Merge pull request #772 from tempus2016/chore/ci-tooling-expansion

chore(ci): data/release gates, CodeQL, dependency review, dev container

Author: tempus2016

.devcontainer/devcontainer.json

@@ -0,0 +1,39 @@
+{
+  "name": "TaskMate dev",
+  "image": "mcr.microsoft.com/devcontainers/python:1-3.13-bookworm",
+  "features": {
+    "ghcr.io/devcontainers/features/node:1": {
+      "version": "20"
+    }
+  },
+  "forwardPorts": [8123],
+  "portsAttributes": {
+    "8123": {
+      "label": "Home Assistant",
+      "onAutoForward": "notify"
+    }
+  },
+  "postCreateCommand": "bash .devcontainer/setup.sh",
+  "remoteUser": "vscode",
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "charliermarsh.ruff",
+        "ms-python.python",
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode",
+        "redhat.vscode-yaml",
+        "github.vscode-github-actions"
+      ],
+      "settings": {
+        "python.defaultInterpreterPath": "/usr/local/bin/python",
+        "editor.formatOnSave": false,
+        "[python]": {
+          "editor.defaultFormatter": "charliermarsh.ruff"
+        },
+        "files.trimTrailingWhitespace": true,
+        "files.insertFinalNewline": true
+      }
+    }
+  }
+}

.devcontainer/setup.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+# Provisions the dev container: test harness, linters, and a throwaway Home
+# Assistant config with TaskMate symlinked in. Runs once, on container create.
+set -euo pipefail
+
+echo "==> Installing Python tooling"
+python -m pip install --upgrade pip
+pip install -r requirements_test.txt
+pip install ruff==0.15.12 pre-commit homeassistant
+
+echo "==> Installing Node tooling"
+npm ci
+
+echo "==> Installing git hooks"
+pre-commit install || echo "pre-commit install skipped"
+
+echo "==> Preparing a Home Assistant config at ./dev-config"
+mkdir -p dev-config/custom_components
+# Symlink, not copy — edits to the integration are live in the running HA.
+ln -sfn "$(pwd)/custom_components/taskmate" dev-config/custom_components/taskmate
+
+if [ ! -f dev-config/configuration.yaml ]; then
+  cat > dev-config/configuration.yaml <<'YAML'
+# Minimal Home Assistant config for TaskMate development.
+default_config:
+
+logger:
+  default: info
+  logs:
+    custom_components.taskmate: debug
+
+# Cards are served by the integration itself at /taskmate/<card>.js and
+# registered automatically, so no lovelace resources block is needed here.
+YAML
+fi
+
+cat <<'EOF'
+
+Setup complete.
+
+  Run tests            pytest -v
+  Lint                 ruff check custom_components/taskmate tests scripts && npm run lint
+  Data checks          python3 scripts/check_translations.py && python3 scripts/check_data_files.py
+  Start Home Assistant hass -c dev-config
+                       then open the forwarded port 8123 and add the
+                       TaskMate integration from Settings -> Devices & services
+
+EOF

.github/CODEOWNERS

@@ -0,0 +1,13 @@
+# Auto-requests review on every PR (including from forks) and makes the
+# ownership explicit. Matches the "codeowners" field in manifest.json.
+
+*                                   @tempus2016
+
+# Areas worth an explicit line — these are the ones where an outside PR is most
+# likely to land, and where a silent change is most expensive.
+/.github/                           @tempus2016
+/custom_components/taskmate/www/    @tempus2016
+/custom_components/taskmate/translations/ @tempus2016
+/blueprints/                        @tempus2016
+/hacs.json                          @tempus2016
+/custom_components/taskmate/manifest.json @tempus2016

.github/CONTRIBUTING.md

@@ -40,6 +40,16 @@ custom_components/taskmate/
 
 ## Development setup
 
+### One-click: dev container / Codespaces
+
+The repo ships a dev container. Open it in GitHub Codespaces, or in VS Code with
+the Dev Containers extension ("Reopen in Container"). Setup installs the test
+harness, ruff, ESLint and pre-commit, and creates a scratch HA config at
+`dev-config/` with the integration symlinked in — so `hass -c dev-config` gives
+you a real Home Assistant on port 8123 with your working copy live.
+
+### Manual
+
 The fastest loop is a real Home Assistant instance with the integration
 bind-mounted:
 
@@ -52,18 +62,35 @@ bind-mounted:
 
 ## Code quality
 
-Two checks gate every PR into `main`. Run them locally before pushing:
+Run these locally before pushing:
 
 ```bash
 # Lint (matches the "Ruff" CI check)
-ruff check .
+ruff check custom_components/taskmate tests scripts
+
+# Cards and panel (matches the "ESLint" CI check)
+npm ci && npm run lint
 
 # Tests (matches the "Run tests" CI check)
 pytest
+
+# Every locale matches en.json (matches the "Translation parity" CI check)
+python3 scripts/check_translations.py
+
+# Blueprints, sentences and packaging metadata parse (matches "Data files")
+python3 scripts/check_data_files.py
 ```
 
-`hassfest` and HACS validation also run in CI to keep the integration
-compliant.
+Or install the hooks once and let them run on commit:
+
+```bash
+pip install pre-commit
+pre-commit install
+pre-commit run --all-files
+```
+
+`hassfest`, HACS validation, dependency review and a workflow-security audit
+(`zizmor`) also run in CI, alongside GitHub's CodeQL code scanning.
 
 ## Translations
 
@@ -75,6 +102,10 @@ be asked to include the translations.
 Backend strings live in `custom_components/taskmate/translations/` and
 `strings.json`; card strings live under `www/locales/`.
 
+This is enforced in CI: `scripts/check_translations.py` fails the build if any
+locale's key set differs from `en.json` in either catalogue. Run it locally to
+see exactly which keys are missing.
+
 ## Submitting a pull request
 
 1. Fork and create a feature branch.

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -175,15 +175,15 @@ body:
     attributes:
       label: Home Assistant Logs
       description: |
-        Paste any relevant log output here. 
-        
+        Paste any relevant log output here.
+
         To get debug logs, add this to configuration.yaml, restart HA, reproduce the issue, then copy the logs from Settings → System → Logs:
         ```yaml
         logger:
           logs:
             custom_components.taskmate: debug
         ```
-        
+
         Filter by "taskmate" to find relevant entries.
       render: text
       placeholder: |
@@ -223,7 +223,7 @@ body:
       label: Additional Context
       description: |
         Anything else that might be relevant — screenshots, screen recordings, recent changes to your setup, etc.
-        
+
         You can drag and drop images directly into this text box.
 
   - type: checkboxes

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -10,7 +10,7 @@ body:
     attributes:
       value: |
         Thanks for suggesting a new feature! Please fill in as much detail as you can — the more context you give, the easier it is to understand and implement.
-        
+
         Before submitting, please search [existing issues](https://github.com/tempus2016/taskmate/issues) to check if this has already been requested.
 
   # ── Feature Summary ───────────────────────────────────────────────────────────
@@ -132,7 +132,7 @@ body:
       label: Additional Context
       description: |
         Anything else that helps explain your situation — ages of children, how you currently use TaskMate, screenshots of what you'd like to see, mockups, etc.
-        
+
         You can drag and drop images directly into this box.
 
   # ── Checklist ─────────────────────────────────────────────────────────────────

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     labels:
       - "dependencies"
       - "ci"
+    # Don't bump onto a release that's hours old — a freshly published action
+    # version is the one most likely to be yanked or compromised.
+    cooldown:
+      default-days: 7
 
   # Dev tooling only (eslint) — nothing here ships in the integration.
   # Grouped so routine bumps arrive as one PR rather than one per package.
@@ -19,9 +23,27 @@ updates:
     labels:
       - "dependencies"
       - "ci"
+    cooldown:
+      default-days: 7
     groups:
       npm-dev-dependencies:
         dependency-type: "development"
         update-types:
           - "minor"
           - "patch"
+
+  # The HA test harness in requirements_test.txt is deliberately pinned so a new
+  # upstream release can't flip the required "Run tests" check on its own. This
+  # entry doesn't undo that — it just raises one PR when a newer pin exists, so
+  # the decision to move is explicit instead of never noticed. Limit 1 on
+  # purpose: this should be a quiet trickle, not a queue.
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 1
+    labels:
+      - "dependencies"
+      - "ci"
+    cooldown:
+      default-days: 14

.github/release.yml

@@ -0,0 +1,46 @@
+# Groups GitHub's auto-generated release notes by label. This does not replace
+# the hand-written release notes — it shapes the "What's Changed" list that
+# GitHub appends when you click "Generate release notes", so dependency bumps
+# collapse into one section instead of padding the top of the list.
+changelog:
+  exclude:
+    labels:
+      - duplicate
+      - invalid
+      - wontfix
+      - stale
+    authors:
+      - dependabot
+  categories:
+    - title: New features
+      labels:
+        - enhancement
+
+    - title: Bug fixes
+      labels:
+        - bug
+
+    - title: Cards & UI
+      labels:
+        - cards
+
+    - title: Translations
+      labels:
+        - translations
+
+    - title: Documentation
+      labels:
+        - documentation
+
+    - title: CI & maintenance
+      labels:
+        - ci
+        - tests
+
+    - title: Dependencies
+      labels:
+        - dependencies
+
+    - title: Other changes
+      labels:
+        - "*"

.github/workflows/data-checks.yml

@@ -0,0 +1,59 @@
+name: Data checks
+
+# Guards the two classes of breakage the Python test suite can't see:
+#   1. a locale that drifted out of sync with en.json (renders raw keys in the UI)
+#   2. a shipped YAML/JSON file that doesn't parse (blows up at install time)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  translations:
+    name: Translation parity
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Check every locale matches en.json
+        run: python3 scripts/check_translations.py
+
+  data-files:
+    name: Data files
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install PyYAML
+        run: python -m pip install --upgrade pip pyyaml
+
+      - name: Parse blueprints, sentences, locales and metadata
+        run: python3 scripts/check_data_files.py

.github/workflows/dependency-review.yml

@@ -0,0 +1,34 @@
+name: Dependency review
+
+# Fails a PR that introduces a dependency with a known vulnerability, or one
+# under a licence we don't want to ship. Only the npm dev tooling and the test
+# requirements are in scope today — the integration itself has no runtime
+# requirements — but this is the gate that keeps it that way.
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency review
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          comment-summary-in-pr: on-failure