Merge remote-tracking branch 'upstream/dev' into remove_posix_tz_parser

# Conflicts:
#	esphome/components/time/posix_tz.cpp
#	esphome/components/time/posix_tz.h

.clang-tidy

@@ -5,30 +5,24 @@ Checks: >-
   -altera-*,
   -android-*,
   -boost-*,
-  -bugprone-derived-method-shadowing-base-method,
   -bugprone-easily-swappable-parameters,
   -bugprone-implicit-widening-of-multiplication-result,
-  -bugprone-invalid-enum-default-initialization,
   -bugprone-multi-level-implicit-pointer-conversion,
   -bugprone-narrowing-conversions,
-  -bugprone-tagged-union-member-count,
   -bugprone-signed-char-misuse,
   -bugprone-switch-missing-default-case,
   -cert-dcl50-cpp,
   -cert-err33-c,
   -cert-err58-cpp,
-  -cert-int09-c,
   -cert-oop57-cpp,
   -cert-str34-c,
   -clang-analyzer-optin.core.EnumCastOutOfRange,
   -clang-analyzer-optin.cplusplus.UninitializedObject,
   -clang-analyzer-osx.*,
-  -clang-analyzer-security.ArrayBound,
   -clang-diagnostic-delete-abstract-non-virtual-dtor,
   -clang-diagnostic-delete-non-abstract-non-virtual-dtor,
   -clang-diagnostic-deprecated-declarations,
   -clang-diagnostic-ignored-optimization-argument,
-  -clang-diagnostic-missing-designated-field-initializers,
   -clang-diagnostic-missing-field-initializers,
   -clang-diagnostic-shadow-field,
   -clang-diagnostic-unused-const-variable,
@@ -48,7 +42,6 @@ Checks: >-
   -cppcoreguidelines-owning-memory,
   -cppcoreguidelines-prefer-member-initializer,
   -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
-  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
   -cppcoreguidelines-pro-bounds-constant-array-index,
   -cppcoreguidelines-pro-bounds-pointer-arithmetic,
   -cppcoreguidelines-pro-type-const-cast,
@@ -61,13 +54,12 @@ Checks: >-
   -cppcoreguidelines-rvalue-reference-param-not-moved,
   -cppcoreguidelines-special-member-functions,
   -cppcoreguidelines-use-default-member-init,
-  -cppcoreguidelines-use-enum-class,
   -cppcoreguidelines-virtual-class-destructor,
-  -fuchsia-default-arguments-calls,
-  -fuchsia-default-arguments-declarations,
   -fuchsia-multiple-inheritance,
   -fuchsia-overloaded-operator,
   -fuchsia-statically-constructed-objects,
+  -fuchsia-default-arguments-declarations,
+  -fuchsia-default-arguments-calls,
   -google-build-using-namespace,
   -google-explicit-constructor,
   -google-readability-braces-around-statements,
@@ -79,64 +71,49 @@ Checks: >-
   -llvm-else-after-return,
   -llvm-header-guard,
   -llvm-include-order,
-  -llvm-prefer-static-over-anonymous-namespace,
   -llvm-qualified-auto,
-  -llvm-use-ranges,
   -llvmlibc-*,
   -misc-const-correctness,
   -misc-include-cleaner,
-  -misc-multiple-inheritance,
   -misc-no-recursion,
   -misc-non-private-member-variables-in-classes,
-  -misc-override-with-different-visibility,
   -misc-unused-parameters,
   -misc-use-anonymous-namespace,
-  -misc-use-internal-linkage,
   -modernize-avoid-bind,
-  -modernize-avoid-variadic-functions,
   -modernize-avoid-c-arrays,
-  -modernize-avoid-c-style-cast,
+  -modernize-concat-nested-namespaces,
   -modernize-macro-to-enum,
   -modernize-return-braced-init-list,
   -modernize-type-traits,
   -modernize-use-auto,
   -modernize-use-constraints,
   -modernize-use-default-member-init,
-  -modernize-use-designated-initializers,
   -modernize-use-equals-default,
-  -modernize-use-integer-sign-comparison,
   -modernize-use-nodiscard,
   -modernize-use-nullptr,
-  -modernize-use-ranges,
+  -modernize-use-nodiscard,
+  -modernize-use-nullptr,
   -modernize-use-trailing-return-type,
   -mpi-*,
   -objc-*,
   -performance-enum-size,
-  -portability-avoid-pragma-once,
-  -portability-template-virtual-member-function,
-  -readability-ambiguous-smartptr-reset-call,
   -readability-avoid-nested-conditional-operator,
   -readability-container-contains,
   -readability-container-data-pointer,
   -readability-convert-member-functions-to-static,
   -readability-else-after-return,
-  -readability-enum-initial-value,
   -readability-function-cognitive-complexity,
   -readability-implicit-bool-conversion,
   -readability-isolate-declaration,
   -readability-magic-numbers,
   -readability-make-member-function-const,
-  -readability-math-missing-parentheses,
   -readability-named-parameter,
   -readability-redundant-casting,
   -readability-redundant-inline-specifier,
   -readability-redundant-member-init,
-  -readability-redundant-parentheses,
-  -readability-redundant-typename,
+  -readability-redundant-string-init,
   -readability-uppercase-literal-suffix,
   -readability-use-anyofallof,
-  -readability-use-std-min-max,
-  -readability-use-concise-preprocessor-directives,
 WarningsAsErrors: '*'
 FormatStyle:     google
 CheckOptions:

.clang-tidy.hash

@@ -1 +1 @@
-96c95feaa60831da5f43e3c6a7c7a3a237e17c5d12995a730dbc3884c8dcd11c
+f31f13994768b5b07e29624406c9b053bf4bb26e1623ac2bc1e9d4a9477502d6

.devcontainer/devcontainer.json

@@ -12,7 +12,7 @@
     "--privileged",
     "-e",
     "GIT_EDITOR=code --wait"
-    // uncomment and edit the path in order to pass through local USB serial to the container
+    // uncomment and edit the path in order to pass though local USB serial to the conatiner
     // , "--device=/dev/ttyACM0"
   ],
   "appPort": 6052,

.dockerignore

@@ -115,4 +115,4 @@ examples/
 Dockerfile
 .git/
 tests/
-.?*
+.*

.github/actions/build-image/action.yaml

@@ -47,7 +47,7 @@ runs:
 
     - name: Build and push to ghcr by digest
       id: build-ghcr
-      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false
@@ -73,7 +73,7 @@ runs:
 
     - name: Build and push to dockerhub by digest
       id: build-dockerhub
-      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+      uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
       env:
         DOCKER_BUILD_SUMMARY: false
         DOCKER_BUILD_RECORD_UPLOAD: false

.github/actions/restore-python/action.yml

@@ -22,7 +22,7 @@ runs:
         python-version: ${{ inputs.python-version }}
     - name: Restore Python virtual environment
       id: cache-venv
-      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+      uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: venv
         # yamllint disable-line rule:line-length

.github/scripts/auto-label-pr/constants.js

@@ -4,7 +4,6 @@ module.exports = {
   CODEOWNERS_MARKER: '<!-- codeowners-request -->',
   TOO_BIG_MARKER: '<!-- too-big-request -->',
   DEPRECATED_COMPONENT_MARKER: '<!-- deprecated-component-request -->',
-  ORG_FORK_MARKER: '<!-- maintainer-access-warning -->',
 
   MANAGED_LABELS: [
     'new-component',

.github/scripts/auto-label-pr/detectors.js

@@ -1,3 +1,4 @@
+const fs = require('fs');
 const { DOCS_PR_PATTERNS } = require('./constants');
 const {
   COMPONENT_REGEX,
@@ -8,31 +9,6 @@ const {
 } = require('../detect-tags');
 const { loadCodeowners, getEffectiveOwners } = require('../codeowners');
 
-// Top-level `CONFIG_SCHEMA = ...` (assignment) or `CONFIG_SCHEMA: ConfigType = ...` (annotation).
-// Ruff/Black enforce exactly one space around `=` and no space before `:`,
-// so we can match strictly: `CONFIG_SCHEMA ` or `CONFIG_SCHEMA:`.
-const CONFIG_SCHEMA_REGEX = /^CONFIG_SCHEMA[ :]/m;
-
-// Fetch a file's contents from the PR head SHA via the GitHub API.
-// The auto-label workflow runs on `pull_request_target`, which checks out the
-// base branch — files added by the PR don't exist in the workspace, so we have
-// to fetch them from the head SHA. Returns null if the file can't be fetched.
-async function fetchPrFileContent(github, context, path) {
-  try {
-    const { owner, repo } = context.repo;
-    const { data } = await github.rest.repos.getContent({
-      owner,
-      repo,
-      path,
-      ref: context.payload.pull_request.head.sha,
-    });
-    return Buffer.from(data.content, 'base64').toString('utf8');
-  } catch (error) {
-    console.log(`Failed to fetch ${path} from PR head:`, error.message);
-    return null;
-  }
-}
-
 // Strategy: Merge branch detection
 async function detectMergeBranch(context) {
   const labels = new Set();
@@ -69,64 +45,52 @@ async function detectComponentPlatforms(changedFiles, apiData) {
 }
 
 // Strategy: New component detection
-async function detectNewComponents(github, context, prFiles) {
+async function detectNewComponents(prFiles) {
   const labels = new Set();
-  let hasYamlLoadable = false;
   const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
 
   for (const file of addedFiles) {
     const componentMatch = file.match(/^esphome\/components\/([^\/]+)\/__init__\.py$/);
-    if (!componentMatch) continue;
-
-    labels.add('new-component');
-    const content = await fetchPrFileContent(github, context, file);
-    if (content === null) {
-      // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-      hasYamlLoadable = true;
-      continue;
-    }
-    if (content.includes('IS_TARGET_PLATFORM = True')) {
-      labels.add('new-target-platform');
-    }
-    if (CONFIG_SCHEMA_REGEX.test(content)) {
-      hasYamlLoadable = true;
+    if (componentMatch) {
+      try {
+        const content = fs.readFileSync(file, 'utf8');
+        if (content.includes('IS_TARGET_PLATFORM = True')) {
+          labels.add('new-target-platform');
+        }
+      } catch (error) {
+        console.log(`Failed to read content of ${file}:`, error.message);
+      }
+      labels.add('new-component');
     }
   }
 
-  return { labels, hasYamlLoadable };
+  return labels;
 }
 
 // Strategy: New platform detection
-async function detectNewPlatforms(github, context, prFiles, apiData) {
+async function detectNewPlatforms(prFiles, apiData) {
   const labels = new Set();
-  let hasYamlLoadable = false;
   const addedFiles = prFiles.filter(file => file.status === 'added').map(file => file.filename);
 
-  const platformPathPatterns = [
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/,
-    /^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/,
-  ];
-
   for (const file of addedFiles) {
-    for (const re of platformPathPatterns) {
-      const match = file.match(re);
-      if (!match) continue;
-      const platform = match[2];
-      if (!apiData.platformComponents.includes(platform)) break;
+    const platformFileMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\.py$/);
+    if (platformFileMatch) {
+      const [, component, platform] = platformFileMatch;
+      if (apiData.platformComponents.includes(platform)) {
+        labels.add('new-platform');
+      }
+    }
 
-      labels.add('new-platform');
-      const content = await fetchPrFileContent(github, context, file);
-      if (content === null) {
-        // Safe default: assume YAML-loadable so needs-docs behaviour is unchanged on fetch failure
-        hasYamlLoadable = true;
-      } else if (CONFIG_SCHEMA_REGEX.test(content)) {
-        hasYamlLoadable = true;
+    const platformDirMatch = file.match(/^esphome\/components\/([^\/]+)\/([^\/]+)\/__init__\.py$/);
+    if (platformDirMatch) {
+      const [, component, platform] = platformDirMatch;
+      if (apiData.platformComponents.includes(platform)) {
+        labels.add('new-platform');
       }
-      break;
     }
   }
 
-  return { labels, hasYamlLoadable };
+  return labels;
 }
 
 // Strategy: Core files detection
@@ -271,20 +235,19 @@ async function detectDeprecatedComponents(github, context, changedFiles) {
     }
   }
 
-  // Get base branch ref to check if deprecation already exists for the component
-  // This prevents flagging a PR that simply adds deprecation
-  const baseRef = context.payload.pull_request.base.ref;
+  // Get PR head to fetch files from the PR branch
+  const prNumber = context.payload.pull_request.number;
 
   // Check each component's __init__.py for DEPRECATED_COMPONENT constant
   for (const component of components) {
     const initFile = `esphome/components/${component}/__init__.py`;
     try {
-      // Fetch file content from base branch using GitHub API
+      // Fetch file content from PR head using GitHub API
       const { data: fileData } = await github.rest.repos.getContent({
         owner,
         repo,
         path: initFile,
-        ref: baseRef
+        ref: `refs/pull/${prNumber}/head`
       });
 
       // Decode base64 content
@@ -317,26 +280,8 @@ async function detectDeprecatedComponents(github, context, changedFiles) {
   return { labels, deprecatedInfo };
 }
 
-// Strategy: Detect when maintainers cannot modify the PR branch
-function detectMaintainerAccess(context) {
-  const pr = context.payload.pull_request;
-
-  // Only relevant for cross-repo PRs (forks)
-  if (!pr.head.repo || pr.head.repo.full_name === pr.base.repo.full_name) {
-    return null;
-  }
-
-  if (pr.maintainer_can_modify) {
-    return null;
-  }
-
-  const isOrgFork = pr.head.repo.owner.type === 'Organization';
-  console.log(`Maintainer cannot modify PR branch (${isOrgFork ? 'org fork: ' + pr.head.repo.owner.login : 'user disabled'})`);
-  return { isOrgFork, orgName: pr.head.repo.owner.login };
-}
-
 // Strategy: Requirements detection
-async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable) {
+async function detectRequirements(allLabels, prFiles, context) {
   const labels = new Set();
 
   // Check for missing tests
@@ -344,15 +289,8 @@ async function detectRequirements(allLabels, prFiles, context, hasYamlLoadable)
     labels.add('needs-tests');
   }
 
-  // Check for missing docs.
-  // `new-feature` (PR-body checkbox) always counts. `new-component` / `new-platform`
-  // only count when at least one newly added file defines a top-level CONFIG_SCHEMA,
-  // i.e. the new component/platform is actually loadable from YAML.
-  const docsEligible =
-    allLabels.has('new-feature') ||
-    ((allLabels.has('new-component') || allLabels.has('new-platform')) && hasYamlLoadable);
-
-  if (docsEligible) {
+  // Check for missing docs
+  if (allLabels.has('new-component') || allLabels.has('new-platform') || allLabels.has('new-feature')) {
     const prBody = context.payload.pull_request.body || '';
     const hasDocsLink = DOCS_PR_PATTERNS.some(pattern => pattern.test(prBody));
 
@@ -390,6 +328,5 @@ module.exports = {
   detectTests,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
-  detectMaintainerAccess,
   detectRequirements
 };

.github/scripts/auto-label-pr/index.js

@@ -12,10 +12,9 @@ const {
   detectTests,
   detectPRTemplateCheckboxes,
   detectDeprecatedComponents,
-  detectMaintainerAccess,
   detectRequirements
 } = require('./detectors');
-const { handleReviews, handleMaintainerAccessComment } = require('./reviews');
+const { handleReviews } = require('./reviews');
 const { applyLabels, removeOldLabels } = require('./labels');
 
 // Fetch API data
@@ -106,8 +105,8 @@ module.exports = async ({ github, context }) => {
   const [
     branchLabels,
     componentLabels,
-    newComponentResult,
-    newPlatformResult,
+    newComponentLabels,
+    newPlatformLabels,
     coreLabels,
     sizeLabels,
     dashboardLabels,
@@ -115,13 +114,12 @@ module.exports = async ({ github, context }) => {
     codeOwnerLabels,
     testLabels,
     checkboxLabels,
-    deprecatedResult,
-    maintainerAccess
+    deprecatedResult
   ] = await Promise.all([
     detectMergeBranch(context),
     detectComponentPlatforms(changedFiles, apiData),
-    detectNewComponents(github, context, prFiles),
-    detectNewPlatforms(github, context, prFiles, apiData),
+    detectNewComponents(prFiles),
+    detectNewPlatforms(prFiles, apiData),
     detectCoreChanges(changedFiles),
     detectPRSize(prFiles, totalAdditions, totalDeletions, totalChanges, isMegaPR, SMALL_PR_THRESHOLD, MEDIUM_PR_THRESHOLD, TOO_BIG_THRESHOLD),
     detectDashboardChanges(changedFiles),
@@ -129,17 +127,9 @@ module.exports = async ({ github, context }) => {
     detectCodeOwner(github, context, changedFiles),
     detectTests(changedFiles),
     detectPRTemplateCheckboxes(context),
-    detectDeprecatedComponents(github, context, changedFiles),
-    detectMaintainerAccess(context)
+    detectDeprecatedComponents(github, context, changedFiles)
   ]);
 
-  // Extract new-component / new-platform results
-  const newComponentLabels = newComponentResult.labels;
-  const newPlatformLabels = newPlatformResult.labels;
-  // Eligible for needs-docs only if any newly added component or platform file
-  // defines a top-level CONFIG_SCHEMA (i.e. is actually loadable from YAML).
-  const hasYamlLoadable = newComponentResult.hasYamlLoadable || newPlatformResult.hasYamlLoadable;
-
   // Extract deprecated component info
   const deprecatedLabels = deprecatedResult.labels;
   const deprecatedInfo = deprecatedResult.deprecatedInfo;
@@ -161,7 +151,7 @@ module.exports = async ({ github, context }) => {
   ]);
 
   // Detect requirements based on all other labels
-  const requirementLabels = await detectRequirements(allLabels, prFiles, context, hasYamlLoadable);
+  const requirementLabels = await detectRequirements(allLabels, prFiles, context);
   for (const label of requirementLabels) {
     allLabels.add(label);
   }
@@ -187,11 +177,8 @@ module.exports = async ({ github, context }) => {
 
   console.log('Computed labels:', finalLabels.join(', '));
 
-  // Handle reviews and org fork comment
-  await Promise.all([
-    handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD),
-    handleMaintainerAccessComment(github, context, maintainerAccess)
-  ]);
+  // Handle reviews
+  await handleReviews(github, context, finalLabels, originalLabelCount, deprecatedInfo, prFiles, totalAdditions, totalDeletions, MAX_LABELS, TOO_BIG_THRESHOLD);
 
   // Apply labels
   await applyLabels(github, context, finalLabels);

.github/scripts/auto-label-pr/reviews.js

@@ -2,8 +2,7 @@ const {
   BOT_COMMENT_MARKER,
   CODEOWNERS_MARKER,
   TOO_BIG_MARKER,
-  DEPRECATED_COMPONENT_MARKER,
-  ORG_FORK_MARKER
+  DEPRECATED_COMPONENT_MARKER
 } = require('./constants');
 
 // Generate review messages
@@ -41,36 +40,16 @@ function generateReviewMessages(finalLabels, originalLabelCount, deprecatedInfo,
 
     let message = `${TOO_BIG_MARKER}\n### 📦 Pull Request Size\n\n`;
 
-    message +=
-      `Hey @${prAuthor}, thanks for the contribution! Just a heads up, ` +
-      `this PR is on the large side `;
-
     if (tooManyLabels && tooManyChanges) {
-      message +=
-        `(${nonTestChanges} line changes excluding tests, across ` +
-        `${originalLabelCount} different components/areas)`;
+      message += `This PR is too large with ${nonTestChanges} line changes (excluding tests) and affects ${originalLabelCount} different components/areas.`;
     } else if (tooManyLabels) {
-      message +=
-        `(it touches ${originalLabelCount} different components/areas)`;
+      message += `This PR affects ${originalLabelCount} different components/areas.`;
     } else {
-      message += `(${nonTestChanges} line changes excluding tests)`;
+      message += `This PR is too large with ${nonTestChanges} line changes (excluding tests).`;
     }
 
-    message += `, which makes it harder for maintainers to review.\n\n`;
-    message +=
-      `Smaller, focused PRs tend to be reviewed much faster since they ` +
-      `fit into the short gaps between other maintainer work; large ones ` +
-      `often have to wait for a rare long uninterrupted block of time. ` +
-      `If you can break this up into smaller pieces that can be reviewed ` +
-      `independently, it will almost certainly land faster overall.\n\n`;
-    message +=
-      `Before putting more time in, it's also worth popping into ` +
-      `\`#devs\` on [Discord](https://esphome.io/chat) so we can help ` +
-      `you scope things and flag anything already in flight.\n\n`;
-    message +=
-      `For more details (including how to split the work up), see: ` +
-      `https://developers.esphome.io/contributing/submitting-your-work/` +
-      `#how-to-approach-large-submissions`;
+    message += ` Please consider breaking it down into smaller, focused PRs to make review easier and reduce the risk of conflicts.\n\n`;
+    message += `For guidance on breaking down large PRs, see: https://developers.esphome.io/contributing/submitting-your-work/#how-to-approach-large-submissions`;
 
     messages.push(message);
   }
@@ -157,63 +136,6 @@ async function handleReviews(github, context, finalLabels, originalLabelCount, d
   }
 }
 
-// Handle maintainer access warning comment
-async function handleMaintainerAccessComment(github, context, maintainerAccess) {
-  if (!maintainerAccess) {
-    return;
-  }
-
-  const { owner, repo } = context.repo;
-  const pr_number = context.issue.number;
-  const prAuthor = context.payload.pull_request.user.login;
-
-  // Check if we already posted the warning (iterate pages to exit early)
-  let existingComment;
-  for await (const { data: comments } of github.paginate.iterator(
-    github.rest.issues.listComments,
-    { owner, repo, issue_number: pr_number }
-  )) {
-    existingComment = comments.find(comment =>
-      comment.user.type === 'Bot' &&
-      comment.body && comment.body.includes(ORG_FORK_MARKER)
-    );
-    if (existingComment) {
-      break;
-    }
-  }
-
-  if (existingComment) {
-    console.log('Maintainer access warning comment already exists, skipping');
-    return;
-  }
-
-  let body;
-  if (maintainerAccess.isOrgFork) {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Organization Fork Detected\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR was submitted from a fork owned by the **${maintainerAccess.orgName}** organization. ` +
-      `GitHub does not allow maintainers to push changes to pull request branches when the fork is owned by an organization. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `To allow maintainer collaboration, please re-submit this PR from a personal fork instead.\n\n` +
-      `See: [Setting up the local repository](https://developers.esphome.io/contributing/development-environment/?h=org#set-up-the-local-repository) for more details.`;
-  } else {
-    body = `${ORG_FORK_MARKER}\n### ⚠️ Maintainer Access Disabled\n\n` +
-      `Hey there @${prAuthor},\n` +
-      `It looks like this PR does not have the "Allow edits from maintainers" option enabled. ` +
-      `This means we won't be able to make small adjustments or fixups to your PR directly.\n\n` +
-      `Please enable this option in the PR sidebar to allow maintainer collaboration.`;
-  }
-
-  await github.rest.issues.createComment({
-    owner,
-    repo,
-    issue_number: pr_number,
-    body
-  });
-  console.log('Created maintainer access warning comment');
-}
-
 module.exports = {
-  handleReviews,
-  handleMaintainerAccessComment
+  handleReviews
 };

.github/workflows/auto-label-pr.yml

@@ -6,10 +6,9 @@ on:
   pull_request_target:
     types: [labeled, opened, reopened, synchronize, edited]
 
-# All PR/label/review writes are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  contents: read  # actions/checkout reads the workflow source
+  pull-requests: write
+  contents: read
 
 env:
   SMALL_PR_THRESHOLD: 30
@@ -21,24 +20,20 @@ env:
 jobs:
   label:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.state == 'open' && (github.event.action != 'labeled' || github.event.sender.type != 'Bot')
+    if: github.event.action != 'labeled' || github.event.sender.type != 'Bot'
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v2
         with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by auto-label-pr/*.js.
-          permission-contents: read       # repos.getContent for CODEOWNERS and file lookups in detectors.js
-          permission-issues: write        # listLabelsOnIssue, addLabels, removeLabel, list/createComment
-          permission-pull-requests: write  # pulls.listFiles, list/create/update/dismissReview
 
       - name: Auto Label PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |

.github/workflows/ci-api-proto.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-api-proto.yml"
 
 permissions:
-  contents: read        # actions/checkout for the PR head
-  pull-requests: write  # pulls.createReview / listReviews / dismissReview when generated proto files are stale
+  contents: read
+  pull-requests: write
 
 jobs:
   check:
@@ -47,7 +47,7 @@ jobs:
           fi
       - if: failure()
         name: Review PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -62,7 +62,7 @@ jobs:
         run: git diff
       - if: failure()
         name: Archive artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: generated-proto-files
           path: |
@@ -70,7 +70,7 @@ jobs:
             esphome/components/api/api_pb2_service.*
       - if: success()
         name: Dismiss review
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({

.github/workflows/ci-clang-tidy-hash.yml

@@ -12,8 +12,8 @@ on:
       - ".github/workflows/ci-clang-tidy-hash.yml"
 
 permissions:
-  contents: read        # actions/checkout for the PR head
-  pull-requests: write  # pulls.createReview / listReviews / dismissReview when the clang-tidy hash is out of date
+  contents: read
+  pull-requests: write
 
 jobs:
   verify-hash:
@@ -42,7 +42,7 @@ jobs:
 
       - if: failure() && github.event.pull_request.head.repo.full_name == github.repository
         name: Request changes
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             await github.rest.pulls.createReview({
@@ -55,7 +55,7 @@ jobs:
 
       - if: success() && github.event.pull_request.head.repo.full_name == github.repository
         name: Dismiss review
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             let reviews = await github.rest.pulls.listReviews({

.github/workflows/ci-docker.yml

@@ -22,7 +22,8 @@ on:
       - "script/platformio_install_deps.py"
 
 permissions:
-  contents: read  # actions/checkout only; the build does not push images
+  contents: read
+  packages: read
 
 concurrency:
   # yamllint disable-line rule:line-length

.github/workflows/ci-memory-impact-comment.yml

@@ -7,9 +7,9 @@ on:
     types: [completed]
 
 permissions:
-  contents: read        # actions/checkout of the base repo at the PR's target branch
-  pull-requests: write  # gh api to look up the PR by head SHA and post/update the memory-impact comment
-  actions: read         # gh run download for the memory-analysis artifacts produced by the CI workflow run
+  contents: read
+  pull-requests: write
+  actions: read
 
 jobs:
   memory-impact-comment:

.github/workflows/ci.yml

@@ -17,7 +17,7 @@ on:
   merge_group:
 
 permissions:
-  contents: read  # actions/checkout for all jobs; individual jobs add their own scopes when they need to write
+  contents: read
 
 env:
   DEFAULT_PYTHON: "3.11"
@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Generate cache-key
         id: cache-key
-        run: echo key="${{ hashFiles('requirements.txt', 'requirements_dev.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
+        run: echo key="${{ hashFiles('requirements.txt', 'requirements_test.txt', '.pre-commit-config.yaml') }}" >> $GITHUB_OUTPUT
       - name: Set up Python ${{ env.DEFAULT_PYTHON }}
         id: python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -47,7 +47,7 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
       - name: Restore Python virtual environment
         id: cache-venv
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: venv
           # yamllint disable-line rule:line-length
@@ -58,7 +58,7 @@ jobs:
           python -m venv venv
           . venv/bin/activate
           python --version
-          pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt pre-commit
+          pip install -r requirements.txt -r requirements_test.txt pre-commit
           pip install -e .
 
   pylint:
@@ -108,81 +108,6 @@ jobs:
           script/generate-esp32-boards.py --check
           script/generate-rp2040-boards.py --check
 
-  import-time:
-    name: Check import esphome.__main__ time
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.import-time == 'true'
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-      - name: Check import time against budget and write waterfall HAR
-        run: |
-          . venv/bin/activate
-          script/check_import_time.py --check --har importtime.har
-      - name: Upload waterfall HAR
-        if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: import-time-waterfall
-          path: importtime.har
-          if-no-files-found: ignore
-          retention-days: 14
-
-  device-builder:
-    name: Test downstream esphome/device-builder
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: needs.determine-jobs.outputs.device-builder == 'true'
-    steps:
-      - name: Check out esphome (this PR)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          path: esphome
-      - name: Check out esphome/device-builder
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: esphome/device-builder
-          ref: main
-          path: device-builder
-      - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: "3.13"
-      - name: Set up uv
-        # Mirrors the install shape device-builder's own CI uses
-        # (esphome/device-builder#192): uv replaces pip for the
-        # install step (order-of-magnitude faster on cold boots,
-        # with its own wheel cache). actions/setup-python still
-        # provides the interpreter.
-        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
-        with:
-          enable-cache: true
-      - name: Install device-builder + esphome from PR
-        # Install device-builder with its esphome + test extras
-        # first so its pinned versions of pytest/etc. land, then
-        # overlay the PR's esphome so the downstream tests run
-        # against this PR's Python code. ``--system`` installs into
-        # the runner's Python instead of a venv.
-        run: |
-          uv pip install --system -e './device-builder[esphome,test]'
-          uv pip install --system -e ./esphome
-      - name: Run device-builder pytest
-        # ``-n auto`` runs under pytest-xdist (matches device-builder's
-        # own CI). No ``--cov`` here -- this is purely a downstream
-        # smoke check against this PR's esphome code.
-        working-directory: device-builder
-        run: pytest -q -n auto --maxfail=5 --durations=10 --no-cov --ignore=tests/benchmarks
-
   pytest:
     name: Run pytest
     strategy:
@@ -234,7 +159,7 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
       - name: Save Python virtual environment cache
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: venv
           key: ${{ runner.os }}-${{ steps.restore-python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
@@ -246,12 +171,11 @@ jobs:
       - common
     outputs:
       integration-tests: ${{ steps.determine.outputs.integration-tests }}
-      integration-test-buckets: ${{ steps.determine.outputs.integration-test-buckets }}
+      integration-tests-run-all: ${{ steps.determine.outputs.integration-tests-run-all }}
+      integration-test-files: ${{ steps.determine.outputs.integration-test-files }}
       clang-tidy: ${{ steps.determine.outputs.clang-tidy }}
       clang-tidy-mode: ${{ steps.determine.outputs.clang-tidy-mode }}
       python-linters: ${{ steps.determine.outputs.python-linters }}
-      import-time: ${{ steps.determine.outputs.import-time }}
-      device-builder: ${{ steps.determine.outputs.device-builder }}
       changed-components: ${{ steps.determine.outputs.changed-components }}
       changed-components-with-tests: ${{ steps.determine.outputs.changed-components-with-tests }}
       directly-changed-components-with-tests: ${{ steps.determine.outputs.directly-changed-components-with-tests }}
@@ -274,7 +198,7 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
       - name: Restore components graph cache
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
@@ -290,12 +214,11 @@ jobs:
 
           # Extract individual fields
           echo "integration-tests=$(echo "$output" | jq -r '.integration_tests')" >> $GITHUB_OUTPUT
-          echo "integration-test-buckets=$(echo "$output" | jq -c '.integration_test_buckets')" >> $GITHUB_OUTPUT
+          echo "integration-tests-run-all=$(echo "$output" | jq -r '.integration_tests_run_all')" >> $GITHUB_OUTPUT
+          echo "integration-test-files=$(echo "$output" | jq -c '.integration_test_files')" >> $GITHUB_OUTPUT
           echo "clang-tidy=$(echo "$output" | jq -r '.clang_tidy')" >> $GITHUB_OUTPUT
           echo "clang-tidy-mode=$(echo "$output" | jq -r '.clang_tidy_mode')" >> $GITHUB_OUTPUT
           echo "python-linters=$(echo "$output" | jq -r '.python_linters')" >> $GITHUB_OUTPUT
-          echo "import-time=$(echo "$output" | jq -r '.import_time')" >> $GITHUB_OUTPUT
-          echo "device-builder=$(echo "$output" | jq -r '.device_builder')" >> $GITHUB_OUTPUT
           echo "changed-components=$(echo "$output" | jq -c '.changed_components')" >> $GITHUB_OUTPUT
           echo "changed-components-with-tests=$(echo "$output" | jq -c '.changed_components_with_tests')" >> $GITHUB_OUTPUT
           echo "directly-changed-components-with-tests=$(echo "$output" | jq -c '.directly_changed_components_with_tests')" >> $GITHUB_OUTPUT
@@ -308,22 +231,18 @@ jobs:
           echo "benchmarks=$(echo "$output" | jq -r '.benchmarks')" >> $GITHUB_OUTPUT
       - name: Save components graph cache
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .temp/components_graph.json
           key: components-graph-${{ hashFiles('esphome/components/**/*.py') }}
 
   integration-tests:
-    name: Run integration tests (${{ matrix.bucket.name }})
+    name: Run integration tests
     runs-on: ubuntu-latest
     needs:
       - common
       - determine-jobs
     if: needs.determine-jobs.outputs.integration-tests == 'true'
-    strategy:
-      fail-fast: false
-      matrix:
-        bucket: ${{ fromJson(needs.determine-jobs.outputs.integration-test-buckets) }}
     steps:
       - name: Check out code from GitHub
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -334,7 +253,7 @@ jobs:
           python-version: "3.13"
       - name: Restore Python virtual environment
         id: cache-venv
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: venv
           key: ${{ runner.os }}-${{ steps.python.outputs.python-version }}-venv-${{ needs.common.outputs.cache-key }}
@@ -350,14 +269,19 @@ jobs:
         run: echo "::add-matcher::.github/workflows/matchers/pytest.json"
       - name: Run integration tests
         env:
-          # JSON array of test paths; parsed into a bash array below to avoid
-          # shell word-splitting / glob hazards.
-          BUCKET_TESTS: ${{ toJson(matrix.bucket.tests) }}
+          INTEGRATION_TEST_FILES: ${{ needs.determine-jobs.outputs.integration-test-files }}
+          INTEGRATION_TESTS_RUN_ALL: ${{ needs.determine-jobs.outputs.integration-tests-run-all }}
         run: |
           . venv/bin/activate
-          mapfile -t test_files < <(echo "$BUCKET_TESTS" | jq -r '.[]')
-          echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
-          pytest -vv --no-cov --tb=native -n auto "${test_files[@]}"
+          if [[ "$INTEGRATION_TESTS_RUN_ALL" == "true" ]]; then
+            echo "Running all integration tests"
+            pytest -vv --no-cov --tb=native -n auto tests/integration/
+          else
+            # Parse JSON array into bash array to avoid shell expansion issues
+            mapfile -t test_files < <(echo "$INTEGRATION_TEST_FILES" | jq -r '.[]')
+            echo "Running ${#test_files[@]} specific integration tests"
+            pytest -vv --no-cov --tb=native -n auto "${test_files[@]}"
+          fi
 
   cpp-unit-tests:
     name: Run C++ unit tests
@@ -415,7 +339,7 @@ jobs:
           echo "binary=$BINARY" >> $GITHUB_OUTPUT
 
       - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@3194d9a39c4d46684cb44bf7207fc56626aad8fd # v4.15.1
+        uses: CodSpeedHQ/action@d872884a306dd4853acf0f584f4b706cf0cc72a2 # v4
         with:
           run: ${{ steps.build.outputs.binary }}
           mode: simulation
@@ -463,14 +387,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
@@ -542,14 +466,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
@@ -631,14 +555,14 @@ jobs:
 
       - name: Cache platformio
         if: github.ref == 'refs/heads/dev'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
 
       - name: Cache platformio
         if: github.ref != 'refs/heads/dev'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-tidyesp32-${{ hashFiles('platformio.ini') }}
@@ -783,91 +707,6 @@ jobs:
           # Run compilation with grouping and isolation
           python3 script/test_build_components.py -e compile -c "$components_csv" -f --isolate "$directly_changed_csv"
 
-  test-native-idf:
-    name: Test components with native ESP-IDF
-    runs-on: ubuntu-24.04
-    needs:
-      - common
-      - determine-jobs
-    if: github.event_name == 'pull_request'
-    env:
-      ESPHOME_ESP_IDF_PREFIX: ~/.esphome-idf
-      TEST_COMPONENTS: esp32,api,heatpumpir,bme280_i2c,bh1750,aht10,esp32_ble,esp32_ble_beacon,esp32_ble_client,esp32_ble_server,esp32_ble_tracker,ble_client,ble_presence,ble_rssi,ble_scanner
-    steps:
-      - name: Check out code from GitHub
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - name: Restore Python
-        uses: ./.github/actions/restore-python
-        with:
-          python-version: ${{ env.DEFAULT_PYTHON }}
-          cache-key: ${{ needs.common.outputs.cache-key }}
-
-      - name: Cache ESPHome
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-        with:
-          path: ~/.esphome-idf
-          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
-
-      - name: Run native ESP-IDF compile test
-        run: |
-          . venv/bin/activate
-
-          # Check if /mnt has more free space than / before bind mounting
-          # Extract available space in KB for comparison
-          root_avail=$(df -k / | awk 'NR==2 {print $4}')
-          mnt_avail=$(df -k /mnt 2>/dev/null | awk 'NR==2 {print $4}')
-
-          echo "Available space: / has ${root_avail}KB, /mnt has ${mnt_avail}KB"
-
-          # Only use /mnt if it has more space than /
-          if [ -n "$mnt_avail" ] && [ "$mnt_avail" -gt "$root_avail" ]; then
-            echo "Using /mnt for build files (more space available)"
-            # Bind mount PlatformIO directory to /mnt (tools, packages, build cache all go there)
-            sudo mkdir -p /mnt/esphome-idf
-            sudo chown $USER:$USER /mnt/esphome-idf
-            mkdir -p ~/.esphome-idf
-            sudo mount --bind /mnt/esphome-idf ~/.esphome-idf
-
-            # Bind mount test build directory to /mnt
-            sudo mkdir -p /mnt/test_build_components_build
-            sudo chown $USER:$USER /mnt/test_build_components_build
-            mkdir -p tests/test_build_components/build
-            sudo mount --bind /mnt/test_build_components_build tests/test_build_components/build
-          else
-            echo "Using / for build files (more space available than /mnt or /mnt unavailable)"
-          fi
-
-          echo "Testing components: $TEST_COMPONENTS"
-          echo ""
-
-          # Show disk space before validation (after bind mounts setup)
-          echo "Disk space before config validation:"
-          df -h
-          echo ""
-
-          # Run config validation (auto-grouped by test_build_components.py)
-          python3 script/test_build_components.py -e config -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
-
-          echo ""
-          echo "Config validation passed! Starting compilation..."
-          echo ""
-
-          # Show disk space before compilation
-          echo "Disk space before compilation:"
-          df -h
-          echo ""
-
-          # Run compilation (auto-grouped by test_build_components.py)
-          python3 script/test_build_components.py -e compile -t esp32-idf -c "$TEST_COMPONENTS" -f --toolchain esp-idf
-
-      - name: Save ESPHome cache
-        if: github.ref == 'refs/heads/dev'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-        with:
-          path: ~/.esphome-idf
-          key: ${{ runner.os }}-esphome-${{ needs.common.outputs.cache-key }}
-
   pre-commit-ci-lite:
     name: pre-commit.ci lite
     runs-on: ubuntu-latest
@@ -884,7 +723,7 @@ jobs:
           cache-key: ${{ needs.common.outputs.cache-key }}
       - uses: esphome/pre-commit-action@43cd1109c09c544d97196f7730ee5b2e0cc6d81e # v3.0.1 fork with pinned actions/cache
         env:
-          SKIP: pylint,clang-tidy-hash,ci-custom
+          SKIP: pylint,clang-tidy-hash
       - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
         if: always()
 
@@ -978,7 +817,7 @@ jobs:
       - name: Restore cached memory analysis
         id: cache-memory-analysis
         if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: memory-analysis-target.json
           key: ${{ steps.cache-key.outputs.cache-key }}
@@ -1002,7 +841,7 @@ jobs:
 
       - name: Cache platformio
         if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true'
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
@@ -1029,8 +868,7 @@ jobs:
           python script/test_build_components.py \
             -e compile \
             -c "$component_list" \
-            -t "$platform" \
-            --base-only 2>&1 | \
+            -t "$platform" 2>&1 | \
             tee /dev/stderr | \
             python script/ci_memory_impact_extract.py \
               --output-env \
@@ -1044,7 +882,7 @@ jobs:
 
       - name: Save memory analysis to cache
         if: steps.check-script.outputs.skip != 'true' && steps.check-tests.outputs.skip != 'true' && steps.cache-memory-analysis.outputs.cache-hit != 'true' && steps.build.outcome == 'success'
-        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: memory-analysis-target.json
           key: ${{ steps.cache-key.outputs.cache-key }}
@@ -1065,7 +903,7 @@ jobs:
           fi
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: memory-analysis-target
           path: memory-analysis-target.json
@@ -1091,7 +929,7 @@ jobs:
           python-version: ${{ env.DEFAULT_PYTHON }}
           cache-key: ${{ needs.common.outputs.cache-key }}
       - name: Cache platformio
-        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: ~/.platformio
           key: platformio-memory-${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}-${{ hashFiles('platformio.ini') }}
@@ -1116,8 +954,7 @@ jobs:
           python script/test_build_components.py \
             -e compile \
             -c "$component_list" \
-            -t "$platform" \
-            --base-only 2>&1 | \
+            -t "$platform" 2>&1 | \
             tee /dev/stderr | \
             python script/ci_memory_impact_extract.py \
               --output-env \
@@ -1130,7 +967,7 @@ jobs:
             --platform "$platform"
 
       - name: Upload memory analysis JSON
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: memory-analysis-pr
           path: memory-analysis-pr.json
@@ -1147,8 +984,8 @@ jobs:
       - memory-impact-pr-branch
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && fromJSON(needs.determine-jobs.outputs.memory_impact).should_run == 'true' && needs.memory-impact-target-branch.outputs.skip != 'true'
     permissions:
-      contents: read        # actions/checkout to load the comment-posting script
-      pull-requests: write  # ci_memory_impact_comment.py posts/updates the memory-impact comment on the PR
+      contents: read
+      pull-requests: write
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
@@ -1197,9 +1034,7 @@ jobs:
       - clang-tidy-nosplit
       - clang-tidy-split
       - determine-jobs
-      - device-builder
       - test-build-components-split
-      - test-native-idf
       - pre-commit-ci-lite
       - memory-impact-target-branch
       - memory-impact-pr-branch

.github/workflows/close-pr-from-fork-default-branch.yml

@@ -1,72 +0,0 @@
-name: Close PR From Fork Default Branch
-
-on:
-  # pull_request_target is required so we have permission to comment and close PRs from forks.
-  pull_request_target:
-    types: [opened, reopened]
-
-permissions:
-  pull-requests: write  # pulls.update to close the PR opened from a fork's default branch
-  issues: write         # issues.createComment to explain to the contributor why the PR was closed
-
-jobs:
-  close:
-    name: Close PR opened from fork's default branch
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
-      && github.event.pull_request.head.ref == github.event.repository.default_branch
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { owner, repo } = context.repo;
-            const prNumber = context.payload.pull_request.number;
-            const author = context.payload.pull_request.user.login;
-            const defaultBranch = context.payload.repository.default_branch;
-            const headRepo = context.payload.pull_request.head.repo.full_name;
-
-            const body = [
-              `Hi @${author}, thanks for opening a pull request! :tada:`,
-              ``,
-              `It looks like this PR was opened from the \`${defaultBranch}\` branch of your fork (\`${headRepo}\`), which is the same name as this repository's default branch. Working directly on \`${defaultBranch}\` in your fork causes a few problems:`,
-              ``,
-              `- Your fork's \`${defaultBranch}\` branch will permanently diverge from \`esphome/esphome:${defaultBranch}\`, making it hard to keep your fork up to date.`,
-              `- Any additional commits you push to \`${defaultBranch}\` will be added to this PR, so you can't easily work on multiple changes at once.`,
-              `- Pushing maintainer fixes to your branch is awkward, since it means committing directly to your fork's default branch.`,
-              `- It makes local collaboration painful — \`${defaultBranch}\` in a checkout becomes ambiguous between upstream and your fork, and maintainers end up with naming collisions when fetching your branch.`,
-              ``,
-              `Please re-open this as a new PR from a dedicated feature branch. The usual flow looks like:`,
-              ``,
-              `\`\`\`bash`,
-              `# Make sure your fork's ${defaultBranch} is up to date with upstream`,
-              `git remote add upstream https://github.com/${owner}/${repo}.git  # if you haven't already`,
-              `git fetch upstream`,
-              `git checkout ${defaultBranch}`,
-              `git reset --hard upstream/${defaultBranch}`,
-              `git push --force-with-lease origin ${defaultBranch}`,
-              ``,
-              `# Create a new branch for your change and cherry-pick / re-apply your commits there`,
-              `git checkout -b my-feature-branch upstream/${defaultBranch}`,
-              `# ...re-apply your changes, then:`,
-              `git push origin my-feature-branch`,
-              `\`\`\``,
-              ``,
-              `Then open a new pull request from \`my-feature-branch\` into \`${owner}/${repo}:${defaultBranch}\`.`,
-              ``,
-              `Closing this PR for now — sorry for the friction, and thanks again for contributing! :heart:`,
-            ].join('\n');
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body,
-            });
-
-            await github.rest.pulls.update({
-              owner,
-              repo,
-              pull_number: prNumber,
-              state: 'closed',
-            });

.github/workflows/codeowner-approved-label-update.yml

@@ -15,9 +15,9 @@ on:
       - beta
 
 permissions:
-  issues: write       # issues.addLabels / removeLabel to manage the 'code-owner-approved' label on the PR
-  pull-requests: read  # listReviews to determine whether a codeowner has approved
-  contents: read       # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+  issues: write
+  pull-requests: read
+  contents: read
 
 jobs:
   codeowner-approved:
@@ -34,7 +34,7 @@ jobs:
             CODEOWNERS
 
       - name: Check codeowner approval and update label
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         with:

.github/workflows/codeowner-review-request.yml

@@ -17,10 +17,9 @@ on:
       - release
       - beta
 
-# PR/review writes (requestReviewers, issues.createComment) are performed with the App token minted below,
-# so the workflow's GITHUB_TOKEN only needs read access for checkout.
 permissions:
-  contents: read  # actions/checkout to read CODEOWNERS and the shared codeowners.js helper
+  pull-requests: write
+  contents: read
 
 jobs:
   request-codeowner-reviews:
@@ -33,20 +32,9 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by the github-script step below.
-          permission-pull-requests: write  # pulls.listFiles, pulls.get, pulls.listReviews, pulls.requestReviewers
-          permission-issues: write         # issues.listComments and issues.createComment (PR comments use the issues API)
-
       - name: Request reviews from component codeowners
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
           script: |
             const { loadCodeowners, getEffectiveOwners } = require('./.github/scripts/codeowners.js');
 

.github/workflows/codeql.yml

@@ -16,9 +16,6 @@ on:
   schedule:
     - cron: "30 18 * * 4"
 
-# Deny by default; the analyze job opts in to exactly what it needs.
-permissions: {}
-
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -29,10 +26,15 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      security-events: write  # upload CodeQL SARIF results to the Code Scanning API
-      packages: read          # fetch internal or private CodeQL query packs
-      actions: read           # required by codeql-action when run from a private repo
-      contents: read          # actions/checkout to scan the repository
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
 
     strategy:
       fail-fast: false
@@ -56,7 +58,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -84,6 +86,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/external-component-bot.yml

@@ -4,29 +4,20 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
-# All API calls (pulls.listFiles + issues.{list,create,update}Comment) are performed with
-# the App token minted below, so the workflow's GITHUB_TOKEN does not need any scopes.
-permissions: {}
+permissions:
+  contents: read       #  Needed to fetch PR details
+  issues: write        #  Needed to create and update comments (PR comments are managed via the issues REST API)
+  pull-requests: write  # also needed?
 
 jobs:
   external-comment:
     name: External component comment
     runs-on: ubuntu-latest
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # pulls.listFiles + issues.{list,create,update}Comment on PRs. For PR resources
-          # the issues.*Comment APIs require the pull-requests scope, not issues.
-          permission-pull-requests: write
-
       - name: Add external component comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
-          github-token: ${{ steps.generate-token.outputs.token }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
             // Generate external component usage instructions
             function generateExternalComponentInstructions(prNumber, componentNames, owner, repo) {

.github/workflows/issue-codeowner-notify.yml

@@ -9,8 +9,8 @@ on:
     types: [labeled]
 
 permissions:
-  issues: write   # issues.createComment to mention component codeowners on the newly labelled issue
-  contents: read  # repos.getContent to fetch CODEOWNERS from the default branch
+  issues: write
+  contents: read
 
 jobs:
   notify-codeowners:
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Notify codeowners for component issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const owner = context.repo.owner;

.github/workflows/lock.yml

@@ -6,12 +6,6 @@ on:
     - cron: "30 0 * * *"  # Run daily at 00:30 UTC
   workflow_dispatch:
 
-# Deny by default; the lock job opts in to exactly what the reusable workflow needs.
-permissions: {}
-
 jobs:
   lock:
-    permissions:
-      issues: write         # issues.lock on closed issues
-      pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@025a1e6255610c498ed590403b7e510b69e474df  # 2026.4.1
+    uses: esphome/workflows/.github/workflows/lock.yml@main

.github/workflows/pr-title-check.yml

@@ -3,13 +3,10 @@ name: PR Title Check
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
-    branches-ignore:
-      - release
-      - beta
 
 permissions:
-  contents: read       # actions/checkout to load detect-tags.js
-  pull-requests: read  # pulls.listFiles to map changed files to component/core/dashboard/ci tags
+  contents: read
+  pull-requests: read
 
 jobs:
   check:
@@ -18,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const {

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
     - cron: "0 2 * * *"
 
 permissions:
-  contents: read  # actions/checkout for all jobs; deploy jobs add their own scopes when they need to write
+  contents: read
 
 jobs:
   init:
@@ -57,8 +57,8 @@ jobs:
     if: github.repository == 'esphome/esphome' && github.event_name == 'release'
     runs-on: ubuntu-latest
     permissions:
-      contents: read   # actions/checkout to build the sdist/wheel
-      id-token: write  # OIDC token for PyPI Trusted Publishing (pypa/gh-action-pypi-publish)
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Python
@@ -70,7 +70,7 @@ jobs:
           pip3 install build
           python3 -m build
       - name: Publish
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           skip-existing: true
 
@@ -78,8 +78,8 @@ jobs:
     name: Build ESPHome ${{ matrix.platform.arch }}
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
+      contents: read
+      packages: write
     runs-on: ${{ matrix.platform.os }}
     needs: [init]
     strategy:
@@ -102,12 +102,12 @@ jobs:
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Log in to docker hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -138,7 +138,7 @@ jobs:
       #     version: ${{ needs.init.outputs.tag }}
 
       - name: Upload digests
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: digests-${{ matrix.platform.arch }}
           path: /tmp/digests
@@ -152,8 +152,8 @@ jobs:
       - deploy-docker
     if: github.repository == 'esphome/esphome'
     permissions:
-      contents: read   # actions/checkout to load Dockerfile and build context
-      packages: write  # docker/login-action + build-push-action push image digests to ghcr.io
+      contents: read
+      packages: write
     strategy:
       fail-fast: false
       matrix:
@@ -182,13 +182,13 @@ jobs:
 
       - name: Log in to docker hub
         if: matrix.registry == 'dockerhub'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Log in to the GitHub container registry
         if: matrix.registry == 'ghcr'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -221,16 +221,15 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: home-assistant-addon
-          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
@@ -257,16 +256,15 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: esphome-schema
-          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |
@@ -289,16 +287,15 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
         with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
+          app-id: ${{ secrets.ESPHOME_GITHUB_APP_ID }}
           private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
           owner: esphome
           repositories: version-notifier
-          permission-actions: write  # actions.createWorkflowDispatch on the target repo (only API call made with this token)
 
       - name: Trigger Workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           github-token: ${{ steps.generate-token.outputs.token }}
           script: |

.github/workflows/stale.yml

@@ -7,8 +7,8 @@ on:
   workflow_dispatch:
 
 permissions:
-  issues: write         # actions/stale labels, comments on, and closes stale issues
-  pull-requests: write  # actions/stale labels, comments on, and closes stale pull requests
+  issues: write
+  pull-requests: write
 
 concurrency:
   group: lock

.github/workflows/status-check-labels.yml

@@ -2,32 +2,30 @@ name: Status check labels
 
 on:
   pull_request:
-    types: [opened, reopened, labeled, unlabeled, synchronize]
-
-permissions:
-  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, merge-after-release, chained-pr)
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
+    types: [labeled, unlabeled]
 
 jobs:
   check:
-    name: Check blocking labels
+    name: Check ${{ matrix.label }}
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        label:
+          - needs-docs
+          - merge-after-release
+          - chained-pr
     steps:
-      - name: Check for blocking labels
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      - name: Check for ${{ matrix.label }} label
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
-            const blockingLabels = ['needs-docs', 'merge-after-release', 'chained-pr'];
             const { data: labels } = await github.rest.issues.listLabelsOnIssue({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.issue.number
             });
-            const labelNames = labels.map(l => l.name);
-            const found = blockingLabels.filter(bl => labelNames.includes(bl));
-            if (found.length > 0) {
-              core.setFailed(`Pull request cannot be merged, it has blocking label(s): ${found.join(', ')}`);
+            const hasLabel = labels.find(label => label.name === '${{ matrix.label }}');
+            if (hasLabel) {
+              core.setFailed('Pull request cannot be merged, it is labeled as ${{ matrix.label }}');
             }

.github/workflows/sync-device-classes.yml

@@ -6,27 +6,12 @@ on:
   schedule:
     - cron: "45 6 * * *"
 
-# Repo writes (branch push, PR open) happen via the App token minted below,
-# so the workflow's GITHUB_TOKEN does not need any write scopes.
-permissions:
-  contents: read  # actions/checkout for this repo and home-assistant/core
-
 jobs:
   sync:
     name: Sync Device Classes
     runs-on: ubuntu-latest
     if: github.repository == 'esphome/esphome'
     steps:
-      - name: Generate a token
-        id: generate-token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        with:
-          client-id: ${{ vars.ESPHOME_GITHUB_APP_CLIENT_ID }}
-          private-key: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
-          # Scope the minted App token to the minimum needed by peter-evans/create-pull-request.
-          permission-contents: write       # git.createCommit + refs.create/update to push the sync/device-classes branch
-          permission-pull-requests: write  # pulls.create / pulls.update to open or refresh the sync PR
-
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -56,7 +41,7 @@ jobs:
           python script/run-in-env.py pre-commit run --all-files
 
       - name: Commit changes
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           commit-message: "Synchronise Device Classes from Home Assistant"
           committer: esphomebot <esphome@openhomefoundation.org>
@@ -65,4 +50,4 @@ jobs:
           delete-branch: true
           title: "Synchronise Device Classes from Home Assistant"
           body-path: .github/PULL_REQUEST_TEMPLATE.md
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.DEVICE_CLASS_SYNC_TOKEN }}

.gitignore

@@ -146,6 +146,5 @@ sdkconfig.*
 
 /components
 /managed_components
-/dependencies.lock
 
 api-docs/

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ ci:
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: v0.15.12
+    rev: v0.15.8
     hooks:
       # Run the linter.
       - id: ruff
@@ -55,10 +55,9 @@ repos:
     hooks:
       - id: pylint
         name: pylint
-        entry: python script/run-in-env.py pylint
+        entry: python3 script/run-in-env.py pylint
         language: system
         types: [python]
-        files: ^esphome/.+\.py$
       - id: clang-tidy-hash
         name: Update clang-tidy hash
         entry: python script/clang_tidy_hash.py --update-if-changed
@@ -66,7 +65,3 @@ repos:
         files: ^(\.clang-tidy|platformio\.ini|requirements_dev\.txt)$
         pass_filenames: false
         additional_dependencies: []
-      - id: ci-custom
-        name: ci-custom
-        entry: python script/run-in-env.py script/ci-custom.py
-        language: system

CODEOWNERS

@@ -56,7 +56,6 @@ esphome/components/audio_adc/* @kbx81
 esphome/components/audio_dac/* @kbx81
 esphome/components/audio_file/* @kahrendt
 esphome/components/audio_file/media_source/* @kahrendt
-esphome/components/audio_http/* @kahrendt
 esphome/components/axs15231/* @clydebarrow
 esphome/components/b_parasite/* @rbaron
 esphome/components/ballu/* @bazuchan
@@ -143,13 +142,12 @@ esphome/components/dlms_meter/* @SimonFischer04
 esphome/components/dps310/* @kbx81
 esphome/components/ds1307/* @badbadc0ffee
 esphome/components/ds2484/* @mrk-its
-esphome/components/dsmr/* @glmnet @PolarGoose
+esphome/components/dsmr/* @glmnet @PolarGoose @zuidwijk
 esphome/components/duty_time/* @dudanov
 esphome/components/ee895/* @Stock-M
 esphome/components/ektf2232/touchscreen/* @jesserockz
 esphome/components/emc2101/* @ellull
 esphome/components/emmeti/* @E440QF
-esphome/components/emontx/* @FredM67 @glynhudson @TrystanLea
 esphome/components/ens160/* @latonita
 esphome/components/ens160_base/* @latonita @vincentscode
 esphome/components/ens160_i2c/* @latonita
@@ -347,7 +345,6 @@ esphome/components/modbus_controller/select/* @martgras @stegm
 esphome/components/modbus_controller/sensor/* @martgras
 esphome/components/modbus_controller/switch/* @martgras
 esphome/components/modbus_controller/text_sensor/* @martgras
-esphome/components/modbus_server/* @exciton
 esphome/components/mopeka_ble/* @Fabian-Schmidt @spbrogan
 esphome/components/mopeka_pro_check/* @spbrogan
 esphome/components/mopeka_std_check/* @Fabian-Schmidt
@@ -405,7 +402,6 @@ esphome/components/qmp6988/* @andrewpc
 esphome/components/qr_code/* @wjtje
 esphome/components/qspi_dbi/* @clydebarrow
 esphome/components/qwiic_pir/* @kahrendt
-esphome/components/radio_frequency/* @kbx81
 esphome/components/radon_eye_ble/* @jeffeb3
 esphome/components/radon_eye_rd200/* @jeffeb3
 esphome/components/rc522/* @glmnet
@@ -416,7 +412,6 @@ esphome/components/resampler/speaker/* @kahrendt
 esphome/components/restart/* @esphome/core
 esphome/components/rf_bridge/* @jesserockz
 esphome/components/rgbct/* @jesserockz
-esphome/components/ring_buffer/* @kahrendt
 esphome/components/rp2040/* @jesserockz
 esphome/components/rp2040_ble/* @bdraco
 esphome/components/rp2040_pio_led_strip/* @Papa-DMan
@@ -442,11 +437,6 @@ esphome/components/sen0321/* @notjj
 esphome/components/sen21231/* @shreyaskarnik
 esphome/components/sen5x/* @martgras
 esphome/components/sen6x/* @martgras @mebner86 @mikelawrence @tuct
-esphome/components/sendspin/* @kahrendt
-esphome/components/sendspin/media_player/* @kahrendt
-esphome/components/sendspin/media_source/* @kahrendt
-esphome/components/sendspin/sensor/* @kahrendt
-esphome/components/sendspin/text_sensor/* @kahrendt
 esphome/components/sensirion_common/* @martgras
 esphome/components/sensor/* @esphome/core
 esphome/components/serial_proxy/* @kbx81
@@ -608,6 +598,6 @@ esphome/components/xxtea/* @clydebarrow
 esphome/components/zephyr/* @tomaszduda23
 esphome/components/zephyr_mcumgr/ota/* @tomaszduda23
 esphome/components/zhlt01/* @cfeenstra1024
-esphome/components/zigbee/* @luar123 @tomaszduda23
+esphome/components/zigbee/* @tomaszduda23
 esphome/components/zio_ultrasonic/* @kahrendt
 esphome/components/zwave_proxy/* @kbx81

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.5.0-dev
+PROJECT_NUMBER         = 2026.4.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

MANIFEST.in

@@ -4,5 +4,4 @@ include requirements.txt
 recursive-include esphome *.yaml
 recursive-include esphome *.cpp *.h *.tcc *.c
 recursive-include esphome *.py.script
-recursive-include esphome *.jinja
 recursive-include esphome LICENSE.txt

docker/ha-addon-rootfs/etc/cont-init.d/40-device-builder.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/with-contenv bashio
-# ==============================================================================
-# Installs the latest prerelease of esphome-device-builder when the
-# `use_new_device_builder` config option is enabled.
-# This is a temporary install-on-boot step until esphome-device-builder
-# becomes a direct dependency of esphome.
-# ==============================================================================
-
-if ! bashio::config.true 'use_new_device_builder'; then
-  exit 0
-fi
-
-bashio::log.info "Installing latest prerelease of esphome-device-builder..."
-if command -v uv > /dev/null; then
-  uv pip install --system --no-cache-dir --prerelease=allow --upgrade \
-    esphome-device-builder ||
-    bashio::exit.nok "Failed installing esphome-device-builder."
-else
-  pip install --no-cache-dir --pre --upgrade esphome-device-builder ||
-    bashio::exit.nok "Failed installing esphome-device-builder."
-fi
-bashio::log.info "Installed esphome-device-builder."

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/esphome/run

@@ -49,12 +49,5 @@ if bashio::fs.directory_exists '/config/esphome/.esphome'; then
     rm -rf /config/esphome/.esphome
 fi
 
-if bashio::config.true 'use_new_device_builder'; then
-    bashio::log.info "Starting ESPHome Device Builder..."
-    exec esphome-device-builder /config/esphome \
-        --ha-addon \
-        --ingress-port "$(bashio::addon.ingress_port)"
-fi
-
 bashio::log.info "Starting ESPHome dashboard..."
 exec esphome dashboard /config/esphome --socket /var/run/esphome.sock --ha-addon

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/init-nginx/run

@@ -4,14 +4,6 @@
 # Community Hass.io Add-ons: ESPHome
 # Configures NGINX for use with ESPHome
 # ==============================================================================
-
-# When the new device builder is enabled it serves HA ingress directly,
-# so nginx is not used at all -- skip configuration.
-if bashio::config.true 'use_new_device_builder'; then
-    bashio::log.info "Skipping NGINX setup: new device builder serves ingress directly."
-    bashio::exit.ok
-fi
-
 mkdir -p /var/log/nginx
 
 # Generate Ingress configuration

docker/ha-addon-rootfs/etc/s6-overlay/s6-rc.d/nginx/run

@@ -5,14 +5,6 @@
 # Runs the NGINX proxy
 # ==============================================================================
 
-# The new device builder handles HA ingress itself, so nginx is bypassed.
-# Block the longrun forever so s6 keeps the dependency satisfied and does
-# not respawn it.
-if bashio::config.true 'use_new_device_builder'; then
-    bashio::log.info "NGINX bypassed: new device builder serves ingress directly."
-    exec sleep infinity
-fi
-
 bashio::log.info "Waiting for ESPHome dashboard to come up..."
 
 while [[ ! -S /var/run/esphome.sock ]]; do

esphome/address_cache.py

@@ -101,17 +101,6 @@ class AddressCache:
         """Check if any cache entries exist."""
         return bool(self.mdns_cache or self.dns_cache)
 
-    def add_mdns_addresses(self, hostname: str, addresses: list[str]) -> None:
-        """Store resolved mDNS addresses for ``hostname`` in the cache.
-
-        Callers that discover ``.local`` hosts (e.g. via mDNS browse) can use
-        this to avoid a second resolution round-trip during the upload path.
-        No-op when ``addresses`` is empty.
-        """
-        if not addresses:
-            return
-        self.mdns_cache[normalize_hostname(hostname)] = addresses
-
     @classmethod
     def from_cli_args(
         cls, mdns_args: Iterable[str], dns_args: Iterable[str]

esphome/analyze_memory/__init__.py

@@ -24,7 +24,7 @@ from .helpers import (
 from .toolchain import find_tool, resolve_tool_path, run_tool
 
 if TYPE_CHECKING:
-    from esphome.platformio.toolchain import IDEData
+    from esphome.platformio_api import IDEData
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -793,11 +793,8 @@ class MemoryAnalyzer:
         """Scan ESPHome source object files to map extern "C" symbols to components.
 
         When no linker map file is available, this uses ``nm`` to scan ``.o`` files
-        under ``src/`` (including ``src/main.cpp.o`` and everything beneath
-        ``src/esphome/``) and build a symbol-to-component mapping. This catches
-        ``extern "C"`` functions, the ESPHome-generated ``setup()``/``loop()``
-        entry points in ``main.cpp``, and other symbols that lack C++ namespace
-        prefixes.
+        under ``src/esphome/`` and build a symbol-to-component mapping. This catches
+        ``extern "C"`` functions and other symbols that lack C++ namespace prefixes.
 
         Skips scanning if ``_source_symbol_map`` was already populated by
         ``_parse_map_file()``.
@@ -809,12 +806,12 @@ class MemoryAnalyzer:
         if obj_dir is None:
             return
 
-        # Scan all ESPHome-owned source object files: src/main.cpp.o and src/esphome/...
-        src_dir = obj_dir / "src"
-        if not src_dir.is_dir():
+        # Find ESPHome source object files
+        esphome_src_dir = obj_dir / "src" / "esphome"
+        if not esphome_src_dir.is_dir():
             return
 
-        obj_files = sorted(src_dir.rglob("*.o"))
+        obj_files = sorted(esphome_src_dir.rglob("*.o"))
         if not obj_files:
             return
 
@@ -1067,10 +1064,6 @@ class MemoryAnalyzer:
                 if component_name in self.external_components:
                     return f"{_COMPONENT_PREFIX_EXTERNAL}{component_name}"
 
-        # ESPHome-generated entry point: src/main.cpp.o (contains setup()/loop())
-        if len(parts) >= 2 and parts[-2:] == ("src", "main.cpp.o"):
-            return _COMPONENT_CORE
-
         # ESPHome core: src/esphome/core/... or src/esphome/...
         if "core" in parts and "esphome" in parts:
             return _COMPONENT_CORE

esphome/analyze_memory/cli.py

@@ -739,7 +739,7 @@ def main():
     import json
     from pathlib import Path
 
-    from esphome.platformio.toolchain import IDEData
+    from esphome.platformio_api import IDEData
 
     build_path = Path(build_dir)
 

esphome/async_thread.py

@@ -1,56 +0,0 @@
-"""Helpers for running an async coroutine from sync code via a daemon thread.
-
-``asyncio.run(coro())`` in the main thread blocks until the loop's cleanup
-cycle finishes, which can add hundreds of milliseconds before the caller
-receives the result. Running the loop in a daemon thread lets the caller
-observe the result as soon as the coroutine completes while cleanup finishes
-in the background.
-"""
-
-from __future__ import annotations
-
-import asyncio
-from collections.abc import Awaitable, Callable
-import threading
-from typing import Generic, TypeVar
-
-_T = TypeVar("_T")
-
-
-class AsyncThreadRunner(threading.Thread, Generic[_T]):
-    """Run an async coroutine in a daemon thread and expose its result.
-
-    The runner catches all exceptions from the coroutine and stores them in
-    ``exception`` so ``event`` is always set — this prevents callers waiting
-    on ``event`` from hanging forever when the coroutine crashes.
-
-    Typical usage::
-
-        runner = AsyncThreadRunner(lambda: my_coro(arg))
-        runner.start()
-        if not runner.event.wait(timeout=5.0):
-            ...  # timed out
-        if runner.exception is not None:
-            raise runner.exception
-        result = runner.result
-    """
-
-    def __init__(self, coro_factory: Callable[[], Awaitable[_T]]) -> None:
-        super().__init__(daemon=True)
-        self._coro_factory = coro_factory
-        self.result: _T | None = None
-        self.exception: BaseException | None = None
-        self.event = threading.Event()
-
-    async def _runner(self) -> None:
-        try:
-            self.result = await self._coro_factory()
-        except Exception as exc:  # pylint: disable=broad-except
-            # Capture all exceptions so ``event`` is always set — otherwise a
-            # crash would hang the waiter forever.
-            self.exception = exc
-        finally:
-            self.event.set()
-
-    def run(self) -> None:
-        asyncio.run(self._runner())

esphome/automation.py

@@ -1,4 +1,3 @@
-from dataclasses import dataclass, field
 import logging
 
 import esphome.codegen as cg
@@ -127,7 +126,7 @@ def validate_potentially_or_condition(value):
     return validate_condition(value)
 
 
-DelayAction = cg.esphome_ns.class_("DelayAction", Action)
+DelayAction = cg.esphome_ns.class_("DelayAction", Action, cg.Component)
 LambdaAction = cg.esphome_ns.class_("LambdaAction", Action)
 StatelessLambdaAction = cg.esphome_ns.class_("StatelessLambdaAction", Action)
 IfAction = cg.esphome_ns.class_("IfAction", Action)
@@ -199,10 +198,11 @@ def validate_automation(extra_schema=None, extra_validators=None, single=False):
                     return cv.Schema([schema])(value)
                 except cv.Invalid as err2:
                     if "extra keys not allowed" in str(err2) and len(err2.path) == 2:
-                        raise err from None
+                        # pylint: disable=raise-missing-from
+                        raise err
                     if "Unable to find action" in str(err):
-                        raise err2 from None
-                    raise cv.MultipleInvalid([err, err2]) from None
+                        raise err2
+                    raise cv.MultipleInvalid([err, err2])
         elif isinstance(value, dict):
             if CONF_THEN in value:
                 return [schema(value)]
@@ -396,6 +396,7 @@ async def delay_action_to_code(
     args: TemplateArgsType,
 ) -> MockObj:
     var = cg.new_Pvariable(action_id, template_arg)
+    await cg.register_component(var, {})
     template_ = await cg.templatable(config, args, cg.uint32)
     cg.add(var.set_delay(template_))
     return var
@@ -596,7 +597,7 @@ async def component_resume_action_to_code(
     comp = await cg.get_variable(config[CONF_ID])
     var = cg.new_Pvariable(action_id, template_arg, comp)
     if CONF_UPDATE_INTERVAL in config:
-        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, cg.uint32)
+        template_ = await cg.templatable(config[CONF_UPDATE_INTERVAL], args, int)
         cg.add(var.set_update_interval(template_))
     return var
 
@@ -714,35 +715,3 @@ async def build_callback_automation(
     # MockObjs (not user input), and there's no Expression type for positional
     # aggregate initialization (StructInitializer uses named fields).
     cg.add(getattr(parent, callback_method)(cg.RawExpression(f"{forwarder}{{{obj}}}")))
-
-
-@dataclass(frozen=True, slots=True)
-class CallbackAutomation:
-    """A single callback automation entry for build_callback_automations."""
-
-    conf_key: str
-    callback_method: str
-    args: TemplateArgsType = field(default_factory=list)
-    forwarder: MockObj | MockObjClass | None = None
-
-
-async def build_callback_automations(
-    parent: MockObj,
-    config: ConfigType,
-    entries: tuple[CallbackAutomation, ...],
-) -> None:
-    """Build multiple callback automations from a tuple of entries.
-
-    :param parent: The component object (e.g., button, sensor).
-    :param config: The full component config dict.
-    :param entries: Tuple of CallbackAutomation entries to process.
-    """
-    for entry in entries:
-        for conf in config.get(entry.conf_key, []):
-            await build_callback_automation(
-                parent,
-                entry.callback_method,
-                entry.args,
-                conf,
-                forwarder=entry.forwarder,
-            )

esphome/build_gen/espidf.py

@@ -6,7 +6,6 @@ from pathlib import Path
 from esphome.components.esp32 import get_esp32_variant
 from esphome.core import CORE
 from esphome.helpers import mkdir_p, write_file_if_changed
-from esphome.writer import update_storage_json
 
 
 def get_available_components() -> list[str] | None:
@@ -55,7 +54,7 @@ def get_project_cmakelists() -> str:
     idf_target = variant.lower().replace("-", "")
 
     # Extract compile definitions from build flags (-DXXX -> XXX)
-    compile_defs = [flag for flag in sorted(CORE.build_flags) if flag.startswith("-D")]
+    compile_defs = [flag for flag in CORE.build_flags if flag.startswith("-D")]
     extra_compile_options = "\n".join(
         f'idf_build_set_property(COMPILE_OPTIONS "{compile_def}" APPEND)'
         for compile_def in compile_defs
@@ -65,22 +64,6 @@ def get_project_cmakelists() -> str:
 # Auto-generated by ESPHome
 cmake_minimum_required(VERSION 3.16)
 
-# On Windows, Ninja can fail with:
-#   "CreateProcess: The parameter is incorrect (is the command line too long?)"
-# when compiler/linker command lines exceed the OS length limit.
-#
-# The following settings force CMake/Ninja to use *response files* (@file.rsp)
-# to pass long lists of includes, objects, and other arguments indirectly,
-# avoiding command-line length limits and fixing the build failure.
-#
-# This is especially useful for large ESP-IDF / ESPHome projects with many
-# source files or include directories.
-set(CMAKE_C_USE_RESPONSE_FILE_FOR_INCLUDES 1)
-set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_INCLUDES 1)
-set(CMAKE_C_USE_RESPONSE_FILE_FOR_OBJECTS 1)
-set(CMAKE_CXX_USE_RESPONSE_FILE_FOR_OBJECTS 1)
-set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
-
 set(IDF_TARGET {idf_target})
 set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)
 
@@ -141,11 +124,6 @@ target_link_options(${{COMPONENT_LIB}} PUBLIC
 
 def write_project(minimal: bool = False) -> None:
     """Write ESP-IDF project files."""
-    # Refresh <data_dir>/storage/<name>.yaml.json so the dashboard's
-    # /info and /downloads endpoints can locate the build (they 404
-    # otherwise). This mirrors the PlatformIO build-gen path's call
-    # in build_gen/platformio.py:write_ini().
-    update_storage_json()
     mkdir_p(CORE.build_path)
     mkdir_p(CORE.relative_src_path())
 

esphome/bundle.py

@@ -1,767 +0,0 @@
-"""Config bundle creator and extractor for ESPHome.
-
-A bundle is a self-contained .tar.gz archive containing a YAML config
-and every local file it depends on. Bundles can be created from a config
-and compiled directly: ``esphome compile my_device.esphomebundle.tar.gz``
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-from enum import StrEnum
-import io
-import json
-import logging
-from pathlib import Path
-import re
-import shutil
-import tarfile
-from typing import Any
-
-from esphome import const, yaml_util
-from esphome.const import (
-    CONF_ESPHOME,
-    CONF_EXTERNAL_COMPONENTS,
-    CONF_INCLUDES,
-    CONF_INCLUDES_C,
-    CONF_PATH,
-    CONF_SOURCE,
-    CONF_TYPE,
-)
-from esphome.core import CORE, EsphomeError
-
-_LOGGER = logging.getLogger(__name__)
-
-BUNDLE_EXTENSION = ".esphomebundle.tar.gz"
-MANIFEST_FILENAME = "manifest.json"
-CURRENT_MANIFEST_VERSION = 1
-MAX_DECOMPRESSED_SIZE = 500 * 1024 * 1024  # 500 MB
-MAX_MANIFEST_SIZE = 1024 * 1024  # 1 MB
-
-# Directories preserved across bundle extractions (build caches)
-_PRESERVE_DIRS = (".esphome", ".pioenvs", ".pio")
-_BUNDLE_STAGING_DIR = ".bundle_staging"
-
-
-class ManifestKey(StrEnum):
-    """Keys used in bundle manifest.json."""
-
-    MANIFEST_VERSION = "manifest_version"
-    ESPHOME_VERSION = "esphome_version"
-    CONFIG_FILENAME = "config_filename"
-    FILES = "files"
-    HAS_SECRETS = "has_secrets"
-
-
-# String prefixes that are never local file paths
-_NON_PATH_PREFIXES = ("http://", "https://", "ftp://", "mdi:", "<")
-
-# File extensions recognized when resolving relative path strings.
-# A relative string with one of these extensions is resolved against the
-# config directory and included if the file exists.
-_KNOWN_FILE_EXTENSIONS = frozenset(
-    {
-        # Fonts
-        ".ttf",
-        ".otf",
-        ".woff",
-        ".woff2",
-        ".pcf",
-        ".bdf",
-        # Images
-        ".png",
-        ".jpg",
-        ".jpeg",
-        ".bmp",
-        ".gif",
-        ".svg",
-        ".ico",
-        ".webp",
-        # Certificates
-        ".pem",
-        ".crt",
-        ".key",
-        ".der",
-        ".p12",
-        ".pfx",
-        # C/C++ includes
-        ".h",
-        ".hpp",
-        ".c",
-        ".cpp",
-        ".ino",
-        # Web assets
-        ".css",
-        ".js",
-        ".html",
-    }
-)
-
-
-# Matches !secret references in YAML text.  An optional surrounding
-# quote pair around the key is allowed and ignored: YAML treats
-# ``!secret 'foo'`` and ``!secret foo`` as the same key.  This is
-# intentionally a simple regex scan rather than a YAML parse — it may
-# match inside comments or multi-line strings, which is the conservative
-# direction (include more secrets rather than fewer).
-_SECRET_RE = re.compile(r"""!secret\s+['"]?([^\s'"]+)""")
-
-
-def _find_used_secret_keys(yaml_files: list[Path]) -> set[str]:
-    """Scan YAML files for ``!secret <key>`` references."""
-    keys: set[str] = set()
-    for fpath in yaml_files:
-        try:
-            text = fpath.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError):
-            continue
-        for match in _SECRET_RE.finditer(text):
-            keys.add(match.group(1))
-    return keys
-
-
-@dataclass
-class BundleFile:
-    """A file to include in the bundle."""
-
-    path: str  # Relative path inside the archive
-    source: Path  # Absolute path on disk
-
-
-@dataclass
-class BundleResult:
-    """Result of creating a bundle."""
-
-    data: bytes
-    manifest: dict[str, Any]
-    files: list[BundleFile]
-
-
-@dataclass
-class BundleManifest:
-    """Parsed and validated bundle manifest."""
-
-    manifest_version: int
-    esphome_version: str
-    config_filename: str
-    files: list[str]
-    has_secrets: bool
-
-
-class ConfigBundleCreator:
-    """Creates a self-contained bundle from an ESPHome config."""
-
-    def __init__(self, config: dict[str, Any]) -> None:
-        self._config = config
-        self._config_dir = Path(CORE.config_dir).resolve()
-        self._config_path = Path(CORE.config_path).resolve()
-        self._files: list[BundleFile] = []
-        self._seen_paths: set[Path] = set()
-        self._secrets_paths: set[Path] = set()
-
-    def discover_files(self) -> list[BundleFile]:
-        """Discover all files needed for the bundle."""
-        self._files = []
-        self._seen_paths = set()
-        self._secrets_paths = set()
-
-        # The main config file
-        self._add_file(self._config_path)
-
-        # Phase 1: YAML includes (tracked during config loading)
-        self._discover_yaml_includes()
-
-        # Phase 2: Component-referenced files from validated config
-        self._discover_component_files()
-
-        return list(self._files)
-
-    def create_bundle(self) -> BundleResult:
-        """Create the bundle archive."""
-        files = self.discover_files()
-
-        # Determine which secret keys are actually referenced by the
-        # bundled YAML files so we only ship those, not the entire
-        # secrets.yaml which may contain secrets for other devices.
-        yaml_sources = [
-            bf.source for bf in files if bf.source.suffix in (".yaml", ".yml")
-        ]
-        used_secret_keys = _find_used_secret_keys(yaml_sources)
-        filtered_secrets = self._build_filtered_secrets(used_secret_keys)
-
-        has_secrets = bool(filtered_secrets)
-        if has_secrets:
-            _LOGGER.warning(
-                "Bundle contains secrets (e.g. Wi-Fi passwords). "
-                "Do not share it with untrusted parties."
-            )
-
-        manifest = self._build_manifest(files, has_secrets=has_secrets)
-
-        buf = io.BytesIO()
-        with tarfile.open(fileobj=buf, mode="w:gz") as tar:
-            # Add manifest first
-            manifest_data = json.dumps(manifest, indent=2).encode("utf-8")
-            _add_bytes_to_tar(tar, MANIFEST_FILENAME, manifest_data)
-
-            # Add filtered secrets files
-            for rel_path, data in sorted(filtered_secrets.items()):
-                _add_bytes_to_tar(tar, rel_path, data)
-
-            # Add files in sorted order for determinism, skipping secrets
-            # files which were already added above with filtered content
-            for bf in sorted(files, key=lambda f: f.path):
-                if bf.source in self._secrets_paths:
-                    continue
-                self._add_to_tar(tar, bf)
-
-        return BundleResult(data=buf.getvalue(), manifest=manifest, files=files)
-
-    def _add_file(self, abs_path: Path) -> bool:
-        """Add a file to the bundle. Returns False if already added."""
-        abs_path = abs_path.resolve()
-        if abs_path in self._seen_paths:
-            return False
-        if not abs_path.is_file():
-            _LOGGER.warning("Bundle: skipping missing file %s", abs_path)
-            return False
-
-        rel_path = self._relative_to_config_dir(abs_path)
-        if rel_path is None:
-            _LOGGER.warning(
-                "Bundle: skipping file outside config directory: %s", abs_path
-            )
-            return False
-
-        self._seen_paths.add(abs_path)
-        self._files.append(BundleFile(path=rel_path, source=abs_path))
-        return True
-
-    def _add_directory(self, abs_path: Path) -> None:
-        """Recursively add all files in a directory."""
-        abs_path = abs_path.resolve()
-        if not abs_path.is_dir():
-            _LOGGER.warning("Bundle: skipping missing directory %s", abs_path)
-            return
-        for child in sorted(abs_path.rglob("*")):
-            if child.is_file() and "__pycache__" not in child.parts:
-                self._add_file(child)
-
-    def _relative_to_config_dir(self, abs_path: Path) -> str | None:
-        """Get a path relative to the config directory. Returns None if outside.
-
-        Always uses forward slashes for consistency in tar archives.
-        """
-        try:
-            return abs_path.relative_to(self._config_dir).as_posix()
-        except ValueError:
-            return None
-
-    def _discover_yaml_includes(self) -> None:
-        """Discover YAML files loaded during config parsing.
-
-        Deliberately uses a fresh re-parse and force-loads every deferred
-        ``IncludeFile`` to include *all* potentially-reachable includes,
-        even branches not selected by the local substitutions. Bundles are
-        meant to be compiled on another system where command-line
-        substitution overrides may choose a different branch — e.g.
-        ``!include network/${eth_model}/config.yaml`` must ship every
-        candidate so the remote build can pick any one.
-
-        Entries with unresolved substitution variables in the filename
-        path are skipped with a warning (they cannot be resolved without
-        the substitution pass).
-
-        Secrets files are tracked separately so we can filter them to
-        only include the keys this config actually references.
-        """
-        # Must be a fresh parse: IncludeFile.load() caches its result in
-        # _content, and we discover files by listening for loader calls. On
-        # an already-parsed tree the cache is populated, .load() returns
-        # without calling the loader, the listener never fires, and the
-        # referenced files would be silently dropped from the bundle.
-        with yaml_util.track_yaml_loads() as loaded_files:
-            try:
-                data = yaml_util.load_yaml(self._config_path)
-            except EsphomeError:
-                _LOGGER.debug(
-                    "Bundle: re-loading YAML for include discovery failed, "
-                    "proceeding with partial file list"
-                )
-            else:
-                _force_load_include_files(data)
-
-        for fpath in loaded_files:
-            if fpath == self._config_path.resolve():
-                continue  # Already added as config
-            if fpath.name in const.SECRETS_FILES:
-                self._secrets_paths.add(fpath)
-            self._add_file(fpath)
-
-    def _discover_component_files(self) -> None:
-        """Walk the validated config for file references.
-
-        Uses a generic recursive walk to find file paths instead of
-        hardcoding per-component knowledge about config dict formats.
-        After validation, components typically resolve paths to absolute
-        using CORE.relative_config_path() or cv.file_(). Relative paths
-        with known file extensions are also resolved and checked.
-
-        Core ESPHome concepts that use relative paths or directories
-        are handled explicitly.
-        """
-        config = self._config
-
-        # Generic walk: find all file paths in the validated config
-        self._walk_config_for_files(config)
-
-        # --- Core ESPHome concepts needing explicit handling ---
-
-        # esphome.includes / includes_c - can be relative paths and directories
-        esphome_conf = config.get(CONF_ESPHOME, {})
-        for include_path in esphome_conf.get(CONF_INCLUDES, []):
-            resolved = _resolve_include_path(include_path)
-            if resolved is None:
-                continue
-            if resolved.is_dir():
-                self._add_directory(resolved)
-            else:
-                self._add_file(resolved)
-        for include_path in esphome_conf.get(CONF_INCLUDES_C, []):
-            resolved = _resolve_include_path(include_path)
-            if resolved is not None:
-                self._add_file(resolved)
-
-        # external_components with source: local - directories
-        for ext_conf in config.get(CONF_EXTERNAL_COMPONENTS, []):
-            source = ext_conf.get(CONF_SOURCE, {})
-            if not isinstance(source, dict):
-                continue
-            if source.get(CONF_TYPE) != "local":
-                continue
-            path = source.get(CONF_PATH)
-            if not path:
-                continue
-            p = Path(path)
-            if not p.is_absolute():
-                p = CORE.relative_config_path(p)
-            self._add_directory(p)
-
-    def _walk_config_for_files(self, obj: Any) -> None:
-        """Recursively walk the config dict looking for file path references."""
-        if isinstance(obj, dict):
-            for value in obj.values():
-                self._walk_config_for_files(value)
-        elif isinstance(obj, (list, tuple)):
-            for item in obj:
-                self._walk_config_for_files(item)
-        elif isinstance(obj, Path):
-            if obj.is_absolute() and obj.is_file():
-                self._add_file(obj)
-        elif isinstance(obj, str):
-            self._check_string_path(obj)
-
-    def _check_string_path(self, value: str) -> None:
-        """Check if a string value is a local file reference."""
-        # Fast exits for strings that cannot be file paths
-        if len(value) < 2 or "\n" in value:
-            return
-        if value.startswith(_NON_PATH_PREFIXES):
-            return
-        # File paths must contain a path separator or a dot (for extension)
-        if "/" not in value and "\\" not in value and "." not in value:
-            return
-
-        p = Path(value)
-
-        # Absolute path - check if it points to an existing file
-        if p.is_absolute():
-            if p.is_file():
-                self._add_file(p)
-            return
-
-        # Relative path with a known file extension - likely a component
-        # validator that forgot to resolve to absolute via cv.file_() or
-        # CORE.relative_config_path(). Warn and try to resolve.
-        if p.suffix.lower() in _KNOWN_FILE_EXTENSIONS:
-            _LOGGER.warning(
-                "Bundle: non-absolute path in validated config: %s "
-                "(component validator should return absolute paths)",
-                value,
-            )
-            resolved = CORE.relative_config_path(p)
-            if resolved.is_file():
-                self._add_file(resolved)
-
-    def _build_filtered_secrets(self, used_keys: set[str]) -> dict[str, bytes]:
-        """Build filtered secrets files containing only the referenced keys.
-
-        Returns a dict mapping relative archive path to YAML bytes.
-        """
-        if not used_keys or not self._secrets_paths:
-            return {}
-
-        result: dict[str, bytes] = {}
-        for secrets_path in self._secrets_paths:
-            rel_path = self._relative_to_config_dir(secrets_path)
-            if rel_path is None:
-                continue
-            try:
-                all_secrets = yaml_util.load_yaml(secrets_path, clear_secrets=False)
-            except EsphomeError:
-                _LOGGER.warning("Bundle: failed to load secrets file %s", secrets_path)
-                continue
-            if not isinstance(all_secrets, dict):
-                continue
-            filtered = {k: v for k, v in all_secrets.items() if k in used_keys}
-            if filtered:
-                data = yaml_util.dump(filtered, show_secrets=True).encode("utf-8")
-                result[rel_path] = data
-        return result
-
-    def _build_manifest(
-        self, files: list[BundleFile], *, has_secrets: bool
-    ) -> dict[str, Any]:
-        """Build the manifest.json content."""
-        return {
-            ManifestKey.MANIFEST_VERSION: CURRENT_MANIFEST_VERSION,
-            ManifestKey.ESPHOME_VERSION: const.__version__,
-            ManifestKey.CONFIG_FILENAME: self._config_path.name,
-            ManifestKey.FILES: [f.path for f in files],
-            ManifestKey.HAS_SECRETS: has_secrets,
-        }
-
-    @staticmethod
-    def _add_to_tar(tar: tarfile.TarFile, bf: BundleFile) -> None:
-        """Add a BundleFile to the tar archive with deterministic metadata."""
-        with open(bf.source, "rb") as f:
-            _add_bytes_to_tar(tar, bf.path, f.read())
-
-
-def extract_bundle(
-    bundle_path: Path,
-    target_dir: Path | None = None,
-) -> Path:
-    """Extract a bundle archive and return the path to the config YAML.
-
-    Sanity checks reject path traversal, symlinks, absolute paths, and
-    oversized archives to prevent accidental file overwrites or extraction
-    outside the target directory.  These are **not** a security boundary —
-    bundles are assumed to come from the user's own machine or a trusted
-    build pipeline.
-
-    Args:
-        bundle_path: Path to the .tar.gz bundle file.
-        target_dir: Directory to extract into. If None, extracts next to
-                     the bundle file in a directory named after it.
-
-    Returns:
-        Absolute path to the extracted config YAML file.
-
-    Raises:
-        EsphomeError: If the bundle is invalid or extraction fails.
-    """
-
-    bundle_path = bundle_path.resolve()
-    if not bundle_path.is_file():
-        raise EsphomeError(f"Bundle file not found: {bundle_path}")
-
-    if target_dir is None:
-        target_dir = _default_target_dir(bundle_path)
-
-    target_dir = target_dir.resolve()
-    target_dir.mkdir(parents=True, exist_ok=True)
-
-    # Read and validate the archive
-    try:
-        with tarfile.open(bundle_path, "r:gz") as tar:
-            manifest = _read_manifest_from_tar(tar)
-            _validate_tar_members(tar, target_dir)
-            tar.extractall(path=target_dir, filter="data")
-    except tarfile.TarError as err:
-        raise EsphomeError(f"Failed to extract bundle: {err}") from err
-
-    config_filename = manifest[ManifestKey.CONFIG_FILENAME]
-    config_path = target_dir / config_filename
-    if not config_path.is_file():
-        raise EsphomeError(
-            f"Bundle manifest references config '{config_filename}' "
-            f"but it was not found in the archive"
-        )
-
-    return config_path
-
-
-def read_bundle_manifest(bundle_path: Path) -> BundleManifest:
-    """Read and validate the manifest from a bundle without full extraction.
-
-    Args:
-        bundle_path: Path to the .tar.gz bundle file.
-
-    Returns:
-        Parsed BundleManifest.
-
-    Raises:
-        EsphomeError: If the manifest is missing, invalid, or version unsupported.
-    """
-
-    try:
-        with tarfile.open(bundle_path, "r:gz") as tar:
-            manifest = _read_manifest_from_tar(tar)
-    except tarfile.TarError as err:
-        raise EsphomeError(f"Failed to read bundle: {err}") from err
-
-    return BundleManifest(
-        manifest_version=manifest[ManifestKey.MANIFEST_VERSION],
-        esphome_version=manifest.get(ManifestKey.ESPHOME_VERSION, "unknown"),
-        config_filename=manifest[ManifestKey.CONFIG_FILENAME],
-        files=manifest.get(ManifestKey.FILES, []),
-        has_secrets=manifest.get(ManifestKey.HAS_SECRETS, False),
-    )
-
-
-def _read_manifest_from_tar(tar: tarfile.TarFile) -> dict[str, Any]:
-    """Read and validate manifest.json from an open tar archive."""
-
-    try:
-        member = tar.getmember(MANIFEST_FILENAME)
-    except KeyError:
-        raise EsphomeError("Invalid bundle: missing manifest.json") from None
-
-    f = tar.extractfile(member)
-    if f is None:
-        raise EsphomeError("Invalid bundle: manifest.json is not a regular file")
-
-    if member.size > MAX_MANIFEST_SIZE:
-        raise EsphomeError(
-            f"Invalid bundle: manifest.json too large "
-            f"({member.size} bytes, max {MAX_MANIFEST_SIZE})"
-        )
-
-    try:
-        manifest = json.loads(f.read())
-    except (json.JSONDecodeError, UnicodeDecodeError) as err:
-        raise EsphomeError(f"Invalid bundle: malformed manifest.json: {err}") from err
-
-    # Version check
-    version = manifest.get(ManifestKey.MANIFEST_VERSION)
-    if version is None:
-        raise EsphomeError("Invalid bundle: manifest.json missing 'manifest_version'")
-    if not isinstance(version, int) or version < 1:
-        raise EsphomeError(
-            f"Invalid bundle: manifest_version must be a positive integer, got {version!r}"
-        )
-    if version > CURRENT_MANIFEST_VERSION:
-        raise EsphomeError(
-            f"Bundle manifest version {version} is newer than this ESPHome "
-            f"version supports (max {CURRENT_MANIFEST_VERSION}). "
-            f"Please upgrade ESPHome to compile this bundle."
-        )
-
-    # Required fields
-    if ManifestKey.CONFIG_FILENAME not in manifest:
-        raise EsphomeError("Invalid bundle: manifest.json missing 'config_filename'")
-
-    return manifest
-
-
-def _validate_tar_members(tar: tarfile.TarFile, target_dir: Path) -> None:
-    """Sanity-check tar members to prevent mistakes and accidental overwrites.
-
-    This is not a security boundary — bundles are created locally or come
-    from a trusted build pipeline.  The checks catch malformed archives
-    and common mistakes (stray absolute paths, ``..`` components) that
-    could silently overwrite unrelated files.
-    """
-
-    total_size = 0
-    for member in tar.getmembers():
-        # Reject absolute paths (Unix and Windows)
-        if member.name.startswith(("/", "\\")):
-            raise EsphomeError(
-                f"Invalid bundle: absolute path in archive: {member.name}"
-            )
-
-        # Reject path traversal (split on both / and \ for cross-platform)
-        parts = re.split(r"[/\\]", member.name)
-        if ".." in parts:
-            raise EsphomeError(
-                f"Invalid bundle: path traversal in archive: {member.name}"
-            )
-
-        # Reject symlinks
-        if member.issym() or member.islnk():
-            raise EsphomeError(f"Invalid bundle: symlink in archive: {member.name}")
-
-        # Ensure extraction stays within target_dir
-        target_path = (target_dir / member.name).resolve()
-        if not target_path.is_relative_to(target_dir):
-            raise EsphomeError(
-                f"Invalid bundle: file would extract outside target: {member.name}"
-            )
-
-        # Track total decompressed size
-        total_size += member.size
-        if total_size > MAX_DECOMPRESSED_SIZE:
-            raise EsphomeError(
-                f"Invalid bundle: decompressed size exceeds "
-                f"{MAX_DECOMPRESSED_SIZE // (1024 * 1024)}MB limit"
-            )
-
-
-def is_bundle_path(path: Path) -> bool:
-    """Check if a path looks like a bundle file."""
-    return path.name.lower().endswith(BUNDLE_EXTENSION)
-
-
-def _add_bytes_to_tar(tar: tarfile.TarFile, name: str, data: bytes) -> None:
-    """Add in-memory bytes to a tar archive with deterministic metadata."""
-    info = tarfile.TarInfo(name=name)
-    info.size = len(data)
-    info.mtime = 0
-    info.uid = 0
-    info.gid = 0
-    info.mode = 0o644
-    tar.addfile(info, io.BytesIO(data))
-
-
-def _force_load_include_files(obj: Any, _seen: set[int] | None = None) -> None:
-    """Recursively resolve any ``IncludeFile`` instances in a YAML tree.
-
-    Nested ``!include`` returns a deferred ``IncludeFile`` that is only
-    resolved during the substitution pass. During bundle discovery we need
-    the referenced files to actually load so the ``track_yaml_loads``
-    listener fires for them.
-
-    ``IncludeFile`` instances with unresolved substitution variables in the
-    filename cannot be loaded — we skip and warn about those.
-    """
-    if _seen is None:
-        _seen = set()
-
-    if isinstance(obj, yaml_util.IncludeFile):
-        if id(obj) in _seen:
-            return
-        _seen.add(id(obj))
-        if obj.has_unresolved_expressions():
-            _LOGGER.warning(
-                "Bundle: cannot resolve !include %s (referenced from %s) "
-                "with substitutions in path",
-                obj.file,
-                obj.parent_file,
-            )
-            return
-        try:
-            loaded = obj.load()
-        except EsphomeError as err:
-            _LOGGER.warning(
-                "Bundle: failed to load !include %s (referenced from %s): %s",
-                obj.file,
-                obj.parent_file,
-                err,
-            )
-            return
-        _force_load_include_files(loaded, _seen)
-    elif isinstance(obj, dict):
-        if id(obj) in _seen:
-            return
-        _seen.add(id(obj))
-        for value in obj.values():
-            _force_load_include_files(value, _seen)
-    elif isinstance(obj, (list, tuple)):
-        if id(obj) in _seen:
-            return
-        _seen.add(id(obj))
-        for item in obj:
-            _force_load_include_files(item, _seen)
-
-
-def _resolve_include_path(include_path: Any) -> Path | None:
-    """Resolve an include path to absolute, skipping system includes."""
-    if isinstance(include_path, str) and include_path.startswith("<"):
-        return None  # System include, not a local file
-    p = Path(include_path)
-    if not p.is_absolute():
-        p = CORE.relative_config_path(p)
-    return p
-
-
-def _default_target_dir(bundle_path: Path) -> Path:
-    """Compute the default extraction directory for a bundle."""
-    name = bundle_path.name
-    if name.lower().endswith(BUNDLE_EXTENSION):
-        name = name[: -len(BUNDLE_EXTENSION)]
-    return bundle_path.parent / name
-
-
-def _restore_preserved_dirs(preserved: dict[str, Path], target_dir: Path) -> None:
-    """Move preserved build cache directories back into target_dir.
-
-    If the bundle contained entries under a preserved directory name,
-    the extracted copy is removed so the original cache always wins.
-    """
-    for dirname, src in preserved.items():
-        dst = target_dir / dirname
-        if dst.exists():
-            shutil.rmtree(dst)
-        shutil.move(str(src), str(dst))
-
-
-def prepare_bundle_for_compile(
-    bundle_path: Path,
-    target_dir: Path | None = None,
-) -> Path:
-    """Extract a bundle for compilation, preserving build caches.
-
-    Unlike extract_bundle(), this preserves .esphome/ and .pioenvs/
-    directories in the target if they already exist (for incremental builds).
-
-    Args:
-        bundle_path: Path to the .tar.gz bundle file.
-        target_dir: Directory to extract into. Must be specified for
-                     build server use.
-
-    Returns:
-        Absolute path to the extracted config YAML file.
-    """
-
-    bundle_path = bundle_path.resolve()
-    if not bundle_path.is_file():
-        raise EsphomeError(f"Bundle file not found: {bundle_path}")
-
-    if target_dir is None:
-        target_dir = _default_target_dir(bundle_path)
-
-    target_dir = target_dir.resolve()
-    target_dir.mkdir(parents=True, exist_ok=True)
-
-    preserved: dict[str, Path] = {}
-
-    # Temporarily move preserved dirs out of the way
-    staging = target_dir / _BUNDLE_STAGING_DIR
-    for dirname in _PRESERVE_DIRS:
-        src = target_dir / dirname
-        if src.is_dir():
-            dst = staging / dirname
-            dst.parent.mkdir(parents=True, exist_ok=True)
-            shutil.move(str(src), str(dst))
-            preserved[dirname] = dst
-
-    try:
-        # Clean non-preserved content and extract fresh
-        for item in target_dir.iterdir():
-            if item.name == _BUNDLE_STAGING_DIR:
-                continue
-            if item.is_dir():
-                shutil.rmtree(item)
-            else:
-                item.unlink()
-
-        config_path = extract_bundle(bundle_path, target_dir)
-    finally:
-        # Restore preserved dirs (idempotent) and clean staging
-        _restore_preserved_dirs(preserved, target_dir)
-        if staging.is_dir():
-            shutil.rmtree(staging)
-
-    return config_path

esphome/codegen.py

@@ -79,7 +79,6 @@ from esphome.cpp_types import (  # noqa: F401
     float_,
     global_ns,
     gpio_Flags,
-    int8,
     int16,
     int32,
     int64,

esphome/components/a01nyub/a01nyub.cpp

@@ -4,7 +4,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::a01nyub {
+namespace esphome {
+namespace a01nyub {
 
 static const char *const TAG = "a01nyub.sensor";
 
@@ -41,4 +42,5 @@ void A01nyubComponent::check_buffer_() {
 
 void A01nyubComponent::dump_config() { LOG_SENSOR("", "A01nyub Sensor", this); }
 
-}  // namespace esphome::a01nyub
+}  // namespace a01nyub
+}  // namespace esphome

esphome/components/a01nyub/a01nyub.h

@@ -6,7 +6,8 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome::a01nyub {
+namespace esphome {
+namespace a01nyub {
 
 class A01nyubComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -22,4 +23,5 @@ class A01nyubComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace esphome::a01nyub
+}  // namespace a01nyub
+}  // namespace esphome

esphome/components/a02yyuw/a02yyuw.cpp

@@ -4,7 +4,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::a02yyuw {
+namespace esphome {
+namespace a02yyuw {
 
 static const char *const TAG = "a02yyuw.sensor";
 
@@ -40,4 +41,5 @@ void A02yyuwComponent::check_buffer_() {
 
 void A02yyuwComponent::dump_config() { LOG_SENSOR("", "A02yyuw Sensor", this); }
 
-}  // namespace esphome::a02yyuw
+}  // namespace a02yyuw
+}  // namespace esphome

esphome/components/a02yyuw/a02yyuw.h

@@ -6,7 +6,8 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/uart/uart.h"
 
-namespace esphome::a02yyuw {
+namespace esphome {
+namespace a02yyuw {
 
 class A02yyuwComponent : public sensor::Sensor, public Component, public uart::UARTDevice {
  public:
@@ -22,4 +23,5 @@ class A02yyuwComponent : public sensor::Sensor, public Component, public uart::U
   std::vector<uint8_t> buffer_;
 };
 
-}  // namespace esphome::a02yyuw
+}  // namespace a02yyuw
+}  // namespace esphome

esphome/components/a4988/a4988.cpp

@@ -1,7 +1,8 @@
 #include "a4988.h"
 #include "esphome/core/log.h"
 
-namespace esphome::a4988 {
+namespace esphome {
+namespace a4988 {
 
 static const char *const TAG = "a4988.stepper";
 
@@ -50,4 +51,5 @@ void A4988::loop() {
   this->step_pin_->digital_write(false);
 }
 
-}  // namespace esphome::a4988
+}  // namespace a4988
+}  // namespace esphome

esphome/components/a4988/a4988.h

@@ -4,7 +4,8 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/stepper/stepper.h"
 
-namespace esphome::a4988 {
+namespace esphome {
+namespace a4988 {
 
 class A4988 : public stepper::Stepper, public Component {
  public:
@@ -24,4 +25,5 @@ class A4988 : public stepper::Stepper, public Component {
   HighFrequencyLoopRequester high_freq_;
 };
 
-}  // namespace esphome::a4988
+}  // namespace a4988
+}  // namespace esphome

esphome/components/ac_dimmer/ac_dimmer.cpp

@@ -190,7 +190,7 @@ void AcDimmer::setup() {
     this->zero_cross_pin_->setup();
     this->store_.zero_cross_pin = this->zero_cross_pin_->to_isr();
     this->zero_cross_pin_->attach_interrupt(&AcDimmerDataStore::s_gpio_intr, &this->store_,
-                                            this->zero_cross_interrupt_type_);
+                                            gpio::INTERRUPT_FALLING_EDGE);
   }
 
 #ifdef USE_ESP8266
@@ -226,25 +226,19 @@ void AcDimmer::write_state(float state) {
 void AcDimmer::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "AcDimmer:\n"
-                "  Min Power: %.1f%%\n"
-                "  Init with half cycle: %s",
+                "   Min Power: %.1f%%\n"
+                "   Init with half cycle: %s",
                 this->store_.min_power / 10.0f, YESNO(this->init_with_half_cycle_));
   LOG_PIN("  Output Pin: ", this->gate_pin_);
   LOG_PIN("  Zero-Cross Pin: ", this->zero_cross_pin_);
-  if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_RISING_EDGE) {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: rising");
-  } else if (this->zero_cross_interrupt_type_ == gpio::INTERRUPT_FALLING_EDGE) {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: falling");
-  } else {
-    ESP_LOGCONFIG(TAG, "  Interrupt Type: any");
-  }
   if (method_ == DIM_METHOD_LEADING_PULSE) {
-    ESP_LOGCONFIG(TAG, "  Method: leading pulse");
+    ESP_LOGCONFIG(TAG, "   Method: leading pulse");
   } else if (method_ == DIM_METHOD_LEADING) {
-    ESP_LOGCONFIG(TAG, "  Method: leading");
+    ESP_LOGCONFIG(TAG, "   Method: leading");
   } else {
-    ESP_LOGCONFIG(TAG, "  Method: trailing");
+    ESP_LOGCONFIG(TAG, "   Method: trailing");
   }
+
   LOG_FLOAT_OUTPUT(this);
   ESP_LOGV(TAG, "  Estimated Frequency: %.3fHz", 1e6f / this->store_.cycle_time_us / 2);
 }

esphome/components/ac_dimmer/ac_dimmer.h

@@ -48,7 +48,6 @@ class AcDimmer : public output::FloatOutput, public Component {
   void dump_config() override;
   void set_gate_pin(InternalGPIOPin *gate_pin) { gate_pin_ = gate_pin; }
   void set_zero_cross_pin(InternalGPIOPin *zero_cross_pin) { zero_cross_pin_ = zero_cross_pin; }
-  void set_zero_cross_interrupt_type(gpio::InterruptType type) { zero_cross_interrupt_type_ = type; }
   void set_init_with_half_cycle(bool init_with_half_cycle) { init_with_half_cycle_ = init_with_half_cycle; }
   void set_method(DimMethod method) { method_ = method; }
 
@@ -57,7 +56,6 @@ class AcDimmer : public output::FloatOutput, public Component {
 
   InternalGPIOPin *gate_pin_;
   InternalGPIOPin *zero_cross_pin_;
-  gpio::InterruptType zero_cross_interrupt_type_;
   AcDimmerDataStore store_;
   bool init_with_half_cycle_;
   DimMethod method_;

esphome/components/ac_dimmer/output.py

@@ -7,8 +7,6 @@ from esphome.core import CORE
 
 CODEOWNERS = ["@glmnet"]
 
-gpio_ns = cg.esphome_ns.namespace("gpio")
-
 ac_dimmer_ns = cg.esphome_ns.namespace("ac_dimmer")
 AcDimmer = ac_dimmer_ns.class_("AcDimmer", output.FloatOutput, cg.Component)
 
@@ -19,26 +17,15 @@ DIM_METHODS = {
     "TRAILING": DimMethod.DIM_METHOD_TRAILING,
 }
 
-ZC_INTERRUPT_TYPES = {
-    "RISING": gpio_ns.INTERRUPT_RISING_EDGE,
-    "FALLING": gpio_ns.INTERRUPT_FALLING_EDGE,
-    "ANY": gpio_ns.INTERRUPT_ANY_EDGE,
-}
-
 CONF_GATE_PIN = "gate_pin"
 CONF_ZERO_CROSS_PIN = "zero_cross_pin"
 CONF_INIT_WITH_HALF_CYCLE = "init_with_half_cycle"
-CONF_ZERO_CROSS_INTERRUPT_TYPE = "zero_cross_interrupt_type"
-
 CONFIG_SCHEMA = cv.All(
     output.FLOAT_OUTPUT_SCHEMA.extend(
         {
             cv.Required(CONF_ID): cv.declare_id(AcDimmer),
             cv.Required(CONF_GATE_PIN): pins.internal_gpio_output_pin_schema,
             cv.Required(CONF_ZERO_CROSS_PIN): pins.internal_gpio_input_pin_schema,
-            cv.Optional(CONF_ZERO_CROSS_INTERRUPT_TYPE, default="FALLING"): cv.enum(
-                ZC_INTERRUPT_TYPES, upper=True, space="_"
-            ),
             cv.Optional(CONF_INIT_WITH_HALF_CYCLE, default=True): cv.boolean,
             cv.Optional(CONF_METHOD, default="leading pulse"): cv.enum(
                 DIM_METHODS, upper=True, space="_"
@@ -67,6 +54,5 @@ async def to_code(config):
     cg.add(var.set_gate_pin(pin))
     pin = await cg.gpio_pin_expression(config[CONF_ZERO_CROSS_PIN])
     cg.add(var.set_zero_cross_pin(pin))
-    cg.add(var.set_zero_cross_interrupt_type(config[CONF_ZERO_CROSS_INTERRUPT_TYPE]))
     cg.add(var.set_init_with_half_cycle(config[CONF_INIT_WITH_HALF_CYCLE]))
     cg.add(var.set_method(config[CONF_METHOD]))

esphome/components/adalight/adalight_light_effect.cpp

@@ -1,7 +1,8 @@
 #include "adalight_light_effect.h"
 #include "esphome/core/log.h"
 
-namespace esphome::adalight {
+namespace esphome {
+namespace adalight {
 
 static const char *const TAG = "adalight_light_effect";
 
@@ -128,7 +129,7 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   uint8_t *led_data = &frame_[6];
 
   for (int led = 0; led < accepted_led_count; led++, led_data += 3) {
-    auto white = std::min({led_data[0], led_data[1], led_data[2]});
+    auto white = std::min(std::min(led_data[0], led_data[1]), led_data[2]);
 
     it[led].set(Color(led_data[0], led_data[1], led_data[2], white));
   }
@@ -137,4 +138,5 @@ AdalightLightEffect::Frame AdalightLightEffect::parse_frame_(light::AddressableL
   return CONSUMED;
 }
 
-}  // namespace esphome::adalight
+}  // namespace adalight
+}  // namespace esphome

esphome/components/adalight/adalight_light_effect.h

@@ -6,7 +6,8 @@
 
 #include <vector>
 
-namespace esphome::adalight {
+namespace esphome {
+namespace adalight {
 
 class AdalightLightEffect : public light::AddressableLightEffect, public uart::UARTDevice {
  public:
@@ -34,4 +35,5 @@ class AdalightLightEffect : public light::AddressableLightEffect, public uart::U
   std::vector<uint8_t> frame_;
 };
 
-}  // namespace esphome::adalight
+}  // namespace adalight
+}  // namespace esphome

esphome/components/adc/adc_sensor.h

@@ -17,7 +17,8 @@
 #include <zephyr/drivers/adc.h>
 #endif
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 #ifdef USE_ESP32
 // clang-format off
@@ -161,4 +162,5 @@ class ADCSensor : public sensor::Sensor, public PollingComponent, public voltage
 #endif
 };
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome

esphome/components/adc/adc_sensor_common.cpp

@@ -1,7 +1,8 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.common";
 
@@ -78,4 +79,5 @@ void ADCSensor::set_sample_count(uint8_t sample_count) {
 
 void ADCSensor::set_sampling_mode(SamplingMode sampling_mode) { this->sampling_mode_ = sampling_mode; }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome

esphome/components/adc/adc_sensor_esp32.cpp

@@ -4,7 +4,8 @@
 #include "esphome/core/log.h"
 #include <cinttypes>
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.esp32";
 
@@ -363,6 +364,7 @@ float ADCSensor::sample_autorange_() {
   return final_result;
 }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome
 
 #endif  // USE_ESP32

esphome/components/adc/adc_sensor_esp8266.cpp

@@ -11,7 +11,8 @@ ADC_MODE(ADC_VCC)
 #include <Arduino.h>
 #endif  // USE_ADC_SENSOR_VCC
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.esp8266";
 
@@ -54,6 +55,7 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1024.0f;
 }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome
 
 #endif  // USE_ESP8266

esphome/components/adc/adc_sensor_libretiny.cpp

@@ -3,7 +3,8 @@
 #include "adc_sensor.h"
 #include "esphome/core/log.h"
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.libretiny";
 
@@ -47,6 +48,7 @@ float ADCSensor::sample() {
   return aggr.aggregate() / 1000.0f;
 }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome
 
 #endif  // USE_LIBRETINY

esphome/components/adc/adc_sensor_rp2040.cpp

@@ -15,7 +15,8 @@
 #define PICO_VSYS_PIN 29  // NOLINT(cppcoreguidelines-macro-usage)
 #endif
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.rp2040";
 
@@ -97,6 +98,7 @@ float ADCSensor::sample() {
   return aggr.aggregate() * 3.3f / 4096.0f * coeff;
 }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome
 
 #endif  // USE_RP2040

esphome/components/adc/adc_sensor_zephyr.cpp

@@ -5,7 +5,8 @@
 
 #include "hal/nrf_saadc.h"
 
-namespace esphome::adc {
+namespace esphome {
+namespace adc {
 
 static const char *const TAG = "adc.zephyr";
 
@@ -201,5 +202,6 @@ float ADCSensor::sample() {
   return val_mv / 1000.0f;
 }
 
-}  // namespace esphome::adc
+}  // namespace adc
+}  // namespace esphome
 #endif

esphome/components/adc/sensor.py

@@ -2,11 +2,7 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
-from esphome.components.esp32 import (
-    get_esp32_variant,
-    include_builtin_idf_component,
-    require_adc_oneshot_iram,
-)
+from esphome.components.esp32 import get_esp32_variant, include_builtin_idf_component
 from esphome.components.nrf52.const import AIN_TO_GPIO, EXTRA_ADC
 from esphome.components.zephyr import (
     zephyr_add_overlay,
@@ -28,7 +24,6 @@ from esphome.const import (
     PlatformFramework,
 )
 from esphome.core import CORE
-from esphome.types import ConfigType
 
 from . import (
     ATTENUATION_MODES,
@@ -70,13 +65,6 @@ def validate_config(config):
     return config
 
 
-def _require_adc_iram(config: ConfigType) -> ConfigType:
-    """Register ADC oneshot IRAM requirement during config validation."""
-    if CORE.is_esp32:
-        require_adc_oneshot_iram()
-    return config
-
-
 ADCSensor = adc_ns.class_(
     "ADCSensor", sensor.Sensor, cg.PollingComponent, voltage_sampler.VoltageSampler
 )
@@ -107,7 +95,6 @@ CONFIG_SCHEMA = cv.All(
     )
     .extend(cv.polling_component_schema("60s")),
     validate_config,
-    _require_adc_iram,
 )
 
 CONF_ADC_CHANNEL_ID = "adc_channel_id"

esphome/components/adc128s102/adc128s102.cpp

@@ -1,7 +1,8 @@
 #include "adc128s102.h"
 #include "esphome/core/log.h"
 
-namespace esphome::adc128s102 {
+namespace esphome {
+namespace adc128s102 {
 
 static const char *const TAG = "adc128s102";
 
@@ -27,4 +28,5 @@ uint16_t ADC128S102::read_data(uint8_t channel) {
   return digital_value;
 }
 
-}  // namespace esphome::adc128s102
+}  // namespace adc128s102
+}  // namespace esphome

esphome/components/adc128s102/adc128s102.h

@@ -4,7 +4,8 @@
 #include "esphome/core/hal.h"
 #include "esphome/components/spi/spi.h"
 
-namespace esphome::adc128s102 {
+namespace esphome {
+namespace adc128s102 {
 
 class ADC128S102 : public Component,
                    public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_LOW, spi::CLOCK_PHASE_LEADING,
@@ -18,4 +19,5 @@ class ADC128S102 : public Component,
   uint16_t read_data(uint8_t channel);
 };
 
-}  // namespace esphome::adc128s102
+}  // namespace adc128s102
+}  // namespace esphome

esphome/components/adc128s102/sensor/adc128s102_sensor.cpp

@@ -2,7 +2,8 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome::adc128s102 {
+namespace esphome {
+namespace adc128s102 {
 
 static const char *const TAG = "adc128s102.sensor";
 
@@ -17,4 +18,5 @@ void ADC128S102Sensor::dump_config() {
 float ADC128S102Sensor::sample() { return this->parent_->read_data(this->channel_); }
 void ADC128S102Sensor::update() { this->publish_state(this->sample()); }
 
-}  // namespace esphome::adc128s102
+}  // namespace adc128s102
+}  // namespace esphome

esphome/components/adc128s102/sensor/adc128s102_sensor.h

@@ -7,7 +7,8 @@
 
 #include "../adc128s102.h"
 
-namespace esphome::adc128s102 {
+namespace esphome {
+namespace adc128s102 {
 
 class ADC128S102Sensor : public PollingComponent,
                          public Parented<ADC128S102>,
@@ -23,4 +24,5 @@ class ADC128S102Sensor : public PollingComponent,
  protected:
   uint8_t channel_;
 };
-}  // namespace esphome::adc128s102
+}  // namespace adc128s102
+}  // namespace esphome

esphome/components/addressable_light/addressable_light_display.cpp

@@ -1,7 +1,8 @@
 #include "addressable_light_display.h"
 #include "esphome/core/log.h"
 
-namespace esphome::addressable_light {
+namespace esphome {
+namespace addressable_light {
 
 static const char *const TAG = "addressable_light.display";
 
@@ -65,4 +66,5 @@ void HOT AddressableLightDisplay::draw_absolute_pixel_internal(int x, int y, Col
     this->addressable_light_buffer_[y * this->get_width_internal() + x] = color;
   }
 }
-}  // namespace esphome::addressable_light
+}  // namespace addressable_light
+}  // namespace esphome

esphome/components/addressable_light/addressable_light_display.h

@@ -7,7 +7,8 @@
 
 #include <vector>
 
-namespace esphome::addressable_light {
+namespace esphome {
+namespace addressable_light {
 
 class AddressableLightDisplay : public display::DisplayBuffer {
  public:
@@ -60,4 +61,5 @@ class AddressableLightDisplay : public display::DisplayBuffer {
   optional<uint32_t> last_effect_index_;
   optional<std::function<int(int, int)>> pixel_mapper_f_;
 };
-}  // namespace esphome::addressable_light
+}  // namespace addressable_light
+}  // namespace esphome

esphome/components/ade7880/ade7880.cpp

@@ -13,7 +13,8 @@
 
 #include <cinttypes>
 
-namespace esphome::ade7880 {
+namespace esphome {
+namespace ade7880 {
 
 static const char *const TAG = "ade7880";
 
@@ -312,4 +313,5 @@ void ADE7880::reset_device_() {
   this->store_.reset_pending = true;
 }
 
-}  // namespace esphome::ade7880
+}  // namespace ade7880
+}  // namespace esphome

esphome/components/ade7880/ade7880.h

@@ -16,7 +16,8 @@
 
 #include "ade7880_registers.h"
 
-namespace esphome::ade7880 {
+namespace esphome {
+namespace ade7880 {
 
 struct NeutralChannel {
   void set_current(sensor::Sensor *sens) { this->current = sens; }
@@ -124,4 +125,5 @@ class ADE7880 : public i2c::I2CDevice, public PollingComponent {
   void write_u32_register16_(uint16_t a_register, uint32_t value);
 };
 
-}  // namespace esphome::ade7880
+}  // namespace ade7880
+}  // namespace esphome

esphome/components/ade7880/ade7880_i2c.cpp

@@ -9,7 +9,8 @@
 
 #include "ade7880.h"
 
-namespace esphome::ade7880 {
+namespace esphome {
+namespace ade7880 {
 
 // adapted from https://stackoverflow.com/a/55912127/1886371
 template<size_t Bits, typename T> inline T sign_extend(const T &v) noexcept {
@@ -96,4 +97,5 @@ void ADE7880::write_u32_register16_(uint16_t a_register, uint32_t value) {
   this->write_register16(a_register, reinterpret_cast<uint8_t *>(&out), sizeof(out));
 }
 
-}  // namespace esphome::ade7880
+}  // namespace ade7880
+}  // namespace esphome

esphome/components/ade7880/ade7880_registers.h

@@ -4,7 +4,8 @@
 
 // Source: https://www.analog.com/media/en/technical-documentation/application-notes/AN-1127.pdf
 
-namespace esphome::ade7880 {
+namespace esphome {
+namespace ade7880 {
 
 // DSP Data Memory RAM registers
 constexpr uint16_t AIGAIN = 0x4380;
@@ -241,4 +242,5 @@ constexpr uint8_t DSPWP_SET_RO = (1 << 7);
 // DSPWP_SEL Register Bits
 constexpr uint8_t DSPWP_SEL_SET = 0xAD;
 
-}  // namespace esphome::ade7880
+}  // namespace ade7880
+}  // namespace esphome

esphome/components/ade7953_base/ade7953_base.cpp

@@ -3,13 +3,11 @@
 
 #include <cinttypes>
 
-namespace esphome::ade7953_base {
+namespace esphome {
+namespace ade7953_base {
 
 static const char *const TAG = "ade7953";
 
-constexpr uint16_t CONFIG_DEFAULT = 0x8004u;
-constexpr uint16_t CONFIG_LOCK_BIT = 0x8000u;
-
 static const float ADE_POWER_FACTOR = 154.0f;
 static const float ADE_WATTSEC_POWER_FACTOR = ADE_POWER_FACTOR * ADE_POWER_FACTOR / 3600;
 
@@ -20,12 +18,7 @@ void ADE7953::setup() {
 
   // The chip might take up to 100ms to initialise
   this->set_timeout(100, [this]() {
-    // Lock communication interface (SPI or I2C)
-    uint16_t config_v = CONFIG_DEFAULT;
-    this->ade_read_16(CONFIG_16, &config_v);
-    config_v &= static_cast<uint16_t>(~CONFIG_LOCK_BIT);  // Clear the lock bit
-    this->ade_write_16(CONFIG_16, config_v);
-    // Configure optimum settings according to datasheet
+    // this->ade_write_8(0x0010, 0x04);
     this->ade_write_8(0x00FE, 0xAD);
     this->ade_write_16(0x0120, 0x0030);
     // Set gains
@@ -159,4 +152,5 @@ void ADE7953::update() {
   ADE_PUBLISH(frequency, 223750.0f, 1 + val_16);
 }
 
-}  // namespace esphome::ade7953_base
+}  // namespace ade7953_base
+}  // namespace esphome

esphome/components/ade7953_base/ade7953_base.h

@@ -6,37 +6,34 @@
 
 #include <vector>
 
-namespace esphome::ade7953_base {
+namespace esphome {
+namespace ade7953_base {
 
-static constexpr uint8_t PGA_V_8 =
+static const uint8_t PGA_V_8 =
     0x007;  // PGA_V,  (R/W) Default: 0x00, Unsigned, Voltage channel gain configuration (Bits[2:0])
-static constexpr uint8_t PGA_IA_8 =
+static const uint8_t PGA_IA_8 =
     0x008;  // PGA_IA, (R/W) Default: 0x00, Unsigned, Current Channel A gain configuration (Bits[2:0])
-static constexpr uint8_t PGA_IB_8 =
+static const uint8_t PGA_IB_8 =
     0x009;  // PGA_IB, (R/W) Default: 0x00, Unsigned, Current Channel B gain configuration (Bits[2:0])
 
-static constexpr uint16_t CONFIG_16 = 0x102;  // CONFIG, (R/W) Default: 0x8004, Unsigned, Configuration register
-
-static constexpr uint16_t AIGAIN_32 =
+static const uint32_t AIGAIN_32 =
     0x380;  // AIGAIN, (R/W)   Default: 0x400000, Unsigned,Current channel gain (Current Channel A)(32 bit)
-static constexpr uint16_t AVGAIN_32 =
-    0x381;  // AVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
-static constexpr uint16_t AWGAIN_32 =
+static const uint32_t AVGAIN_32 = 0x381;  // AVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
+static const uint32_t AWGAIN_32 =
     0x382;  // AWGAIN, (R/W)   Default: 0x400000, Unsigned,Active power gain (Current Channel A)(32 bit)
-static constexpr uint16_t AVARGAIN_32 =
+static const uint32_t AVARGAIN_32 =
     0x383;  // AVARGAIN, (R/W) Default: 0x400000, Unsigned, Reactive power gain (Current Channel A)(32 bit)
-static constexpr uint16_t AVAGAIN_32 =
+static const uint32_t AVAGAIN_32 =
     0x384;  // AVAGAIN, (R/W)  Default: 0x400000, Unsigned,Apparent power gain (Current Channel A)(32 bit)
 
-static constexpr uint16_t BIGAIN_32 =
+static const uint32_t BIGAIN_32 =
     0x38C;  // BIGAIN, (R/W)   Default: 0x400000, Unsigned,Current channel gain (Current Channel B)(32 bit)
-static constexpr uint16_t BVGAIN_32 =
-    0x38D;  // BVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
-static constexpr uint16_t BWGAIN_32 =
+static const uint32_t BVGAIN_32 = 0x38D;  // BVGAIN, (R/W)   Default: 0x400000, Unsigned,Voltage channel gain(32 bit)
+static const uint32_t BWGAIN_32 =
     0x38E;  // BWGAIN, (R/W)   Default: 0x400000, Unsigned,Active power gain (Current Channel B)(32 bit)
-static constexpr uint16_t BVARGAIN_32 =
+static const uint32_t BVARGAIN_32 =
     0x38F;  // BVARGAIN, (R/W) Default: 0x400000, Unsigned, Reactive power gain (Current Channel B)(32 bit)
-static constexpr uint16_t BVAGAIN_32 =
+static const uint32_t BVAGAIN_32 =
     0x390;  // BVAGAIN, (R/W)  Default: 0x400000, Unsigned,Apparent power gain (Current Channel B)(32 bit)
 
 class ADE7953 : public PollingComponent, public sensor::Sensor {
@@ -130,4 +127,5 @@ class ADE7953 : public PollingComponent, public sensor::Sensor {
   virtual bool ade_read_32(uint16_t reg, uint32_t *value) = 0;
 };
 
-}  // namespace esphome::ade7953_base
+}  // namespace ade7953_base
+}  // namespace esphome

esphome/components/ade7953_i2c/ade7953_i2c.cpp

@@ -2,7 +2,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::ade7953_i2c {
+namespace esphome {
+namespace ade7953_i2c {
 
 static const char *const TAG = "ade7953";
 
@@ -75,4 +76,5 @@ bool AdE7953I2c::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace esphome::ade7953_i2c
+}  // namespace ade7953_i2c
+}  // namespace esphome

esphome/components/ade7953_i2c/ade7953_i2c.h

@@ -8,7 +8,8 @@
 
 #include <vector>
 
-namespace esphome::ade7953_i2c {
+namespace esphome {
+namespace ade7953_i2c {
 
 class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
  public:
@@ -23,4 +24,5 @@ class AdE7953I2c : public ade7953_base::ADE7953, public i2c::I2CDevice {
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace esphome::ade7953_i2c
+}  // namespace ade7953_i2c
+}  // namespace esphome

esphome/components/ade7953_spi/ade7953_spi.cpp

@@ -2,13 +2,11 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::ade7953_spi {
+namespace esphome {
+namespace ade7953_spi {
 
 static const char *const TAG = "ade7953";
 
-// Datasheet requires at least 1.2µs after clearing CONFIG LOCK_BIT before raising CS
-constexpr uint8_t CONFIG_LOCK_SETTLE_US = 2;
-
 void AdE7953Spi::setup() {
   this->spi_setup();
   ade7953_base::ADE7953::setup();
@@ -34,9 +32,6 @@ bool AdE7953Spi::ade_write_16(uint16_t reg, uint16_t value) {
   this->write_byte16(reg);
   this->transfer_byte(0);
   this->write_byte16(value);
-  if (reg == ade7953_base::CONFIG_16) {
-    delayMicroseconds(CONFIG_LOCK_SETTLE_US);
-  }
   this->disable();
   return false;
 }
@@ -82,4 +77,5 @@ bool AdE7953Spi::ade_read_32(uint16_t reg, uint32_t *value) {
   return false;
 }
 
-}  // namespace esphome::ade7953_spi
+}  // namespace ade7953_spi
+}  // namespace esphome

esphome/components/ade7953_spi/ade7953_spi.h

@@ -8,10 +8,11 @@
 
 #include <vector>
 
-namespace esphome::ade7953_spi {
+namespace esphome {
+namespace ade7953_spi {
 
 class AdE7953Spi : public ade7953_base::ADE7953,
-                   public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH, spi::CLOCK_PHASE_TRAILING,
+                   public spi::SPIDevice<spi::BIT_ORDER_MSB_FIRST, spi::CLOCK_POLARITY_HIGH, spi::CLOCK_PHASE_LEADING,
                                          spi::DATA_RATE_1MHZ> {
  public:
   void setup() override;
@@ -27,4 +28,5 @@ class AdE7953Spi : public ade7953_base::ADE7953,
   bool ade_read_32(uint16_t reg, uint32_t *value) override;
 };
 
-}  // namespace esphome::ade7953_spi
+}  // namespace ade7953_spi
+}  // namespace esphome

esphome/components/ads1115/ads1115.cpp

@@ -2,7 +2,8 @@
 #include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
-namespace esphome::ads1115 {
+namespace esphome {
+namespace ads1115 {
 
 static const char *const TAG = "ads1115";
 static const uint8_t ADS1115_REGISTER_CONVERSION = 0x00;
@@ -207,4 +208,5 @@ float ADS1115Component::request_measurement(ADS1115Multiplexer multiplexer, ADS1
   return millivolts / 1e3f;
 }
 
-}  // namespace esphome::ads1115
+}  // namespace ads1115
+}  // namespace esphome

esphome/components/ads1115/ads1115.h

@@ -5,7 +5,8 @@
 
 #include <vector>
 
-namespace esphome::ads1115 {
+namespace esphome {
+namespace ads1115 {
 
 enum ADS1115Multiplexer {
   ADS1115_MULTIPLEXER_P0_N1 = 0b000,
@@ -59,4 +60,5 @@ class ADS1115Component : public Component, public i2c::I2CDevice {
   bool continuous_mode_;
 };
 
-}  // namespace esphome::ads1115
+}  // namespace ads1115
+}  // namespace esphome

esphome/components/ads1115/sensor/ads1115_sensor.cpp

@@ -2,7 +2,8 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome::ads1115 {
+namespace esphome {
+namespace ads1115 {
 
 static const char *const TAG = "ads1115.sensor";
 
@@ -28,4 +29,5 @@ void ADS1115Sensor::dump_config() {
                 this->multiplexer_, this->gain_, this->resolution_, this->samplerate_);
 }
 
-}  // namespace esphome::ads1115
+}  // namespace ads1115
+}  // namespace esphome

esphome/components/ads1115/sensor/ads1115_sensor.h

@@ -8,7 +8,8 @@
 
 #include "../ads1115.h"
 
-namespace esphome::ads1115 {
+namespace esphome {
+namespace ads1115 {
 
 /// Internal holder class that is in instance of Sensor so that the hub can create individual sensors.
 class ADS1115Sensor : public sensor::Sensor,
@@ -32,4 +33,5 @@ class ADS1115Sensor : public sensor::Sensor,
   ADS1115Samplerate samplerate_;
 };
 
-}  // namespace esphome::ads1115
+}  // namespace ads1115
+}  // namespace esphome

esphome/components/ads1118/__init__.py

@@ -12,15 +12,11 @@ CONF_ADS1118_ID = "ads1118_id"
 ads1118_ns = cg.esphome_ns.namespace("ads1118")
 ADS1118 = ads1118_ns.class_("ADS1118", cg.Component, spi.SPIDevice)
 
-CONFIG_SCHEMA = (
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(ADS1118),
-        }
-    )
-    .extend(spi.spi_device_schema(cs_pin_required=True))
-    .extend(cv.COMPONENT_SCHEMA)
-)
+CONFIG_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(ADS1118),
+    }
+).extend(spi.spi_device_schema(cs_pin_required=True))
 
 
 async def to_code(config):

esphome/components/ads1118/ads1118.cpp

@@ -2,7 +2,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::ads1118 {
+namespace esphome {
+namespace ads1118 {
 
 static const char *const TAG = "ads1118";
 static const uint8_t ADS1118_DATA_RATE_860_SPS = 0b111;
@@ -121,4 +122,5 @@ float ADS1118::request_measurement(ADS1118Multiplexer multiplexer, ADS1118Gain g
   }
 }
 
-}  // namespace esphome::ads1118
+}  // namespace ads1118
+}  // namespace esphome

esphome/components/ads1118/ads1118.h

@@ -4,7 +4,8 @@
 #include "esphome/core/component.h"
 #include "esphome/core/hal.h"
 
-namespace esphome::ads1118 {
+namespace esphome {
+namespace ads1118 {
 
 enum ADS1118Multiplexer {
   ADS1118_MULTIPLEXER_P0_N1 = 0b000,
@@ -40,4 +41,5 @@ class ADS1118 : public Component,
   uint16_t config_{0};
 };
 
-}  // namespace esphome::ads1118
+}  // namespace ads1118
+}  // namespace esphome

esphome/components/ads1118/sensor/ads1118_sensor.cpp

@@ -2,7 +2,8 @@
 
 #include "esphome/core/log.h"
 
-namespace esphome::ads1118 {
+namespace esphome {
+namespace ads1118 {
 
 static const char *const TAG = "ads1118.sensor";
 
@@ -26,4 +27,5 @@ void ADS1118Sensor::update() {
   }
 }
 
-}  // namespace esphome::ads1118
+}  // namespace ads1118
+}  // namespace esphome

esphome/components/ads1118/sensor/ads1118_sensor.h

@@ -8,7 +8,8 @@
 
 #include "../ads1118.h"
 
-namespace esphome::ads1118 {
+namespace esphome {
+namespace ads1118 {
 
 class ADS1118Sensor : public PollingComponent,
                       public sensor::Sensor,
@@ -31,4 +32,5 @@ class ADS1118Sensor : public PollingComponent,
   bool temperature_mode_;
 };
 
-}  // namespace esphome::ads1118
+}  // namespace ads1118
+}  // namespace esphome

esphome/components/ags10/ags10.cpp

@@ -3,7 +3,8 @@
 
 #include <cinttypes>
 
-namespace esphome::ags10 {
+namespace esphome {
+namespace ags10 {
 static const char *const TAG = "ags10";
 
 // Data acquisition.
@@ -191,4 +192,5 @@ template<size_t N> optional<std::array<uint8_t, N>> AGS10Component::read_and_che
 
   return data;
 }
-}  // namespace esphome::ags10
+}  // namespace ags10
+}  // namespace esphome

esphome/components/ags10/ags10.h

@@ -5,7 +5,8 @@
 #include "esphome/core/automation.h"
 #include "esphome/core/component.h"
 
-namespace esphome::ags10 {
+namespace esphome {
+namespace ags10 {
 
 class AGS10Component : public PollingComponent, public i2c::I2CDevice {
  public:
@@ -135,4 +136,5 @@ template<typename... Ts> class AGS10SetZeroPointAction : public Action<Ts...>, p
     }
   }
 };
-}  // namespace esphome::ags10
+}  // namespace ags10
+}  // namespace esphome

esphome/components/ags10/sensor.py

@@ -35,7 +35,7 @@ CONFIG_SCHEMA = (
     cv.Schema(
         {
             cv.GenerateID(): cv.declare_id(AGS10Component),
-            cv.Required(CONF_TVOC): sensor.sensor_schema(
+            cv.Optional(CONF_TVOC): sensor.sensor_schema(
                 unit_of_measurement=UNIT_PARTS_PER_BILLION,
                 icon=ICON_RADIATOR,
                 accuracy_decimals=0,
@@ -97,7 +97,7 @@ AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
 async def ags10newi2caddress_to_code(config, action_id, template_arg, args):
     var = cg.new_Pvariable(action_id, template_arg)
     await cg.register_parented(var, config[CONF_ID])
-    address = await cg.templatable(config[CONF_ADDRESS], args, cg.uint8)
+    address = await cg.templatable(config[CONF_ADDRESS], args, int)
     cg.add(var.set_new_address(address))
     return var
 
@@ -112,9 +112,7 @@ AGS10_SET_ZERO_POINT_ACTION_MODE = {
 AGS10_SET_ZERO_POINT_SCHEMA = cv.Schema(
     {
         cv.GenerateID(): cv.use_id(AGS10Component),
-        cv.Required(CONF_MODE): cv.templatable(
-            cv.enum(AGS10_SET_ZERO_POINT_ACTION_MODE, upper=True)
-        ),
+        cv.Required(CONF_MODE): cv.enum(AGS10_SET_ZERO_POINT_ACTION_MODE, upper=True),
         cv.Optional(CONF_VALUE, default=0xFFFF): cv.templatable(cv.uint16_t),
     },
 )
@@ -129,10 +127,8 @@ AGS10_SET_ZERO_POINT_SCHEMA = cv.Schema(
 async def ags10setzeropoint_to_code(config, action_id, template_arg, args):
     var = cg.new_Pvariable(action_id, template_arg)
     await cg.register_parented(var, config[CONF_ID])
-    mode = await cg.templatable(
-        config.get(CONF_MODE), args, AGS10SetZeroPointActionMode
-    )
+    mode = await cg.templatable(config.get(CONF_MODE), args, enumerate)
     cg.add(var.set_mode(mode))
-    value = await cg.templatable(config[CONF_VALUE], args, cg.uint16)
+    value = await cg.templatable(config[CONF_VALUE], args, int)
     cg.add(var.set_value(value))
     return var

esphome/components/aht10/aht10.cpp

@@ -17,7 +17,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::aht10 {
+namespace esphome {
+namespace aht10 {
 
 static const char *const TAG = "aht10";
 static const uint8_t AHT10_INITIALIZE_CMD[] = {0xE1, 0x08, 0x00};
@@ -159,4 +160,5 @@ void AHT10Component::dump_config() {
   LOG_SENSOR("  ", "Humidity", this->humidity_sensor_);
 }
 
-}  // namespace esphome::aht10
+}  // namespace aht10
+}  // namespace esphome

esphome/components/aht10/aht10.h

@@ -6,7 +6,8 @@
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/components/i2c/i2c.h"
 
-namespace esphome::aht10 {
+namespace esphome {
+namespace aht10 {
 
 enum AHT10Variant { AHT10, AHT20 };
 
@@ -30,4 +31,5 @@ class AHT10Component : public PollingComponent, public i2c::I2CDevice {
   uint32_t start_time_{};
 };
 
-}  // namespace esphome::aht10
+}  // namespace aht10
+}  // namespace esphome

esphome/components/aic3204/aic3204.cpp

@@ -4,7 +4,8 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-namespace esphome::aic3204 {
+namespace esphome {
+namespace aic3204 {
 
 static const char *const TAG = "aic3204";
 
@@ -166,4 +167,5 @@ bool AIC3204::write_volume_() {
   return true;
 }
 
-}  // namespace esphome::aic3204
+}  // namespace aic3204
+}  // namespace esphome

esphome/components/aic3204/aic3204.h

@@ -6,7 +6,8 @@
 #include "esphome/core/defines.h"
 #include "esphome/core/hal.h"
 
-namespace esphome::aic3204 {
+namespace esphome {
+namespace aic3204 {
 
 // TLV320AIC3204 Register Addresses
 // Page 0
@@ -82,4 +83,5 @@ class AIC3204 : public audio_dac::AudioDac, public Component, public i2c::I2CDev
   float volume_{0};
 };
 
-}  // namespace esphome::aic3204
+}  // namespace aic3204
+}  // namespace esphome

esphome/components/aic3204/audio_dac.py

@@ -43,7 +43,7 @@ async def aic3204_set_volume_to_code(config, action_id, template_arg, args):
     paren = await cg.get_variable(config[CONF_ID])
     var = cg.new_Pvariable(action_id, template_arg, paren)
 
-    template_ = await cg.templatable(config.get(CONF_MODE), args, cg.uint8)
+    template_ = await cg.templatable(config.get(CONF_MODE), args, int)
     cg.add(var.set_auto_mute_mode(template_))
 
     return var

esphome/components/aic3204/automation.h

@@ -4,7 +4,8 @@
 #include "esphome/core/component.h"
 #include "aic3204.h"
 
-namespace esphome::aic3204 {
+namespace esphome {
+namespace aic3204 {
 
 template<typename... Ts> class SetAutoMuteAction : public Action<Ts...> {
  public:
@@ -18,4 +19,5 @@ template<typename... Ts> class SetAutoMuteAction : public Action<Ts...> {
   AIC3204 *aic3204_;
 };
 
-}  // namespace esphome::aic3204
+}  // namespace aic3204
+}  // namespace esphome

esphome/components/airthings_ble/airthings_listener.cpp

@@ -4,7 +4,8 @@
 
 #ifdef USE_ESP32
 
-namespace esphome::airthings_ble {
+namespace esphome {
+namespace airthings_ble {
 
 static const char *const TAG = "airthings_ble";
 
@@ -28,6 +29,7 @@ bool AirthingsListener::parse_device(const esp32_ble_tracker::ESPBTDevice &devic
   return false;
 }
 
-}  // namespace esphome::airthings_ble
+}  // namespace airthings_ble
+}  // namespace esphome
 
 #endif