Dev to Main

.github/dependabot.yml

@@ -11,7 +11,7 @@ updates:
 
   # Update ook GitHub Actions workflows
   - package-ecosystem: "github-actions"
-    directory: "/"              
+    directory: "/"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -2,10 +2,21 @@ name: CI
 
 on:
   push:
-    branches: ["dev", "feature/**", "fix/**", "hotfix/**"]
+    # main is included because releases are cut from it: the tag is created on
+    # main through the GitHub UI and release.yml builds the shipped ZIP from
+    # that tag. Without main here, the merge commit that reaches users is
+    # never tested as it ships — only as a pull request, before the merge.
+    branches: ["main", "dev", "feature/**", "fix/**", "hotfix/**"]
     tags-ignore: ["**"]
   pull_request:
     branches: [dev, main]
+  # pytest-homeassistant-custom-component is deliberately unpinned, so the
+  # suite tracks whatever Home Assistant is current. That means a Home
+  # Assistant release can break this integration without anyone touching the
+  # repository — the weekly run surfaces it instead of the next contributor.
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
 
 concurrency:
   group: ci-${{ github.ref }}
@@ -19,37 +30,70 @@ jobs:
     name: Lint & pre-commit
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
-          python-version: "3.13"
+          python-version: "3.14"
+          cache: pip
+
+      - name: Install dependencies
+        run: pip install pre-commit mypy -r requirements.txt
 
-      - name: Install pre-commit
-        run: pip install pre-commit
+      - name: Cache pre-commit hooks
+        uses: actions/cache@v6
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
 
       - name: Run pre-commit
         run: pre-commit run --all-files
 
+      # The pre-commit hook above type checks against homeassistant-stubs; this
+      # run uses the real homeassistant package from requirements.txt, which
+      # catches what the stubs leave as Incomplete.
+      - name: Run mypy
+        run: mypy custom_components/simple_pid_controller/
+
   test:
-    name: Test (Python 3.13)
+    # Home Assistant's supported Python floor decides which Home Assistant
+    # version pip can install. On 3.13 the newest resolvable release is
+    # 2026.2.3, because Home Assistant 2026.3 onwards requires Python 3.14.2.
+    # Testing only on 3.13 therefore validates against a Home Assistant that
+    # is months behind what users run, without saying so anywhere.
+    #
+    # 3.14 is the version that matters; 3.13 is kept so the older supported
+    # Home Assistant line does not silently break.
+    name: Test (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.14", "3.13"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
-          python-version: "3.13"
+          python-version: ${{ matrix.python-version }}
           cache: pip
 
       - name: Install dependencies
         run: pip install -r requirements.txt
 
+      # Which Home Assistant a green run actually proves compatibility with is
+      # otherwise invisible, since the dependency is unpinned by design.
+      - name: Report the resolved Home Assistant version
+        run: |
+          HA_VERSION=$(pip show homeassistant | awk '/^Version:/ {print $2}')
+          echo "Python ${{ matrix.python-version }} resolved Home Assistant $HA_VERSION"
+          echo "- Python \`${{ matrix.python-version }}\` → Home Assistant \`$HA_VERSION\`" >> "$GITHUB_STEP_SUMMARY"
+
       - name: Run pytest
         run: pytest --cov=custom_components --cov-report=xml -q
 
       - name: Upload coverage
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@v7
         with:
           files: ./coverage.xml
           fail_ci_if_error: false
@@ -58,7 +102,7 @@ jobs:
     name: HACS validation
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: hacs/action@main
         with:
@@ -68,6 +112,6 @@ jobs:
     name: Home Assistant hassfest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: home-assistant/actions/hassfest@master

.github/workflows/label-issues.yml

@@ -12,7 +12,7 @@ jobs:
     name: Automatically label issues
     runs-on: ubuntu-latest
     steps:
-      - uses: github/issue-labeler@v3.4
+      - uses: github/issue-labeler@v3.5
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/labeler.yml

.github/workflows/label-prs.yml

@@ -13,7 +13,7 @@ jobs:
     name: Automatically label PRs by changed files
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@v7
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: .github/pr-labeler.yml

.github/workflows/release.yml

@@ -1,8 +1,13 @@
 name: Create Release
 
+# Triggered by publishing the release, not by the tag push, so the workflow
+# can read the release you created and honour the "Previous tag" you picked
+# there. GitHub does not expose that choice as a field — the only durable
+# trace is the compare link in the notes it generates — so it is recovered
+# from the release body below.
 on:
-  push:
-    tags: ["v*.*.*"]
+  release:
+    types: [published]
 
 permissions:
   contents: write
@@ -12,14 +17,44 @@ jobs:
     name: Build ZIP and create GitHub Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event.release.tag_name }}
 
       - name: Get version from tag
         id: version
         run: |
-          VERSION=${GITHUB_REF_NAME#v}
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          TAG="${{ github.event.release.tag_name }}"
+          echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+
+      - name: Resolve previous tag from the release notes
+        id: prev
+        env:
+          # Quoted via env rather than inlined, so a body containing quotes or
+          # backticks cannot break out of the script.
+          BODY: ${{ github.event.release.body }}
+        run: |
+          # "Generate release notes" appends a line of the form:
+          #   **Full Changelog**: https://github.com/OWNER/REPO/compare/v1.5.1...v1.5.2
+          # The tag before "..." is exactly the previous release that was
+          # selected in the UI. Take the last occurrence, in case the body
+          # quotes other compare links above it.
+          FROM_TAG=$(printf '%s\n' "$BODY" \
+            | sed -nE 's#.*/compare/([^/[:space:]]+)\.\.\.[^[:space:])]+.*#\1#p' \
+            | tail -1)
+          if [ -n "$FROM_TAG" ]; then
+            echo "Using previous tag from the release notes: $FROM_TAG"
+          else
+            echo "No compare link in the release body; letting the changelog"
+            echo "builder fall back to the most recent tag."
+          fi
+          echo "from_tag=$FROM_TAG" >> $GITHUB_OUTPUT
 
+      # Tags are created by hand in the GitHub UI, so nothing has written the
+      # new version into manifest.json by the time this runs — the tagged
+      # commit still carries the previous one. The ZIP is patched here so the
+      # shipped manifest matches the tag. This edit is local to the runner and
+      # is never committed back.
       - name: Update version in manifest.json
         run: |
           sed -i 's/"version": "[^"]*"/"version": "${{ steps.version.outputs.version }}"/' \
@@ -34,6 +69,9 @@ jobs:
         id: changelog
         uses: mikepenz/release-changelog-builder-action@v6
         with:
+          # Empty fromTag = keep the action's own "most recent tag" detection.
+          fromTag: ${{ steps.prev.outputs.from_tag }}
+          toTag: ${{ github.event.release.tag_name }}
           commitMode: true
           configuration: |
             {
@@ -61,6 +99,9 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v3
         with:
+          # The release already exists (this runs on publish); naming the tag
+          # makes it update that one instead of guessing from the ref.
+          tag_name: ${{ github.event.release.tag_name }}
           files: simple_pid_controller.zip
           body: |
             ${{ steps.changelog.outputs.changelog }}

.github/workflows/stale.yml

@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           operations-per-run: 200

.github/workflows/sync-labels.yml

@@ -14,7 +14,7 @@ jobs:
     name: Sync repository labels
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - uses: EndBug/label-sync@v2
         with: