ci.yaml

name: CI
run-name: "${{ github.event_name == 'workflow_dispatch' && format('CI: {0}', github.ref_name) || '' }}"

# yamllint disable-line rule:truthy
on:
  push:
    branches:
      - dev
      - rc
      - master
  pull_request: ~
  workflow_dispatch:
    inputs:
      full:
        description: "Full run (regardless of changes)"
        default: false
        type: boolean
      lint-only:
        description: "Skip pytest"
        default: false
        type: boolean
      skip-coverage:
        description: "Skip coverage"
        default: false
        type: boolean
      pylint-only:
        description: "Only run pylint"
        default: false
        type: boolean
      mypy-only:
        description: "Only run mypy"
        default: false
        type: boolean
      audit-licenses-only:
        description: "Only run audit licenses"
        default: false
        type: boolean

env:
  CACHE_VERSION: 4
  MYPY_CACHE_VERSION: 1
  HA_SHORT_VERSION: "2026.10"
  ADDITIONAL_PYTHON_VERSIONS: "[]"
  # LTS versions: 10.3, 10.6, 10.11, 11.4, 11.8, 12.3
  # - 10.3 and 10.6 are the versions currently phased out until 2027.3
  # - 10.11.2 is the oldest supported long term version (as of September 2026)
  # - 11.4.9 is used in Alpine 3.23 (used in latest HA base images as of April 2026)
  # - 11.8.8 is used in Alpine 3.24 (used in latest HA base images as of July 2026)
  # - 12.3.3 is the latest supported long term version (as of September 2026),
  #   the last mariadb entry is bumped by Renovate when a new LTS is released
  # mysql 8.0.32 does not always behave the same as MariaDB
  # and some queries that work on MariaDB do not work on MySQL
  MARIADB_VERSIONS: "['mariadb:10.3.32','mariadb:10.6.10','mariadb:10.11.2','mariadb:11.4.9','mariadb:11.8.8','mariadb:12.3.3','mysql:8.0.32']"
  # 12 is the oldest supported version
  # 15 is a supported version
  # 18 is the latest version
  # Renovate keeps each entry on the latest release of its major version
  POSTGRESQL_VERSIONS: "['postgres:12.22','postgres:15.19', 'postgres:18.6']"
  # 3.40.1 is the oldest supported version (recorder MIN_VERSION_SQLITE),
  # shipped in Debian 12 (bookworm)
  # 3.53.4 is the latest (as of 25 Aug 2026) and the version shipped with
  # HA OS and the official container images (Alpine 3.24); when bumping the
  # latest, keep an entry for the version the container images ship
  # The year is part of the sqlite.org amalgamation download URL
  SQLITE_VERSIONS: '[{"version": "3.40.1", "year": "2022"}, {"version": "3.53.4", "year": "2026"}]'
  RECORDER_TEST_DIRS: >-
    tests/components/history
    tests/components/logbook
    tests/components/recorder
    tests/components/sensor
  UV_CACHE_DIR: /tmp/uv-cache
  APT_CACHE_VERSION: 1
  SQLALCHEMY_WARN_20: 1
  PYTHONASYNCIODEBUG: 1
  HASS_CI: 1

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  info:
    name: Collect information & changes data
    runs-on: ubuntu-24.04
    permissions:
      contents: read # To check out the repository
      pull-requests: read # For paths-filter to detect changed files
    outputs:
      # In case of issues with the partial run, use the following line instead:
      # test_full_suite: 'true'
      core: ${{ steps.core.outputs.changes }}
      integrations_glob: ${{ steps.info.outputs.integrations_glob }}
      integrations: ${{ steps.integrations.outputs.changes }}
      python_cache_key: ${{ steps.generate_python_cache_key.outputs.key }}
      requirements: ${{ steps.core.outputs.requirements }}
      mariadb_groups: ${{ steps.info.outputs.mariadb_groups }}
      postgresql_groups: ${{ steps.info.outputs.postgresql_groups }}
      sqlite_groups: ${{ steps.info.outputs.sqlite_groups }}
      python_versions: ${{ steps.info.outputs.python_versions }}
      default_python: ${{ steps.info.outputs.default_python }}
      uv_version: ${{ steps.info.outputs.uv_version }}
      test_full_suite: ${{ steps.info.outputs.test_full_suite }}
      test_group_count: ${{ steps.info.outputs.test_group_count }}
      test_groups: ${{ steps.info.outputs.test_groups }}
      tests_glob: ${{ steps.info.outputs.tests_glob }}
      tests: ${{ steps.info.outputs.tests }}
      lint_only: ${{ steps.info.outputs.lint_only }}
      skip_coverage: ${{ steps.info.outputs.skip_coverage }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Generate partial Python venv restore key
        id: generate_python_cache_key
        env:
          HASH_REQUIREMENTS_TEST: ${{ hashFiles('requirements_test.txt', 'requirements_test_pre_commit.txt') }}
          HASH_REQUIREMENTS: ${{ hashFiles('requirements.txt') }}
          HASH_REQUIREMENTS_ALL: ${{ hashFiles('requirements_all.txt') }}
          HASH_PACKAGE_CONSTRAINTS: ${{ hashFiles('homeassistant/package_constraints.txt') }}
          HASH_GEN_REQUIREMENTS: ${{ hashFiles('script/gen_requirements_all.py') }}
        run: |
          # Include HA_SHORT_VERSION to force the immediate creation
          # of a new uv cache entry after a version bump.
          echo "key=venv-${CACHE_VERSION}-${HA_SHORT_VERSION}-${HASH_REQUIREMENTS_TEST}-${HASH_REQUIREMENTS}-${HASH_REQUIREMENTS_ALL}-${HASH_PACKAGE_CONSTRAINTS}-${HASH_GEN_REQUIREMENTS}" >> $GITHUB_OUTPUT
      - name: Filter for core changes
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: core
        with:
          filters: .core_files.yaml
      - name: Create a list of integrations to filter for changes
        run: |
          integrations=$(ls -Ad ./homeassistant/components/[!_]*  | xargs -n 1 basename)
          touch .integration_paths.yaml
          for integration in $integrations; do
            echo "${integration}: [homeassistant/components/${integration}/**, tests/components/${integration}/**]" \
              >> .integration_paths.yaml;
          done
          echo "Result:"
          cat .integration_paths.yaml
      - name: Filter for integration changes
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
        id: integrations
        with:
          filters: .integration_paths.yaml
      - name: Collect additional information
        id: info
        env:
          INTEGRATION_CHANGES: ${{ steps.integrations.outputs.changes }}
          CORE_ANY: ${{ steps.core.outputs.any }}
          INPUT_FULL: ${{ github.event.inputs.full }}
          HAS_CI_FULL_RUN_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'ci-full-run') }}
          INPUT_LINT_ONLY: ${{ github.event.inputs.lint-only }}
          INPUT_PYLINT_ONLY: ${{ github.event.inputs.pylint-only }}
          INPUT_MYPY_ONLY: ${{ github.event.inputs.mypy-only }}
          INPUT_AUDIT_LICENSES_ONLY: ${{ github.event.inputs.audit-licenses-only }}
          REPO_FULL_NAME: ${{ github.event.repository.full_name }}
          INPUT_SKIP_COVERAGE: ${{ github.event.inputs.skip-coverage }}
          HAS_CI_SKIP_COVERAGE_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'ci-skip-coverage') }}
        run: |
          # Defaults
          integrations_glob=""
          mariadb_groups=${MARIADB_VERSIONS}
          postgresql_groups=${POSTGRESQL_VERSIONS}
          sqlite_groups=${SQLITE_VERSIONS}
          test_full_suite="true"
          test_groups="[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]"
          test_group_count=10
          tests="[]"
          tests_glob=""
          lint_only=""
          skip_coverage=""
          default_python=$(cat .python-version)
          all_python_versions=$(jq -cn \
            --arg default_python "${default_python}" \
            --argjson additional_python_versions "${ADDITIONAL_PYTHON_VERSIONS}" \
            '[$default_python] + $additional_python_versions')

          if [[ "${INTEGRATION_CHANGES}" != "[]" ]];
          then
            # Create a space-separated list of integrations
            integrations_glob=$(echo "${INTEGRATION_CHANGES}" | jq -r '. | join(" ")')

            # Create list of testable integrations
            possible_integrations=$(echo "${INTEGRATION_CHANGES}" | jq -cSr '.[]')
            tests=$(
              for integration in ${possible_integrations};
              do
                if [[ -d "tests/components/${integration}" ]]; then
                  echo -n "\"${integration}\",";
                fi;
              done
            )

            [[ ! -z "${tests}" ]] && tests="${tests::-1}"
            tests="[${tests}]"
            test_groups="${tests}"
            # Test group count should be 1, we don't split partial tests
            test_group_count=1

            # Create a space-separated list of test integrations
            tests_glob=$(echo "${tests}" | jq -r '. | join(" ")')

            mariadb_groups="[]"
            postgresql_groups="[]"
            sqlite_groups="[]"
            test_full_suite="false"
          fi

          # We need to run the full suite on certain branches.
          # Or, in case core files are touched, for the full suite as well.
          if [[ "${GITHUB_REF}" == "refs/heads/dev" ]] \
            || [[ "${GITHUB_REF}" == "refs/heads/master" ]] \
            || [[ "${GITHUB_REF}" == "refs/heads/rc" ]] \
            || [[ "${CORE_ANY}" == "true" ]] \
            || [[ "${INPUT_FULL}" == "true" ]] \
            || [[ "${HAS_CI_FULL_RUN_LABEL}" == "true" ]];
          then
            mariadb_groups=${MARIADB_VERSIONS}
            postgresql_groups=${POSTGRESQL_VERSIONS}
            sqlite_groups=${SQLITE_VERSIONS}
            test_groups="[1, 2, 3, 4, 5, 6, 7, 8, 9, 10]"
            test_group_count=10
            test_full_suite="true"
          fi

          if [[ "${INPUT_LINT_ONLY}" == "true" ]] \
            || [[ "${INPUT_PYLINT_ONLY}" == "true" ]] \
            || [[ "${INPUT_MYPY_ONLY}" == "true" ]] \
            || [[ "${INPUT_AUDIT_LICENSES_ONLY}" == "true" ]] \
            || [[ "${GITHUB_EVENT_NAME}" == "push" \
              && "${REPO_FULL_NAME}" != "home-assistant/core" ]];
          then
            lint_only="true"
            skip_coverage="true"
          fi

          if [[ "${INPUT_SKIP_COVERAGE}" == "true" ]] \
            || [[ "${HAS_CI_SKIP_COVERAGE_LABEL}" == "true" ]];
          then
            skip_coverage="true"
          fi

          # Output & sent to GitHub Actions
          echo "mariadb_groups: ${mariadb_groups}"
          echo "mariadb_groups=${mariadb_groups}" >> $GITHUB_OUTPUT
          echo "postgresql_groups: ${postgresql_groups}"
          echo "postgresql_groups=${postgresql_groups}" >> $GITHUB_OUTPUT
          echo "sqlite_groups: ${sqlite_groups}"
          echo "sqlite_groups=${sqlite_groups}" >> $GITHUB_OUTPUT
          echo "python_versions: ${all_python_versions}"
          echo "python_versions=${all_python_versions}" >> $GITHUB_OUTPUT
          echo "default_python: ${default_python}"
          echo "default_python=${default_python}" >> $GITHUB_OUTPUT
          uv_version=$(grep '^uv==' requirements.txt | cut -d'=' -f3)
          echo "uv_version: ${uv_version}"
          echo "uv_version=${uv_version}" >> $GITHUB_OUTPUT
          echo "test_full_suite: ${test_full_suite}"
          echo "test_full_suite=${test_full_suite}" >> $GITHUB_OUTPUT
          echo "integrations_glob: ${integrations_glob}"
          echo "integrations_glob=${integrations_glob}" >> $GITHUB_OUTPUT
          echo "test_group_count: ${test_group_count}"
          echo "test_group_count=${test_group_count}" >> $GITHUB_OUTPUT
          echo "test_groups: ${test_groups}"
          echo "test_groups=${test_groups}" >> $GITHUB_OUTPUT
          echo "tests: ${tests}"
          echo "tests=${tests}" >> $GITHUB_OUTPUT
          echo "tests_glob: ${tests_glob}"
          echo "tests_glob=${tests_glob}" >> $GITHUB_OUTPUT
          echo "lint_only": ${lint_only}
          echo "lint_only=${lint_only}" >> $GITHUB_OUTPUT
          echo "skip_coverage: ${skip_coverage}"
          echo "skip_coverage=${skip_coverage}" >> $GITHUB_OUTPUT

  prek:
    name: Run prek checks
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs: [info]
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Register problem matchers
        run: |
          echo "::add-matcher::.github/workflows/matchers/yamllint.json"
          echo "::add-matcher::.github/workflows/matchers/check-json.json"
          echo "::add-matcher::.github/workflows/matchers/check-executables-have-shebangs.json"
          echo "::add-matcher::.github/workflows/matchers/codespell.json"
      - name: Run prek
        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
        env:
          PREK_SKIP: no-commit-to-branch,mypy,pylint,gen_requirements_all,hassfest,hassfest-metadata,hassfest-mypy-config,zizmor
          RUFF_OUTPUT_FORMAT: github

  zizmor:
    name: Check GitHub Actions workflows
    runs-on: ubuntu-24.04
    permissions:
      contents: read # To check out the repository
    needs: [info]
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Run zizmor
        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
        with:
          extra-args: --all-files zizmor

  lint-hadolint:
    name: Check ${{ matrix.file }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs: [info]
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    strategy:
      fail-fast: false
      matrix:
        file:
          - Dockerfile
          - Dockerfile.dev
          - script/hassfest/docker/Dockerfile
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Register hadolint problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/hadolint.json"
      - name: Check ${{ matrix.file }}
        uses: docker://hadolint/hadolint:v2.15.1@sha256:32dac94127fd60b7b7e3fbfc65e1383b9b5e25c9bfd7b8536de7a539fe68a12d
        with:
          args: hadolint ${{ matrix.file }}

  base:
    name: Prepare dependencies
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs: [info]
    timeout-minutes: 60
    strategy:
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python ${{ matrix.python-version }} and build venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
          save: "true"
      - name: Dump pip freeze
        run: |
          . venv/bin/activate
          python --version
          uv pip freeze >> pip_freeze.txt
      - name: Upload pip_freeze artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pip-freeze-${{ matrix.python-version }}
          path: pip_freeze.txt
          overwrite: true
      - name: Remove pip_freeze
        run: rm pip_freeze.txt
      - name: Check dirty
        run: |
          ./script/check_dirty

  hassfest:
    name: Check hassfest
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: libturbojpeg
          version: ${{ env.APT_CACHE_VERSION }}
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Run hassfest
        run: |
          . venv/bin/activate
          python -m script.hassfest --requirements --action validate

  gen-requirements-all:
    name: Check all requirements
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Run gen_requirements_all.py
        run: |
          . venv/bin/activate
          python -m script.gen_requirements_all validate

  gen-copilot-instructions:
    name: Check copilot instructions
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: python
        uses: $/.github/actions/setup-uv-python
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
      - name: Run gen_copilot_instructions.py
        run: |
          uv run --no-project python -m script.gen_copilot_instructions validate

  gen-recorder-db-versions:
    name: Check recorder database versions
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
    # Only run on push to the dev branch; this job reaches out to endoflife.date, and
    # we do not want a new MariaDB/MySQL release to fail CI on PR runs or the rc/master
    # branches.
    if: github.event_name == 'push' && github.ref == 'refs/heads/dev'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python
        id: python
        uses: $/.github/actions/setup-uv-python
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
      - name: Check MariaDB and MySQL versions are up to date
        run: |
          uv run --no-project python -m script.gen_recorder_db_versions validate

  dependency-review:
    name: Dependency review
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.mypy-only != 'true'
      && needs.info.outputs.requirements == 'true'
      && github.event_name == 'pull_request'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          license-check: false # We use our own license audit checks

  audit-licenses:
    name: Audit licenses
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    if: |
      (github.event.inputs.pylint-only != 'true'
        && github.event.inputs.mypy-only != 'true'
        || github.event.inputs.audit-licenses-only == 'true')
      && needs.info.outputs.requirements == 'true'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Extract license data
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python -m script.licenses extract --output-file=licenses-${PYTHON_VERSION}.json
      - name: Upload licenses
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: licenses-${{ github.run_number }}-${{ matrix.python-version }}
          path: licenses-${{ matrix.python-version }}.json
      - name: Check licenses
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python -m script.licenses check licenses-${PYTHON_VERSION}.json

  pylint:
    name: Check pylint
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    timeout-minutes: 20
    if: |
      github.event.inputs.mypy-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
      || github.event.inputs.pylint-only == 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register pylint problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/pylint.json"
      - name: Run pylint (fully)
        if: needs.info.outputs.test_full_suite == 'true'
        run: |
          . venv/bin/activate
          python --version
          pylint --ignore-missing-annotations=y homeassistant
      - name: Run pylint (partially)
        if: needs.info.outputs.test_full_suite == 'false'
        shell: bash
        env:
          INTEGRATIONS_GLOB: ${{ needs.info.outputs.integrations_glob }}
        run: |
          . venv/bin/activate
          python --version
          pylint --ignore-missing-annotations=y $(printf "homeassistant/components/%s " ${INTEGRATIONS_GLOB})

  pylint-tests:
    name: Check pylint on tests
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    timeout-minutes: 20
    if: |
      (github.event.inputs.mypy-only != 'true'
        && github.event.inputs.audit-licenses-only != 'true'
        || github.event.inputs.pylint-only == 'true')
      && (needs.info.outputs.tests_glob || needs.info.outputs.test_full_suite == 'true')
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register pylint problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/pylint.json"
      - name: Run pylint (fully)
        if: needs.info.outputs.test_full_suite == 'true'
        run: |
          . venv/bin/activate
          python --version
          pylint tests
      - name: Run pylint (partially)
        if: needs.info.outputs.test_full_suite == 'false'
        shell: bash
        env:
          TESTS_GLOB: ${{ needs.info.outputs.tests_glob }}
        run: |
          . venv/bin/activate
          python --version
          pylint $(printf "tests/components/%s " ${TESTS_GLOB})

  mypy:
    name: Check mypy
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
    if: |
      github.event.inputs.pylint-only != 'true'
      && github.event.inputs.audit-licenses-only != 'true'
      || github.event.inputs.mypy-only == 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Generate partial mypy restore key
        id: generate-mypy-key
        run: |
          mypy_version=$(cat requirements_test.txt | grep 'mypy.*=' | cut -d '=' -f 3)
          echo "version=${mypy_version}" >> $GITHUB_OUTPUT
          echo "key=mypy-${MYPY_CACHE_VERSION}-${mypy_version}-${HA_SHORT_VERSION}-$(date -u '+%Y-%m-%dT%H:%M:%s')" >> $GITHUB_OUTPUT
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Restore mypy cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: .mypy_cache
          key: >-
            ${{ runner.os }}-${{ runner.arch }}-${{ steps.python.outputs.python-version }}-${{
            steps.generate-mypy-key.outputs.key }}
          restore-keys: |
            ${{ runner.os }}-${{ runner.arch }}-${{ steps.python.outputs.python-version }}-mypy-${{
            env.MYPY_CACHE_VERSION }}-${{ steps.generate-mypy-key.outputs.version }}-${{
            env.HA_SHORT_VERSION }}-
      - name: Register mypy problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/mypy.json"
      - name: Run mypy (fully)
        if: needs.info.outputs.test_full_suite == 'true'
        run: |
          . venv/bin/activate
          python --version
          mypy --num-workers=4 homeassistant pylint
      - name: Run mypy (partially)
        if: needs.info.outputs.test_full_suite == 'false'
        shell: bash
        env:
          INTEGRATIONS_GLOB: ${{ needs.info.outputs.integrations_glob }}
        run: |
          . venv/bin/activate
          python --version
          mypy --num-workers=4 $(printf "homeassistant/components/%s " ${INTEGRATIONS_GLOB})

  benchmarks:
    name: Run benchmarks
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write # OIDC token CodSpeed mints (no CODSPEED_TOKEN secret)
    needs:
      - info
      - base
    # Run only when core code or the benchmark suite itself changed. Skipped on
    # forks, where the OIDC token CodSpeed needs is unavailable. Pushes to dev
    # that touch core refresh the CodSpeed baseline.
    if: >-
      needs.info.outputs.lint_only != 'true'
      && (github.event_name != 'pull_request'
        || !github.event.pull_request.head.repo.fork)
      && (contains(fromJSON(needs.info.outputs.core), 'core')
        || contains(fromJSON(needs.info.outputs.core), 'benchmarks'))
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Run benchmarks
        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
        with:
          mode: simulation,memory
          # No token: auth uses the OIDC id-token minted by the job permissions.
          run: |
            . venv/bin/activate
            pytest benchmarks --codspeed --no-cov -o addopts=""

  prepare-pytest-full:
    name: Split tests for full run
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.test_full_suite == 'true'
    needs:
      - info
      - base
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up Python and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ needs.info.outputs.default_python }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Restore pytest test counts cache
        id: cache-pytest-counts
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: pytest_test_counts.json
          # Primary key is a sentinel; restore-keys pick the most recent
          # prefix match since the real (content-addressed) key isn't
          # known until split_tests.py runs below.
          key: >-
            pytest-counts-${{ runner.os }}-${{ runner.arch }}-${{
            steps.python.outputs.python-version }}-${{
            needs.info.outputs.python_cache_key }}-restore-sentinel
          restore-keys: |
            pytest-counts-${{ runner.os }}-${{ runner.arch }}-${{ steps.python.outputs.python-version }}-${{ needs.info.outputs.python_cache_key }}-
      - name: Run split_tests.py
        env:
          TEST_GROUP_COUNT: ${{ needs.info.outputs.test_group_count }}
        run: |
          . venv/bin/activate
          python -m script.split_tests \
            --cache pytest_test_counts.json \
            ${TEST_GROUP_COUNT} tests
      - name: Hash pytest test counts cache
        id: cache-pytest-counts-hash
        run: |
          echo "hash=$(sha256sum pytest_test_counts.json | cut -d' ' -f1)" \
            >> "$GITHUB_OUTPUT"
      - name: Save pytest test counts cache
        # Content-addressed key: identical content reuses the same entry.
        # Skip the save when the restore already matched that hash.
        if: >-
          !endsWith(
            steps.cache-pytest-counts.outputs.cache-matched-key,
            steps.cache-pytest-counts-hash.outputs.hash
          )
        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: pytest_test_counts.json
          key: >-
            pytest-counts-${{ runner.os }}-${{ runner.arch }}-${{
            steps.python.outputs.python-version }}-${{
            needs.info.outputs.python_cache_key }}-${{
            steps.cache-pytest-counts-hash.outputs.hash }}
      - name: Upload pytest_buckets
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest_buckets
          path: pytest_buckets.txt
          overwrite: true

  pytest-full:
    name: Run tests Python ${{ matrix.python-version }} (${{ matrix.group }})
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
      - gen-requirements-all
      - hassfest
      - prek
      - mypy
      - prepare-pytest-full
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.test_full_suite == 'true'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
        group: ${{ fromJson(needs.info.outputs.test_groups) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
            libxml2-utils
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register Python problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/python.json"
      - name: Download pytest_buckets
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: pytest_buckets
      - name: Compile English translations
        run: |
          . venv/bin/activate
          python3 -m script.translations develop --all
      - name: Run pytest
        timeout-minutes: 60
        id: pytest-full
        env:
          PYTHONDONTWRITEBYTECODE: 1
          SKIP_COVERAGE: ${{ needs.info.outputs.skip_coverage }}
          TEST_GROUP: ${{ matrix.group }}
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python --version
          set -o pipefail
          cov_params=()
          if [[ "${SKIP_COVERAGE}" != "true" ]]; then
            cov_params+=(--cov="homeassistant")
            cov_params+=(--cov-report=xml)
            cov_params+=(--junitxml=junit.xml -o junit_family=legacy)
          fi

          echo "Test group ${TEST_GROUP}: $(sed -n "${TEST_GROUP},1p" pytest_buckets.txt)"
          python3 -b -X dev -m pytest \
            -qq \
            --timeout=9 \
            --durations=0 \
            --durations-min=1 \
            --numprocesses auto \
            --snapshot-details \
            --dist=loadfile \
            ${cov_params[@]} \
            -o console_output_style=count \
            -p no:sugar \
            --exclude-warning-annotations \
            $(sed -n "${TEST_GROUP},1p" pytest_buckets.txt) \
              2>&1 | tee pytest-${PYTHON_VERSION}-${TEST_GROUP}.txt
      - name: Upload pytest output
        if: success() || failure() && steps.pytest-full.conclusion == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest-${{ github.run_number }}-${{ matrix.python-version }}-${{ matrix.group }}
          path: pytest-*.txt
          overwrite: true
      - name: Upload coverage artifact
        if: needs.info.outputs.skip_coverage != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ matrix.python-version }}-${{ matrix.group }}
          path: coverage.xml
          overwrite: true
      - name: Beautify test results
        # For easier identification of parsing errors
        if: needs.info.outputs.skip_coverage != 'true'
        run: |
          xmllint --format "junit.xml" > "junit.xml-tmp"
          mv "junit.xml-tmp" "junit.xml"
      - name: Upload test results artifact
        if: needs.info.outputs.skip_coverage != 'true' && !cancelled()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-full-${{ matrix.python-version }}-${{ matrix.group }}
          path: junit.xml
      - name: Remove pytest_buckets
        run: rm pytest_buckets.txt
      - name: Check dirty
        run: |
          ./script/check_dirty

  pytest-mariadb:
    name: Run ${{ matrix.mariadb-group }} tests Python ${{ matrix.python-version }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    services:
      mariadb:
        image: ${{ matrix.mariadb-group }} # zizmor: ignore[unpinned-images]
        ports:
          - 3306:3306
        env:
          MYSQL_ROOT_PASSWORD: password
        options: >-
          --health-cmd="if command -v mariadb-admin >/dev/null; then mariadb-admin ping -uroot -ppassword; else mysqladmin ping -uroot -ppassword; fi"
          --health-interval=5s --health-timeout=2s --health-retries=3
          --tmpfs /var/lib/mysql:size=2g,mode=0750
    needs:
      - info
      - base
      - gen-requirements-all
      - hassfest
      - prek
      - mypy
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.mariadb_groups != '[]'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
        mariadb-group: ${{ fromJson(needs.info.outputs.mariadb_groups) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
            libmariadb-dev-compat
            libxml2-utils
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register Python problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/python.json"
      - name: Install SQL Python libraries
        run: |
          . venv/bin/activate
          uv pip install mysqlclient sqlalchemy_utils
      - name: Compile English translations
        run: |
          . venv/bin/activate
          python3 -m script.translations develop --all
      - name: Run pytest (partially)
        timeout-minutes: 20
        id: pytest-partial
        shell: bash
        env:
          PYTHONDONTWRITEBYTECODE: 1
          MARIADB_GROUP: ${{ matrix.mariadb-group }}
          SKIP_COVERAGE: ${{ needs.info.outputs.skip_coverage }}
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python --version
          set -o pipefail
          mariadb=$(echo "${MARIADB_GROUP}" | sed "s/:/-/g")
          echo "mariadb=${mariadb}" >> $GITHUB_OUTPUT
          cov_params=()
          if [[ "${SKIP_COVERAGE}" != "true" ]]; then
            cov_params+=(--cov="homeassistant.components.recorder")
            cov_params+=(--cov-report=xml)
            cov_params+=(--cov-report=term-missing)
            cov_params+=(--junitxml=junit.xml -o junit_family=legacy)
          fi

          python3 -b -X dev -m pytest \
            -qq \
            --timeout=20 \
            --numprocesses 1 \
            --snapshot-details \
            ${cov_params[@]} \
            -o console_output_style=count \
            --durations=0 \
            --durations-min=10 \
            -p no:sugar \
            --exclude-warning-annotations \
            --dburl=mysql://root:password@127.0.0.1/homeassistant-test \
            ${RECORDER_TEST_DIRS} \
              2>&1 | tee pytest-${PYTHON_VERSION}-${mariadb}.txt
      - name: Upload pytest output
        if: success() || failure() && steps.pytest-partial.conclusion == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest-${{ github.run_number }}-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.mariadb }}
          path: pytest-*.txt
          overwrite: true
      - name: Upload coverage artifact
        if: needs.info.outputs.skip_coverage != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.mariadb }}
          path: coverage.xml
          overwrite: true
      - name: Beautify test results
        # For easier identification of parsing errors
        if: needs.info.outputs.skip_coverage != 'true'
        run: |
          xmllint --format "junit.xml" > "junit.xml-tmp"
          mv "junit.xml-tmp" "junit.xml"
      - name: Upload test results artifact
        if: needs.info.outputs.skip_coverage != 'true' && !cancelled()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-mariadb-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.mariadb }}
          path: junit.xml
      - name: Check dirty
        run: |
          ./script/check_dirty

  pytest-postgres:
    name: Run ${{ matrix.postgresql-group }} tests Python ${{ matrix.python-version }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    services:
      postgres:
        image: ${{ matrix.postgresql-group }} # zizmor: ignore[unpinned-images]
        ports:
          - 5432:5432
        env:
          POSTGRES_PASSWORD: password
          # 18+ images default PGDATA to /var/lib/postgresql/<major>/docker,
          # which is not covered by the tmpfs below
          PGDATA: /var/lib/postgresql/data
        options: >-
          --health-cmd="pg_isready -hlocalhost -Upostgres"
          --health-interval=5s --health-timeout=2s --health-retries=3
          --tmpfs /var/lib/postgresql/data:size=2g,mode=0700
    needs:
      - info
      - base
      - gen-requirements-all
      - hassfest
      - prek
      - mypy
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.postgresql_groups != '[]'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
        postgresql-group: ${{ fromJson(needs.info.outputs.postgresql_groups) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
            libxml2-utils
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up PostgreSQL apt repository
        run: sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y
      - name: Cache PostgreSQL development headers
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: postgresql-server-dev-14
          version: ${{ env.APT_CACHE_VERSION }}
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register Python problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/python.json"
      - name: Install SQL Python libraries
        run: |
          . venv/bin/activate
          uv pip install psycopg2 sqlalchemy_utils
      - name: Compile English translations
        run: |
          . venv/bin/activate
          python3 -m script.translations develop --all
      - name: Run pytest (partially)
        timeout-minutes: 20
        id: pytest-partial
        shell: bash
        env:
          PYTHONDONTWRITEBYTECODE: 1
          POSTGRESQL_GROUP: ${{ matrix.postgresql-group }}
          SKIP_COVERAGE: ${{ needs.info.outputs.skip_coverage }}
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python --version
          set -o pipefail
          postgresql=$(echo "${POSTGRESQL_GROUP}" | sed "s/:/-/g")
          echo "postgresql=${postgresql}" >> $GITHUB_OUTPUT
          cov_params=()
          if [[ "${SKIP_COVERAGE}" != "true" ]]; then
            cov_params+=(--cov="homeassistant.components.recorder")
            cov_params+=(--cov-report=xml)
            cov_params+=(--cov-report=term-missing)
            cov_params+=(--junitxml=junit.xml -o junit_family=legacy)
          fi

          python3 -b -X dev -m pytest \
            -qq \
            --timeout=9 \
            --numprocesses 1 \
            --snapshot-details \
            ${cov_params[@]} \
            -o console_output_style=count \
            --durations=0 \
            --durations-min=10 \
            -p no:sugar \
            --exclude-warning-annotations \
            --dburl=postgresql://postgres:password@127.0.0.1/homeassistant-test \
            ${RECORDER_TEST_DIRS} \
              2>&1 | tee pytest-${PYTHON_VERSION}-${postgresql}.txt
      - name: Upload pytest output
        if: success() || failure() && steps.pytest-partial.conclusion == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest-${{ github.run_number }}-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.postgresql }}
          path: pytest-*.txt
          overwrite: true
      - name: Upload coverage artifact
        if: needs.info.outputs.skip_coverage != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.postgresql }}
          path: coverage.xml
          overwrite: true
      - name: Beautify test results
        # For easier identification of parsing errors
        if: needs.info.outputs.skip_coverage != 'true'
        run: |
          xmllint --format "junit.xml" > "junit.xml-tmp"
          mv "junit.xml-tmp" "junit.xml"
      - name: Upload test results artifact
        if: needs.info.outputs.skip_coverage != 'true' && !cancelled()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-postgres-${{ matrix.python-version }}-${{
            steps.pytest-partial.outputs.postgresql }}
          path: junit.xml
      - name: Check dirty
        run: |
          ./script/check_dirty

  pytest-sqlite:
    name: Run SQLite ${{ matrix.sqlite-group.version }} tests Python ${{ matrix.python-version }}
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
      - gen-requirements-all
      - hassfest
      - prek
      - mypy
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.sqlite_groups != '[]'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
        sqlite-group: ${{ fromJson(needs.info.outputs.sqlite_groups) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
            libxml2-utils
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register Python problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/python.json"
      - name: Restore vendored sqlite3 wheel cache
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/sqlite3-vendor-wheel
          key: >-
            sqlite3-vendor-wheel-${{ runner.os }}-${{ runner.arch }}-${{
            steps.python.outputs.python-version }}-${{
            matrix.sqlite-group.version }}-${{
            hashFiles('script/vendor_sqlite3.py', 'script/sqlite3_vendor/**') }}
      - name: Install sqlite3 module with SQLite ${{ matrix.sqlite-group.version }}
        env:
          SQLITE_VERSION: ${{ matrix.sqlite-group.version }}
          SQLITE_YEAR: ${{ matrix.sqlite-group.year }}
        run: |
          . venv/bin/activate
          python3 -m script.vendor_sqlite3 \
            --version "${SQLITE_VERSION}" \
            --year "${SQLITE_YEAR}" \
            --wheel-dir ~/sqlite3-vendor-wheel
      - name: Compile English translations
        run: |
          . venv/bin/activate
          python3 -m script.translations develop --all
      - name: Run pytest (partially)
        timeout-minutes: 20
        id: pytest-partial
        shell: bash
        env:
          PYTHONDONTWRITEBYTECODE: 1
          EXPECTED_SQLITE_VERSION: ${{ matrix.sqlite-group.version }}
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python --version
          set -o pipefail

          # No coverage collection: these tests already run with coverage in
          # the pytest-full job with the interpreter's own SQLite.
          python3 -b -X dev -m pytest \
            -qq \
            --timeout=20 \
            --numprocesses auto \
            --dist=loadfile \
            --snapshot-details \
            -o console_output_style=count \
            --durations=0 \
            --durations-min=10 \
            -p no:sugar \
            -p tests.sqlite3_shim \
            --exclude-warning-annotations \
            ${RECORDER_TEST_DIRS} \
              2>&1 | tee pytest-${PYTHON_VERSION}-sqlite-${EXPECTED_SQLITE_VERSION}.txt
      - name: Upload pytest output
        if: success() || failure() && steps.pytest-partial.conclusion == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name:
            pytest-${{ github.run_number }}-${{ matrix.python-version }}-sqlite-${{
            matrix.sqlite-group.version }}
          path: pytest-*.txt
          overwrite: true
      - name: Check dirty
        run: |
          ./script/check_dirty

  coverage-full:
    name: Upload test coverage to Codecov (full suite)
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - pytest-full
      - pytest-postgres
      - pytest-mariadb
    timeout-minutes: 10
    if: needs.info.outputs.skip_coverage != 'true'
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Download all coverage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-*
      - name: Upload coverage to Codecov
        if: needs.info.outputs.test_full_suite == 'true'
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          fail_ci_if_error: true
          flags: full-suite
          token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]

  pytest-partial:
    name: Run tests Python ${{ matrix.python-version }} (${{ matrix.group }})
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    needs:
      - info
      - base
      - gen-requirements-all
      - hassfest
      - prek
      - mypy
    if: |
      needs.info.outputs.lint_only != 'true'
      && needs.info.outputs.tests_glob
      && needs.info.outputs.test_full_suite == 'false'
    strategy:
      fail-fast: false
      matrix:
        python-version: ${{ fromJson(needs.info.outputs.python_versions) }}
        group: ${{ fromJson(needs.info.outputs.test_groups) }}
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install additional OS dependencies
        timeout-minutes: 10
        uses: $/.github/actions/cache-apt-packages
        with:
          packages: >-
            bluez
            ffmpeg
            libturbojpeg
            libxml2-utils
          version: ${{ env.APT_CACHE_VERSION }}
          execute_install_scripts: true
      - name: Set up Python ${{ matrix.python-version }} and restore venv
        id: python
        uses: $/.github/actions/restore-or-build-venv
        with:
          uv-version: ${{ needs.info.outputs.uv_version }}
          python-version: ${{ matrix.python-version }}
          python-cache-key: ${{ needs.info.outputs.python_cache_key }}
          uv-cache-dir: ${{ env.UV_CACHE_DIR }}
          apt-cache-version: ${{ env.APT_CACHE_VERSION }}
      - name: Register Python problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/python.json"
      - name: Register pytest slow test problem matcher
        run: |
          echo "::add-matcher::.github/workflows/matchers/pytest-slow.json"
      - name: Compile English translations
        run: |
          . venv/bin/activate
          python3 -m script.translations develop --all
      - name: Run pytest
        timeout-minutes: 10
        id: pytest-partial
        shell: bash
        env:
          PYTHONDONTWRITEBYTECODE: 1
          TEST_GROUP: ${{ matrix.group }}
          SKIP_COVERAGE: ${{ needs.info.outputs.skip_coverage }}
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: |
          . venv/bin/activate
          python --version
          set -o pipefail

          if [[ ! -f "tests/components/${TEST_GROUP}/__init__.py" ]]; then
            echo "::error:: missing file tests/components/${TEST_GROUP}/__init__.py"
            exit 1
          fi

          cov_params=()
          if [[ "${SKIP_COVERAGE}" != "true" ]]; then
            cov_params+=(--cov="homeassistant.components.${TEST_GROUP}")
            cov_params+=(--cov-report=xml)
            cov_params+=(--cov-report=term-missing)
            cov_params+=(--junitxml=junit.xml -o junit_family=legacy)
          fi

          python3 -b -X dev -m pytest \
            -qq \
            --timeout=9 \
            --numprocesses auto \
            --snapshot-details \
            ${cov_params[@]} \
            -o console_output_style=count \
            --durations=0 \
            --durations-min=1 \
            -p no:sugar \
            --exclude-warning-annotations \
            tests/components/${TEST_GROUP} \
              2>&1 | tee pytest-${PYTHON_VERSION}-${TEST_GROUP}.txt
      - name: Upload pytest output
        if: success() || failure() && steps.pytest-partial.conclusion == 'failure'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: pytest-${{ github.run_number }}-${{ matrix.python-version }}-${{ matrix.group }}
          path: pytest-*.txt
          overwrite: true
      - name: Upload coverage artifact
        if: needs.info.outputs.skip_coverage != 'true'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-${{ matrix.python-version }}-${{ matrix.group }}
          path: coverage.xml
          overwrite: true
      - name: Beautify test results
        # For easier identification of parsing errors
        if: needs.info.outputs.skip_coverage != 'true'
        run: |
          xmllint --format "junit.xml" > "junit.xml-tmp"
          mv "junit.xml-tmp" "junit.xml"
      - name: Upload test results artifact
        if: needs.info.outputs.skip_coverage != 'true' && !cancelled()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: test-results-partial-${{ matrix.python-version }}-${{ matrix.group }}
          path: junit.xml
      - name: Check dirty
        run: |
          ./script/check_dirty

  coverage-partial:
    name: Upload test coverage to Codecov (partial suite)
    if: needs.info.outputs.skip_coverage != 'true'
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    timeout-minutes: 10
    needs:
      - info
      - pytest-partial
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Download all coverage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: coverage-*
      - name: Upload coverage to Codecov
        if: needs.info.outputs.test_full_suite == 'false'
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          fail_ci_if_error: true
          token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]

  upload-test-results:
    name: Upload test results to Codecov
    runs-on: ubuntu-24.04
    needs:
      - info
      - pytest-partial
      - pytest-full
      - pytest-postgres
      - pytest-mariadb
    timeout-minutes: 10
    permissions:
      id-token: write # For Codecov OIDC upload
    # codecov/test-results-action currently doesn't support tokenless uploads
    # therefore we can't run it on forks
    if: |
      (github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork)
      && needs.info.outputs.skip_coverage != 'true' && !cancelled()
    steps:
      - name: Download all coverage artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: test-results-*
      - name: Upload test results to Codecov
        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
        with:
          report_type: test_results
          fail_ci_if_error: true
          verbose: true
          use_oidc: true