Beta 2

.github/workflows/conflict-check.yml

@@ -16,7 +16,11 @@ jobs:
     name: Check for merge conflicts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/github-script@v8
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const dirtyLabel = "has-conflicts";
@@ -41,13 +45,16 @@ jobs:
               });
             }
 
-            async function pullWithMergeableState(number) {
+            async function pullWithMergeableState(candidate) {
+              let latest = candidate;
+
               for (let attempt = 0; attempt < 10; attempt += 1) {
                 const { data: pull } = await github.rest.pulls.get({
                   owner,
                   repo,
-                  pull_number: number,
+                  pull_number: candidate.number,
                 });
+                latest = pull;
 
                 if (pull.mergeable !== null && pull.mergeable_state !== "unknown") {
                   return pull;
@@ -56,12 +63,47 @@ jobs:
                 await new Promise((resolve) => setTimeout(resolve, 3000));
               }
 
-              core.warning(`Mergeability is still unknown for PR #${number}`);
-              return null;
+              const headRef = `refs/remotes/pull/${candidate.number}/head`;
+              const fetchResult = await exec.getExecOutput(
+                "git",
+                [
+                  "fetch",
+                  "--force",
+                  "--no-tags",
+                  "origin",
+                  `pull/${candidate.number}/head:${headRef}`,
+                ],
+                { ignoreReturnCode: true, silent: true },
+              );
+
+              if (fetchResult.exitCode !== 0) {
+                core.warning(
+                  `Could not fetch PR #${candidate.number} for local conflict detection`,
+                );
+                return null;
+              }
+
+              const mergeResult = await exec.getExecOutput(
+                "git",
+                ["merge-tree", "--write-tree", latest.base.sha, headRef],
+                { ignoreReturnCode: true, silent: true },
+              );
+
+              if (mergeResult.exitCode > 1) {
+                core.warning(
+                  `Could not determine mergeability for PR #${candidate.number}`,
+                );
+                return null;
+              }
+
+              return {
+                ...latest,
+                mergeable_state: mergeResult.exitCode === 1 ? "dirty" : "clean",
+              };
             }
 
             async function updateConflictLabel(pull) {
-              const current = await pullWithMergeableState(pull.number);
+              const current = await pullWithMergeableState(pull);
               if (current === null) {
                 return;
               }

.github/workflows/context7-refresh.yml

@@ -5,6 +5,9 @@ on:
     workflows: ["Deploy Docusaurus to GitHub Pages"]
     types: [completed]
 
+permissions:
+  contents: read
+
 jobs:
   refresh:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}

.github/workflows/dependabot-automerge.yml

@@ -14,5 +14,22 @@ concurrency:
 
 jobs:
   automerge:
-    uses: nicxe/.github/.github/workflows/reusable-dependabot-automerge.yml@main
-    secrets: inherit
+    if: >-
+      github.actor == 'dependabot[bot]' ||
+      github.event.pull_request.user.login == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fetch verified Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
+        with:
+          github-token: ${{ github.token }}
+
+      - name: Enable auto-merge after required checks and approval
+        if: >-
+          steps.metadata.outputs.update-type == 'version-update:semver-patch' ||
+          steps.metadata.outputs.update-type == 'version-update:semver-minor' ||
+          steps.metadata.outputs.update-type == 'security-update'
+        run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}"
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/deploy.yml

@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
           cache: npm
@@ -39,7 +39,7 @@ jobs:
         run: npm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: build
 
@@ -52,4 +52,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5

.github/workflows/issue-component-labeler.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.event.issue.pull_request == null
     steps:
       - name: Apply component labels
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const body = context.payload.issue.body || '';

.github/workflows/issue-release-comment.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Post comment on released issues
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const body = context.payload.release.body || '';

.github/workflows/issue-version-check.yml

@@ -13,7 +13,7 @@ jobs:
     if: contains(github.event.issue.labels.*.name, 'bug')
     steps:
       - name: Check reported version against latest release
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const cleanValue = v => {

.github/workflows/label-beta-issues.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add "In BETA-testing" label to released issues
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const body = context.payload.release.body || '';

.github/workflows/quality.yml

@@ -0,0 +1,79 @@
+name: Phase 5 quality
+
+on:
+  push:
+    branches: [dev, beta, main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  frontend:
+    name: Frontend matrix and accessibility
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+
+      - name: Run browser quality matrix
+        run: npm run test:frontend
+
+      - name: Upload Playwright evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: phase-5-playwright-report
+          path: playwright-report
+          retention-days: 14
+
+  supply-chain:
+    name: Release and supply-chain gates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        with:
+          python-version: "3.13"
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check translations and source reviews
+        run: |
+          python scripts/check_translations.py custom_components/f1_sensor/translations
+          python scripts/check_source_reviews.py quality/data-sources.json
+          python scripts/check_token_helper_review.py quality/token-helper-review.json
+
+      - name: Check dependency policy
+        run: npm run test:audit
+
+      - name: Verify deterministic runtime-only release
+        run: npm run test:release
+
+      - name: Build documentation
+        run: npm run build

.github/workflows/release.yml

@@ -9,14 +9,46 @@ permissions:
   issues: write
   pull-requests: write
   packages: read
+  id-token: write
+  attestations: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   release:
-    uses: nicxe/.github/.github/workflows/reusable-release.yml@main
-    with:
-      node_version: "22"
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set up Node
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+          registry-url: https://npm.pkg.github.com
+          scope: "@nicxe"
+
+      - name: Install dependencies
+        run: npm ci
+        env:
+          NODE_AUTH_TOKEN: ${{ github.token }}
+
+      - name: Verify dependency policy
+        run: npm run test:audit
+
+      - name: Release
+        run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+
+      - name: Attest release provenance
+        if: ${{ hashFiles('f1_sensor.zip') != '' }}
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        with:
+          subject-path: f1_sensor.zip

.github/workflows/ruff.yml

@@ -1,10 +1,10 @@
 name: Ruff
 
 on:
+  push:
+    branches: [dev, beta, main]
   pull_request:
-    paths:
-      - "custom_components/**/*.py"
-      - "pyproject.toml"
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -18,14 +18,16 @@ jobs:
     name: Lint & format check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Ruff lint
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
         with:
+          version: "0.15.4"
           args: "check custom_components"
 
       - name: Ruff format check
-        uses: astral-sh/ruff-action@v3
+        uses: astral-sh/ruff-action@4919ec5cf1f49eff0871dbcea0da843445b837e6 # v3
         with:
+          version: "0.15.4"
           args: "format --check custom_components"

.github/workflows/sync-after-pre-release.yml

@@ -10,10 +10,13 @@ permissions:
 jobs:
   sync:
     if: ${{ github.event.release.prerelease == true && github.event.release.target_commitish == 'beta' }}
-    uses: nicxe/.github/.github/workflows/reusable-sync-beta-to-dev.yml@main
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout beta
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: beta
+          fetch-depth: 0
 
-
-
-
-
+      - name: Synchronize beta to dev
+        run: git push origin beta:dev --force

.github/workflows/sync-after-release.yml

@@ -10,15 +10,23 @@ permissions:
 jobs:
   sync-beta:
     if: ${{ github.event.release.prerelease == false && github.event.release.target_commitish == 'main' }}
-    uses: nicxe/.github/.github/workflows/resusable-sync-main-back-to-beta.yml@main
-    secrets: inherit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          ref: main
+          fetch-depth: 0
+
+      - name: Synchronize main to beta
+        run: git push origin main:beta --force
 
   sync-content:
     if: ${{ github.event.release.prerelease == false && github.event.release.target_commitish == 'main' }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           ref: main
           fetch-depth: 0