Merge from upstream

.env.example

@@ -1,7 +1,8 @@
 # Copy this file to .env and adjust paths for your local setup.
-
-# Path to span-panel-api repo (for editable pip install)
-export SPAN_PANEL_API_DIR=../span-panel-api
+#
+# Consumed by the shell scripts under `scripts/`, which source it. Nothing in the
+# test suite reads it: the library the suite resolves is named by
+# `[tool.uv.sources]` in `pyproject.toml`, not by an environment variable.
 
 # Path to span-card frontend repo (for build-frontend.sh)
 export SPAN_CARD_DIR=../cards/span-card

.github/dependabot.yml

@@ -11,14 +11,7 @@ updates:
     allow:
       - dependency-type: "all"
     groups:
-      # Home Assistant core, stubs, and test component must upgrade together.
-      # A version mismatch between any of these causes resolution failures.
-      ha-core:
-        patterns:
-          - "homeassistant"
-          - "homeassistant-stubs"
-          - "pytest-homeassistant-custom-component"
-      # Group remaining development dependencies together
+      # Group development dependencies together
       dev-dependencies:
         patterns:
           - "pytest*"
@@ -35,10 +28,6 @@ updates:
           - "types-*"
           - "voluptuous-stubs"
           - "pyright"
-        exclude-patterns:
-          - "homeassistant"
-          - "homeassistant-stubs"
-          - "pytest-homeassistant-custom-component"
     reviewers:
       - "cayossarian"
     assignees:
@@ -50,9 +39,17 @@ updates:
       - "dependencies"
       - "python"
     ignore:
-      # Ignore major version updates for span-panel-api since it's a local dependency
+      # Bumped by hand with each integration release, together with
+      # manifest.json, so the manifest and the pip pins never drift.
       - dependency-name: "span-panel-api"
-        update-types: ["version-update:semver-major"]
+      - dependency-name: "span-panel-api-schema-0"
+      - dependency-name: "span-panel-api-schema-1"
+      # Bumped by hand as a pair, as in #281: each harness release pins one
+      # exact Home Assistant, often a beta, so the harness moves only to the
+      # release that pins the `homeassistant` version chosen. `homeassistant`
+      # is ignored too, because bumping it alone breaks the same pairing.
+      - dependency-name: "pytest-homeassistant-custom-component"
+      - dependency-name: "homeassistant"
 
   # GitHub Actions dependencies
   - package-ecosystem: "github-actions"

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@v7
         with:
           python-version: ${{ matrix.python-version }}
           allow-prereleases: true

.github/workflows/dependabot-auto-approve.yml

@@ -19,8 +19,9 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # Not `span-panel-api`, for the reason given in dependabot-auto-merge.yml.
       - name: Auto-approve patch and minor updates
-        if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' }}
+        if: ${{ (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') && !contains(steps.metadata.outputs.dependency-names, 'span-panel-api') }}
         uses: hmarr/auto-approve-action@v4
         with:
           review-message: "Auto-approved ${{ steps.metadata.outputs.update-type }} update for ${{ steps.metadata.outputs.dependency-names }}"

.github/workflows/dependabot-auto-merge.yml

@@ -19,8 +19,10 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      # Not `span-panel-api`: it is bumped by hand with manifest.json (see
+      # .github/dependabot.yml), so a bump that slips through must not land alone.
       - name: Auto-merge for patch and minor updates
-        if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' }}
+        if: ${{ (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') && !contains(steps.metadata.outputs.dependency-names, 'span-panel-api') }}
         run: |
           echo "Auto-merging ${{ steps.metadata.outputs.dependency-names }}"
           gh pr merge --auto --merge "$PR_URL"

AGENTS.md

@@ -91,7 +91,9 @@ forget action). Services that perform actions without returning data omit `suppo
 ### 6. Runtime Data Guards
 
 Handlers that access `entry.runtime_data` MUST verify the entry is loaded and its runtime data is the expected type before accessing coordinator or other
-runtime objects. Use `hasattr` and `isinstance` checks — never assume runtime data is present.
+runtime objects. Call `runtime.loaded_runtime_data(entry)`, which answers `SpanPanelRuntimeData | None` — never inline the check and never assume runtime data
+is present. It reads the attribute with a default, because core deletes `runtime_data` on unload, and then narrows it with `isinstance`, because what is there
+is whatever the owning integration put there.
 
 ### 7. Domain-Level Registration