proxy_set_header Host $http_host;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-NginX-Proxy true;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header Authorization "";

docker/ha-addon-rootfs/etc/nginx/includes/server_params.conf

@@ -0,0 +1,8 @@
+root            /dev/null;
+server_name     $hostname;
+
+client_max_body_size 512m;
+
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+add_header X-Robots-Tag none;

docker/ha-addon-rootfs/etc/nginx/includes/ssl_params.conf

@@ -0,0 +1,8 @@
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_prefer_server_ciphers off;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off;
+ssl_stapling on;
+ssl_stapling_verify on;

docker/ha-addon-rootfs/etc/nginx/includes/upstream.conf

@@ -0,0 +1,3 @@
+upstream esphome {
+    server unix:/var/run/esphome.sock;
+}

docker/ha-addon-rootfs/etc/nginx/nginx.conf

@@ -0,0 +1,30 @@
+daemon off;
+user root;
+pid /var/run/nginx.pid;
+worker_processes 1;
+error_log /proc/1/fd/1 error;
+events {
+    worker_connections 1024;
+}
+
+http {
+    include /etc/nginx/includes/mime.types;
+
+    access_log              off;
+    default_type            application/octet-stream;
+    gzip                    on;
+    keepalive_timeout       65;
+    sendfile                on;
+    server_tokens           off;
+
+    tcp_nodelay             on;
+    tcp_nopush              on;
+
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ''      close;
+    }
+
+    include /etc/nginx/includes/upstream.conf;
+    include /etc/nginx/servers/*.conf;
+}

docker/ha-addon-rootfs/etc/nginx/servers/.gitkeep

@@ -0,0 +1 @@
+Without requirements or design, programming is the art of adding bugs to an empty text file. (Louis Srygley)

docker/ha-addon-rootfs/etc/nginx/templates/direct.gtpl

@@ -0,0 +1,28 @@
+server {
+    {{ if not .ssl }}
+    listen 6052 default_server;
+    {{ else }}
+    listen 6052 default_server ssl http2;
+    {{ end }}
+
+    include /etc/nginx/includes/server_params.conf;
+    include /etc/nginx/includes/proxy_params.conf;
+
+    {{ if .ssl }}
+    include /etc/nginx/includes/ssl_params.conf;
+
+    ssl_certificate /ssl/{{ .certfile }};
+    ssl_certificate_key /ssl/{{ .keyfile }};
+
+    # Redirect http requests to https on the same port.
+    # https://rageagainstshell.com/2016/11/redirect-http-to-https-on-the-same-port-in-nginx/
+    error_page 497 https://$http_host$request_uri;
+    {{ end }}
+
+    # Clear Home Assistant Ingress header
+    proxy_set_header X-HA-Ingress "";
+
+    location / {
+        proxy_pass http://esphome;
+    }
+}

docker/ha-addon-rootfs/etc/nginx/templates/ingress.gtpl

@@ -0,0 +1,18 @@
+server {
+    listen 127.0.0.1:{{ .port }} default_server;
+    listen {{ .interface }}:{{ .port }} default_server;
+
+    include /etc/nginx/includes/server_params.conf;
+    include /etc/nginx/includes/proxy_params.conf;
+
+    # Set Home Assistant Ingress header
+    proxy_set_header X-HA-Ingress "YES";
+
+    location / {
+        allow   172.30.32.2;
+        allow   127.0.0.1;
+        deny    all;
+
+        proxy_pass http://esphome;
+    }
+}

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/discovery/run

@@ -4,6 +4,7 @@
 # Home Assistant Add-on: ESPHome
 # Sends discovery information to Home Assistant.
 # ==============================================================================
+declare config
 declare port
 
 # We only disable it when disabled explicitly
@@ -15,20 +16,17 @@ fi
 
 port=$(bashio::addon.ingress_port)
 
-# Wait for the ESPHome Device Builder to become available
+# Wait for NGINX to become available
 bashio::net.wait_for "${port}" "127.0.0.1" 300
 
-# Send one discovery message; the config is a JSON string built with bashio::var.json.
-send_discovery() {
-    local service=$1
-    local config=$2
-    if bashio::discovery "${service}" "${config}" > /dev/null; then
-        bashio::log.info "Successfully send ${service} discovery information to Home Assistant."
-    else
-        bashio::log.error "${service} discovery message to Home Assistant failed!"
-    fi
-}
+config=$(\
+    bashio::var.json \
+        host "127.0.0.1" \
+        port "^${port}" \
+)
 
-send_discovery "esphome" "$(bashio::var.json host "127.0.0.1" port "^${port}")"
-# The Device Builder MCP server, consumed by Home Assistant's mcp integration.
-send_discovery "mcp" "$(bashio::var.json url "http://127.0.0.1:${port}/api/mcp")"
+if bashio::discovery "esphome" "${config}" > /dev/null; then
+    bashio::log.info "Successfully send discovery information to Home Assistant."
+else
+    bashio::log.error "Discovery message to Home Assistant failed!"
+fi

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/finish

@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # ==============================================================================
 # Home Assistant Community Add-on: ESPHome
-# Take down the S6 supervision tree when ESPHome Device Builder fails
+# Take down the S6 supervision tree when ESPHome dashboard fails
 # ==============================================================================
 declare exit_code
 readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
@@ -10,7 +10,7 @@ readonly exit_code_service="${1}"
 readonly exit_code_signal="${2}"
 
 bashio::log.info \
-  "Service ESPHome Device Builder exited with code ${exit_code_service}" \
+  "Service ESPHome dashboard exited with code ${exit_code_service}" \
   "(by signal ${exit_code_signal})"
 
 if [[ "${exit_code_service}" -eq 256 ]]; then

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -2,7 +2,7 @@
 # shellcheck shell=bash
 # ==============================================================================
 # Community Hass.io Add-ons: ESPHome
-# Runs the ESPHome Device Builder
+# Runs the ESPHome dashboard
 # ==============================================================================
 readonly pio_cache_base=/data/cache/platformio
 
@@ -15,19 +15,18 @@ export PLATFORMIO_PLATFORMS_DIR="${pio_cache_base}/platforms"
 export PLATFORMIO_PACKAGES_DIR="${pio_cache_base}/packages"
 export PLATFORMIO_CACHE_DIR="${pio_cache_base}/cache"
 
-# Keep the native toolchain installs and compiler caches on the persistent
-# /data volume, not the container's ephemeral user cache dir (wiped on every
-# add-on update/restart).
-export ESPHOME_ESP_IDF_PREFIX=/data/cache/idf
-export ESPHOME_SDK_NRF_PREFIX=/data/cache/sdk-nrf
-export ESPHOME_ARDUINO8266_PREFIX=/data/cache/arduino8266
-export ESPHOME_HOST_PREFIX=/data/cache/host
-export ESPHOME_PLATFORMIO_CCACHE_DIR=/data/cache/platformio-ccache
-
 if bashio::config.true 'leave_front_door_open'; then
     export DISABLE_HA_AUTHENTICATION=true
 fi
 
+if bashio::config.true 'streamer_mode'; then
+    export ESPHOME_STREAMER_MODE=true
+fi
+
+if bashio::config.has_value 'relative_url'; then
+    export ESPHOME_DASHBOARD_RELATIVE_URL=$(bashio::config 'relative_url')
+fi
+
 if bashio::config.has_value 'default_compile_process_limit'; then
     export ESPHOME_DEFAULT_COMPILE_PROCESS_LIMIT=$(bashio::config 'default_compile_process_limit')
 else
@@ -50,21 +49,5 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
-# Only signal device-builder to expose the public LAN port when the operator
-# mapped port 6052, matching the legacy dashboard where nginx listened on the
-# fixed port 6052 only when it was configured. We use the mapping purely as a
-# presence check and don't forward the published value; device-builder binds
-# its default port 6052 (the fixed container port, as the legacy
-# "listen 6052" did). --ha-addon-allow-public is inert on its own: the no-auth
-# gate is the DISABLE_HA_AUTHENTICATION env var set above, so both opt-ins are
-# required to bind 6052 unauthenticated; either alone stays ingress-only.
-set --
-if bashio::var.has_value "$(bashio::addon.port 6052)"; then
-    set -- --ha-addon-allow-public
-fi
-
-bashio::log.info "Starting ESPHome Device Builder..."
-exec esphome-device-builder /config/esphome \
-    --ha-addon \
-    --ingress-port "$(bashio::addon.ingress_port)" \
-    "$@"
+bashio::log.info "Starting ESPHome dashboard..."
+exec esphome dashboard /config/esphome --socket /var/run/esphome.sock --ha-addon

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -0,0 +1,27 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Community Hass.io Add-ons: ESPHome
+# Configures NGINX for use with ESPHome
+# ==============================================================================
+mkdir -p /var/log/nginx
+
+# Generate Ingress configuration
+bashio::var.json \
+    interface "$(bashio::addon.ip_address)" \
+    port "^$(bashio::addon.ingress_port)" \
+    | tempio \
+        -template /etc/nginx/templates/ingress.gtpl \
+        -out /etc/nginx/servers/ingress.conf
+
+# Generate direct access configuration, if enabled.
+if bashio::var.has_value "$(bashio::addon.port 6052)"; then
+    bashio::config.require.ssl
+    bashio::var.json \
+        certfile "$(bashio::config 'certfile')" \
+        keyfile "$(bashio::config 'keyfile')" \
+        ssl "^$(bashio::config 'ssl')" \
+        | tempio \
+            -template /etc/nginx/templates/direct.gtpl \
+            -out /etc/nginx/servers/direct.conf
+fi

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/type

@@ -0,0 +1 @@
+oneshot

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/up

@@ -0,0 +1 @@
+/etc/s6-overlay/s6-rc.d/init-nginx/run

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/finish

@@ -0,0 +1,25 @@
+#!/command/with-contenv bashio
+# ==============================================================================
+# Community Hass.io Add-ons: ESPHome
+# Take down the S6 supervision tree when NGINX fails
+# ==============================================================================
+declare exit_code
+readonly exit_code_container=$(</run/s6-linux-init-container-results/exitcode)
+readonly exit_code_service="${1}"
+readonly exit_code_signal="${2}"
+
+bashio::log.info \
+  "Service NGINX exited with code ${exit_code_service}" \
+  "(by signal ${exit_code_signal})"
+
+if [[ "${exit_code_service}" -eq 256 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo $((128 + $exit_code_signal)) > /run/s6-linux-init-container-results/exitcode
+  fi
+  [[ "${exit_code_signal}" -eq 15 ]] && exec /run/s6/basedir/bin/halt
+elif [[ "${exit_code_service}" -ne 0 ]]; then
+  if [[ "${exit_code_container}" -eq 0 ]]; then
+    echo "${exit_code_service}" > /run/s6-linux-init-container-results/exitcode
+  fi
+  exec /run/s6/basedir/bin/halt
+fi

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -0,0 +1,15 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Community Hass.io Add-ons: ESPHome
+# Runs the NGINX proxy
+# ==============================================================================
+
+bashio::log.info "Waiting for ESPHome dashboard to come up..."
+
+while [[ ! -S /var/run/esphome.sock ]]; do
+  sleep 0.5
+done
+
+bashio::log.info "Starting NGINX..."
+exec nginx

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/type

@@ -0,0 +1 @@
+longrun

docker/test_configs/bk72xx-arduino.yaml

@@ -1,19 +0,0 @@
-esphome:
-  name: docker-test-bk72xx-arduino
-
-bk72xx:
-  board: generic-bk7231n-qfn32-tuya
-
-logger:
-
-wifi:
-  ssid: MySSID
-  password: password1
-  ap:
-
-# mqtt and captive_portal together pull in AsyncTCP and ESPAsyncWebServer;
-# a stray ESP32 AsyncTCP copy on the library search path breaks this build
-captive_portal:
-
-mqtt:
-  broker: 192.168.178.84

docker/test_configs/esp32-arduino-esp-idf.yaml

@@ -1,10 +0,0 @@
-esphome:
-  name: docker-test-esp32-ard-idf
-
-esp32:
-  variant: esp32
-  framework:
-    type: arduino
-  toolchain: esp-idf
-
-logger: