Adopt ProjectTemplate Docker release pipeline and conventions

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Brings ESPHome-NonRoot in-line with ptr727/ProjectTemplate (develop) as a Docker-only derived repo, and keeps it consistent with the sibling downstreams homeassistant-purpleair and NxWitness.

Pipeline (template two-layer model)

• Orchestration carried verbatim:get-version-task.yml, build-datebadge-task.yml, publish-release.yml, and the get-version + github-release jobs in build-release-task.yml.
• Build layer (owned):build-docker-task.yml. Dropped the nuget/pypi/executable targets, the publish-pypi job, and the .NET unit-test job from test-pull-request.yml (the ruleset-bound Check pull request workflow status aggregator is preserved).
• Two-phase release (PUBLISH_ON_MERGE unset): PRs smoke-test linux/amd64 only; the weekly schedule + manual dispatch publish both branches.

ESPHome-specific behavior (preserved, sibling-aligned)

• Image tags:latest/:develop + the pinned upstream ESPHome version, also passed as the ESPHOME_VERSION build-arg, read from the committed .github/esphome-version.json.
• check-esphome-version.yml replaces CheckUpstreamRelease.yml, mirroring purpleair's check-ha-version.yml: resolves the latest ESPHome from PyPI and opens a rolling, App-authored, signed bump PR (dual-targeted over main + develop, since the version is shipped content) that merge-bot auto-merges; the next publish ships it.
• publish-docker-readme-task.yml mirrors NxWitness: pushes a static Docker/README.md via DOCKER_HUB_ACCESS_TOKEN, replacing the m4/toolversions machinery and the DOCKER_HUB_PASSWORD secret.

Verbatim carries / config

AGENTS.md (Docker-only adaptation), .github/copilot-instructions.md, .markdownlint-cli2.jsonc, .editorconfig (C# block trimmed, deviation noted inline), .gitattributes. Added a dual-target docker Dependabot ecosystem; pointed the README build badge at publish-release.yml.

Local verification

• actionlint (with shellcheck) and markdownlint-cli2 both clean.
• docker buildx build --platform linux/amd64 --build-arg ESPHOME_VERSION=2026.6.2 succeeds; esphome version in the image reports 2026.6.2, matching the state file.

Two-phase latency note

In the two-phase model, a merged ESPHome-version bump ships on the next weekly/dispatch publish rather than within ~24h (matching NxWitness). Flip PUBLISH_ON_MERGE=true or add a post-merge dispatch if prompt rebuilds are wanted.

Follow-up (maintainer / GitHub-side)

• Import the develop/main rulesets; set PUBLISH_ON_MERGE unset; enable "Allow GitHub Actions to create and approve pull requests".
• Secrets: DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (no more DOCKER_HUB_PASSWORD); create/install the ptr727-codegen GitHub App and add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to the Actions and Dependabot secret stores (powers merge-bot and the version tracker).
• Upstream template-gap issues will be filed at ptr727/ProjectTemplate (no upstream-rebuild pattern, external-version docker tag, unit-test .NET coupling, .editorconfig C# block, no Docker Hub README task).

🤖 Generated with Claude Code

[ptr727]

Maintainer GitHub-side setup runbook

I automated what was safe; the rest needs you. Summary of what I checked:

• Repo already has develop + main rulesets (correctly named) and no classic branch protection - good. But the existing rulesets are minimal (deletion only); they do not enforce signed commits, the required status check, or the per-branch merge methods.
• Allow GitHub Actions to create and approve pull requests is already enabled (can_approve_pull_request_reviews: true); default_workflow_permissions: read is fine (workflows declare explicit per-job permissions:).
• PUBLISH_ON_MERGE is unset = two-phase (intended). Leave it unset.

1. Rulesets - NOT auto-imported (brownfield, maintainer-only)

origin/main and origin/develop each contain 51 unsigned commits in history. The template's rulesets enable Require signed commits, which - per AGENTS.md "Branching Model" and the brownfield migration procedure - can block the first develop -> main release on a repo with unsigned history and requires a force-push re-sign that an AI agent must never perform. So I left the rulesets untouched.

To bring them up to the template (your call):

# Export the template's two rulesets (writable fields only)fornamein develop main;do
id=$(gh api repos/ptr727/ProjectTemplate/rulesets --jq ".[] | select(.name==\"$name\") | .id")
gh api "repos/ptr727/ProjectTemplate/rulesets/$id" \
--jq '{name, target, enforcement, bypass_actors, conditions, rules}'>"$name-ruleset.json"done# Either delete the two minimal same-named rulesets and re-create,# or full-payload PUT them (rename not needed - names already match).# Existing ids: develop=918710 main=918708# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918710# gh api -X DELETE repos/ptr727/ESPHome-NonRoot/rulesets/918708fornamein develop main;do
gh api -X POST repos/ptr727/ESPHome-NonRoot/rulesets --input "$name-ruleset.json"done

Because of the unsigned history, before/after enabling Require signed commits follow the brownfield procedure (re-sign divergent history, temporarily set the ruleset Enforcement to Disabled for the one-time force-push, re-enable). The required status-check context resolves to Check pull request workflow status and only turns green after test-pull-request.yml runs once.

2. Secrets

• DOCKER_HUB_USERNAME, DOCKER_HUB_ACCESS_TOKEN (Actions store; Dependabot store too if needed). The token needs write scope - the Docker buildcache cache-to pushes to the registry (the old type=gha cache did not). DOCKER_HUB_PASSWORD is no longer needed (the README push now uses the access token).
• GitHub App for the bots: create + install ptr727-codegen, then add CODEGEN_APP_CLIENT_ID + CODEGEN_APP_PRIVATE_KEY to both the Actions and Dependabot secret stores. This App powers both merge-bot-pull-request.yml (Dependabot auto-merge) andcheck-esphome-version.yml (the rolling version-bump PR).

3. Verify after merge

workflow_dispatchpublish-release.yml once and confirm: multi-arch image + :develop/:latest + :<esphome-version> tags pushed, a GitHub release at the NBGV SemVer2 tag, date badge updated, the docker-readme job pushing Docker/README.md, and no PyPI/NuGet steps. Then workflow_dispatchcheck-esphome-version.yml to confirm it opens a signed bump PR only when PyPI is ahead of .github/esphome-version.json.

[Copilot]

Pull request overview

Aligns ESPHome-NonRoot with the ptr727/ProjectTemplate “Docker-only derived repo” conventions by replacing the legacy single-workflow build/push model with a two-layer reusable-workflow release pipeline, and by adopting the sibling-style upstream ESPHome version tracker + Docker Hub README publishing.

Changes:

• Replaced the legacy BuildDockerPush.yml / CheckUpstreamRelease.yml workflows with a reusable-workflow orchestration model (publish-release.yml, test-pull-request.yml, and shared *-task.yml building blocks).
• Added an ESPHome upstream version tracker (check-esphome-version.yml) that bumps .github/esphome-version.json via an App-authored PR flow.
• Switched Docker Hub README publishing to a static Docker/README.md pushed via publish-docker-readme-task.yml, and updated repo linting/line-ending governance files (.editorconfig, .markdownlint-cli2.jsonc, .gitattributes).

Reviewed changes

Copilot reviewed 20 out of 21 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
README.md	Updates pipeline references and workflow badge to the new release workflow.
Docker/README.md	Adds a static Docker Hub README source file.
Docker/README.m4	Removes m4-based README generation source.
AGENTS.md	Adds template-derived repo conventions and workflow contracts.
.markdownlint-cli2.jsonc	Adds markdownlint-cli2 configuration aligned to the template.
.github/workflows/test-pull-request.yml	Adds PR smoke-test workflow using reusable tasks and an aggregator check.
.github/workflows/publish-release.yml	Adds orchestrator workflow for scheduled/dispatch publishing and optional publish-on-merge.
.github/workflows/publish-docker-readme-task.yml	Adds reusable task to publish Docker Hub README from Docker/README.md.
.github/workflows/merge-bot-pull-request.yml	Adds/updates merge-bot workflow for Dependabot and ESPHome bump PRs.
.github/workflows/get-version-task.yml	Adds reusable NBGV versioning task for consistent tagging.
.github/workflows/check-esphome-version.yml	Adds daily upstream tracker that opens rolling bump PRs for both branches.
.github/workflows/build-release-task.yml	Adds reusable “build release” task that composes versioning + Docker build + GitHub release.
.github/workflows/build-docker-task.yml	Adds the Docker build/push task (repo-owned build layer).
.github/workflows/build-datebadge-task.yml	Adds reusable task for updating the BYOB date badge.
.github/esphome-version.json	Adds committed ESPHome version state used for image tags and build args.
.github/dependabot.yml	Adds dual-target Dependabot updates and docker ecosystem entries.
.github/copilot-instructions.md	Adds Copilot runbook and repo-specific review mechanics pointering to AGENTS.md.
.gitattributes	Normalizes/updates EOL governance header while keeping * -text.
.editorconfig	Adds per-extension EOL and formatting rules aligned with the template.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ptr727]

Filed the template-gap issues upstream: ptr727/ProjectTemplate#157 (upstream-version tracker pattern), ptr727/ProjectTemplate#158 (docker tag from external version), ptr727/ProjectTemplate#159 (unit-test .NET coupling in test-pull-request), ptr727/ProjectTemplate#160 (.editorconfig C# block in a verbatim carry), ptr727/ProjectTemplate#161 (Docker Hub README task).

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.

[ptr727]

Trimmed all workflow comments to concise current-state context (no cross-project refs, historic/design background, or rule citations; non-obvious-only). Net ~240 fewer comment lines; removed the dead semver-major NuGet auto-merge guard (no NuGet ecosystem here). Filed the comment-style observation upstream as ptr727/ProjectTemplate#162.

[Copilot]

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 2 comments.