Skip to content

Promote develop to main #120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ptr727 merged 3 commits into from
Jul 5, 2026
Merged

Promote develop to main #120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3a25aff
Update upstream versions: device_builder to 1.0.28 (#115)
ptr727-codegen[bot] Jul 4, 2026
fe68ece
Update upstream versions: device_builder to 1.0.29 (#117)
ptr727-codegen[bot] Jul 5, 2026
7314357
Add editorconfig CRLF default and renormalize workflow YAML (#119)
ptr727 Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .editorconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ root = true
# Defaults
[*]
charset = utf-8
end_of_line = crlf
indent_size = 4
indent_style = space
insert_final_newline = true
Expand Down
242 changes: 121 additions & 121 deletions .github/workflows/build-docker-task.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,121 +1,121 @@
name: Build Docker image task

# Builds the multi-arch image (linux/amd64,arm64) and, on a main publish, pushes it plus the Docker Hub overview.
# Branch drives tags: main => latest + the pinned esphome-version tag, else develop, plus the `:SemVer2` tag. Smoke
# builds amd64 only and never pushes; registry buildcache is branch-scoped. The orchestrator passes `branch` explicitly
# (the publisher builds one branch per run - the trigger ref - and smoke passes github.ref_name) and the threaded
# `semver2` from its single NBGV run, so this task never re-runs NBGV on the detached commit.
on:
workflow_call:
inputs:
# Push the built image and the Docker Hub overview.
push:
required: false
type: boolean
default: false
# Git ref to check out (empty = default checkout ref).
ref:
required: false
type: string
default: ''
# Logical branch: main => latest + pinned version tag, else develop. Required (see header).
branch:
required: true
type: string
# Smoke: build linux/amd64 only, never push, skip the shared cache-to. Fast PR feedback.
smoke:
required: false
type: boolean
default: false
# Version from the orchestrator's single NBGV run (threaded). This task does not
# re-run NBGV on the detached commit, which could classify the branch differently.
semver2:
required: true
type: string

jobs:

build-docker:
name: Build Docker image job
runs-on: ubuntu-latest

steps:

- name: Checkout step
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ inputs.ref }}

# Pinned ESPHome + device-builder versions from the committed state file; the ESPHome version drives the
# image tag, both become build-args.
- name: Get pinned versions step
id: esphome
run: |
set -euo pipefail
version="$(jq -r .esphome upstream-version.json)"
if [[ -z "$version" || "$version" == "null" ]]; then
echo "::error::Could not read .esphome from upstream-version.json"
exit 1
fi
device_builder="$(jq -r .device_builder upstream-version.json)"
if [[ -z "$device_builder" || "$device_builder" == "null" ]]; then
echo "::error::Could not read .device_builder from upstream-version.json"
exit 1
fi
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "device_builder=$device_builder" >> "$GITHUB_OUTPUT"

# QEMU only emulates arm64; smoke is amd64-only, so skip it to save setup cost.
- name: Setup QEMU step
if: ${{ !inputs.smoke }}
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
with:
platforms: linux/amd64,linux/arm64

- name: Setup Buildx step
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
platforms: ${{ inputs.smoke && 'linux/amd64' || 'linux/amd64,linux/arm64' }}

# Always login (even on smoke) for higher pull/cache-read rate limits; the credentials are in both the
# Actions and Dependabot secret stores so a Dependabot push CI run can log in too. Forks cannot push here.
- name: Login to Docker Hub step
uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}

- name: Docker build and push step
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
# Context is Docker/ (the Dockerfile only copies entrypoint/).
context: ./Docker
push: ${{ inputs.push }}
file: ./Docker/Dockerfile
# main: latest + the pinned esphome-version tag; develop: develop only (the middle line is empty off
# main, which build-push-action ignores). Every image also carries the `:SemVer2` release tag.
tags: |
docker.io/ptr727/esphome-nonroot:${{ inputs.branch == 'main' && 'latest' || 'develop' }}
${{ inputs.branch == 'main' && format('docker.io/ptr727/esphome-nonroot:{0}', steps.esphome.outputs.version) || '' }}
docker.io/ptr727/esphome-nonroot:${{ inputs.semver2 }}
platforms: ${{ inputs.smoke && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
# Read both branches' caches (near-identical layers), write only this branch's tag and only when pushing.
# mode=max caches the builder publish; ignore-error keeps a cache hiccup from failing a publish.
cache-from: |
type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-main
type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-develop
cache-to: ${{ inputs.push && format('type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-{0},mode=max,ignore-error=true', inputs.branch) || '' }}
build-args: |
LABEL_VERSION=${{ inputs.semver2 }}
ESPHOME_VERSION=${{ steps.esphome.outputs.version }}
DEVICE_BUILDER_VERSION=${{ steps.esphome.outputs.device_builder }}

# Push the trimmed Docker Hub overview from Docker/README.md, main only (one overview, no per-branch context).
- name: Update Docker Hub description step
if: ${{ inputs.push && inputs.branch == 'main' }}
uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
repository: ptr727/esphome-nonroot
readme-filepath: ./Docker/README.md
name: Build Docker image task
# Builds the multi-arch image (linux/amd64,arm64) and, on a main publish, pushes it plus the Docker Hub overview.
# Branch drives tags: main => latest + the pinned esphome-version tag, else develop, plus the `:SemVer2` tag. Smoke
# builds amd64 only and never pushes; registry buildcache is branch-scoped. The orchestrator passes `branch` explicitly
# (the publisher builds one branch per run - the trigger ref - and smoke passes github.ref_name) and the threaded
# `semver2` from its single NBGV run, so this task never re-runs NBGV on the detached commit.
on:
workflow_call:
inputs:
# Push the built image and the Docker Hub overview.
push:
required: false
type: boolean
default: false
# Git ref to check out (empty = default checkout ref).
ref:
required: false
type: string
default: ''
# Logical branch: main => latest + pinned version tag, else develop. Required (see header).
branch:
required: true
type: string
# Smoke: build linux/amd64 only, never push, skip the shared cache-to. Fast PR feedback.
smoke:
required: false
type: boolean
default: false
# Version from the orchestrator's single NBGV run (threaded). This task does not
# re-run NBGV on the detached commit, which could classify the branch differently.
semver2:
required: true
type: string
jobs:
build-docker:
name: Build Docker image job
runs-on: ubuntu-latest
steps:
- name: Checkout step
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ inputs.ref }}
# Pinned ESPHome + device-builder versions from the committed state file; the ESPHome version drives the
# image tag, both become build-args.
- name: Get pinned versions step
id: esphome
run: |
set -euo pipefail
version="$(jq -r .esphome upstream-version.json)"
if [[ -z "$version" || "$version" == "null" ]]; then
echo "::error::Could not read .esphome from upstream-version.json"
exit 1
fi
device_builder="$(jq -r .device_builder upstream-version.json)"
if [[ -z "$device_builder" || "$device_builder" == "null" ]]; then
echo "::error::Could not read .device_builder from upstream-version.json"
exit 1
fi
echo "version=$version" >> "$GITHUB_OUTPUT"
echo "device_builder=$device_builder" >> "$GITHUB_OUTPUT"
# QEMU only emulates arm64; smoke is amd64-only, so skip it to save setup cost.
- name: Setup QEMU step
if: ${{ !inputs.smoke }}
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
with:
platforms: linux/amd64,linux/arm64
- name: Setup Buildx step
uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
with:
platforms: ${{ inputs.smoke && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
# Always login (even on smoke) for higher pull/cache-read rate limits; the credentials are in both the
# Actions and Dependabot secret stores so a Dependabot push CI run can log in too. Forks cannot push here.
- name: Login to Docker Hub step
uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4 # v4.3.0
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
- name: Docker build and push step
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
with:
# Context is Docker/ (the Dockerfile only copies entrypoint/).
context: ./Docker
push: ${{ inputs.push }}
file: ./Docker/Dockerfile
# main: latest + the pinned esphome-version tag; develop: develop only (the middle line is empty off
# main, which build-push-action ignores). Every image also carries the `:SemVer2` release tag.
tags: |
docker.io/ptr727/esphome-nonroot:${{ inputs.branch == 'main' && 'latest' || 'develop' }}
${{ inputs.branch == 'main' && format('docker.io/ptr727/esphome-nonroot:{0}', steps.esphome.outputs.version) || '' }}
docker.io/ptr727/esphome-nonroot:${{ inputs.semver2 }}
platforms: ${{ inputs.smoke && 'linux/amd64' || 'linux/amd64,linux/arm64' }}
# Read both branches' caches (near-identical layers), write only this branch's tag and only when pushing.
# mode=max caches the builder publish; ignore-error keeps a cache hiccup from failing a publish.
cache-from: |
type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-main
type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-develop
cache-to: ${{ inputs.push && format('type=registry,ref=docker.io/ptr727/esphome-nonroot:buildcache-{0},mode=max,ignore-error=true', inputs.branch) || '' }}
build-args: |
LABEL_VERSION=${{ inputs.semver2 }}
ESPHOME_VERSION=${{ steps.esphome.outputs.version }}
DEVICE_BUILDER_VERSION=${{ steps.esphome.outputs.device_builder }}
# Push the trimmed Docker Hub overview from Docker/README.md, main only (one overview, no per-branch context).
- name: Update Docker Hub description step
if: ${{ inputs.push && inputs.branch == 'main' }}
uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
repository: ptr727/esphome-nonroot
readme-filepath: ./Docker/README.md
Loading