chore: maintenance pass – deps, CI modernization, repo-checker fixes

.github/dependabot.yml

@@ -1,14 +1,32 @@
+# Dependabot configuration
+# Cooldown delays updating normal npm dependencies by 7 days but allows security updates to be processed immediately.
+# Note: Cooldown is not supported for the github-actions ecosystem.
+# Reference: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
 version: 2
 updates:
-- package-ecosystem: npm
-  directory: "/"
-  schedule:
-    interval: monthly
-    time: "04:00"
-    timezone: Europe/Berlin
-    allow:
-      - dependency-type: 'production'
-  open-pull-requests-limit: 20
-  assignees:
-  - DrozmotiX
-  versioning-strategy: increase
+    - package-ecosystem: 'github-actions'
+      directory: '/'
+      schedule:
+          interval: 'cron'
+          timezone: 'Europe/Berlin'
+          cronjob: '21 1 2 * *'
+      open-pull-requests-limit: 15
+
+    - package-ecosystem: 'npm'
+      directory: '/'
+      schedule:
+          interval: 'cron'
+          timezone: 'Europe/Berlin'
+          cronjob: '21 1 2 * *'
+      open-pull-requests-limit: 15
+      versioning-strategy: 'increase'
+      ignore:
+          - dependency-name: 'typescript'
+            update-types:
+                - 'version-update:semver-minor'
+                - 'version-update:semver-major'
+          - dependency-name: '@types/node'
+            update-types:
+                - 'version-update:semver-major'
+      cooldown:
+          default-days: 7

.github/workflows/automerge-dependabot.yml

@@ -0,0 +1,35 @@
+# Workflow for auto-merging Dependabot PRs
+# This workflow uses the action-automerge-dependabot action to automatically merge
+# Dependabot PRs based on the rules defined in .github/auto-merge.yml
+
+name: Auto-Merge Dependabot PRs
+
+on:
+    # Trigger when a PR is opened or updated
+    # WARNING: This needs to be run in the PR base, DO NOT build untrusted code in this action
+    pull_request_target:
+        types: [opened, synchronize, reopened]
+
+jobs:
+    auto-merge:
+        runs-on: ubuntu-latest
+        # Only run if actor is dependabot
+        if: github.actor == 'dependabot[bot]'
+
+        permissions:
+            contents: write
+            pull-requests: write
+
+        steps:
+            - name: Auto-merge Dependabot PRs
+              uses: iobroker-bot-orga/action-automerge-dependabot@v1
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  # Optional: Path to your auto-merge configuration file
+                  # config-file-path: '.github/auto-merge.yml'
+                  # Optional: Merge method (merge, squash, or rebase)
+                  # merge-method: 'squash'
+                  # Optional: Wait for other checks to complete
+                  # wait-for-checks: 'true'
+                  # Optional: Maximum time to wait for checks in seconds (default: 3600)
+                  # max-wait-time: '3600'

.github/workflows/test-and-release.yml

@@ -3,146 +3,105 @@ name: Test and Release
 # Run this job on all pushes and pull requests
 # as well as tags with a semantic version
 on:
-  push:
-    branches:
-      - "main"
-    tags:
-      # normal versions
-      - "v[0-9]+.[0-9]+.[0-9]+"
-      # pre-releases
-      - "v[0-9]+.[0-9]+.[0-9]+-**"
-  pull_request: {}
+    push:
+        branches:
+            - '*'
+        tags:
+            # normal versions
+            - 'v[0-9]+.[0-9]+.[0-9]+'
+            # pre-releases
+            - 'v[0-9]+.[0-9]+.[0-9]+-**'
+    pull_request: {}
+
+# Cancel previous PR/branch runs when a new commit is pushed.
+# Release runs (tag pushes) are never cancelled - cancelling them aborts the deploy job and
+# leaves the release half finished, which the ioBroker repo checker reports as W3032.
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: ${{ !startsWith(github.ref, 'refs/tags/') }}
+
+# Restrict the default GITHUB_TOKEN to read-only; the deploy job widens this for itself.
+permissions:
+    contents: read
 
 jobs:
-  # Performs quick checks before the expensive test runs
-  check-and-lint:
-    if: contains(github.event.head_commit.message, '[skip ci]') == false
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [14.x]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Lint source code
-        run: npm run lint
-      - name: Test package files
-        run: npm run test:package
-
-  # Runs adapter tests on all supported node versions and OSes
-  adapter-tests:
-    if: contains(github.event.head_commit.message, '[skip ci]') == false
-
-    needs: [check-and-lint]
-
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        node-version: [12.x, 14.x, 16.x]
-        os: [ubuntu-latest, windows-latest, macos-latest]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Run unit tests
-        run: npm run test:unit
-
-      - name: Run integration tests (unix only)
-        if: startsWith(runner.OS, 'windows') == false
-        run: DEBUG=testing:* npm run test:integration
-
-      - name: Run integration tests (windows only)
-        if: startsWith(runner.OS, 'windows')
-        run: set DEBUG=testing:* & npm run test:integration
-
-  # Deploys the final package to NPM
-  deploy:
-    needs: [adapter-tests]
-
-    # Trigger this step only when a commit on any branch is tagged with a version number
-    if: |
-      contains(github.event.head_commit.message, '[skip ci]') == false &&
-      github.event_name == 'push' &&
-      startsWith(github.ref, 'refs/tags/v')
-
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [14.x]
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v2
-
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v1
-        with:
-          node-version: ${{ matrix.node-version }}
-
-      - name: Extract the version and commit body from the tag
-        id: extract_release
-        # The body may be multiline, therefore newlines and % need to be escaped
-        run: |
-          VERSION="${{ github.ref }}"
-          VERSION=${VERSION##*/v}
-          echo "::set-output name=VERSION::$VERSION"
-          BODY=$(git show -s --format=%b)
-          BODY="${BODY//'%'/'%25'}"
-          BODY="${BODY//$'\n'/'%0A'}"
-          BODY="${BODY//$'\r'/'%0D'}"
-          echo "::set-output name=BODY::$BODY"
-
-      - name: Publish package to npm
-        run: |
-          npm config set //registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}
-          npm whoami
-          npm publish
-
-      - name: Create Github Release
-        uses: actions/create-release@v1
+    # Performs quick checks before the expensive test runs
+    check-and-lint:
+        if: contains(github.event.head_commit.message, '[skip ci]') == false
+
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: ioBroker/testing-action-check@v2
+              with:
+                  node-version: '24.x'
+                  # Uncomment the following line if your adapter cannot be installed using 'npm ci'
+                  # install-command: 'npm install'
+                  lint: true
+
+    # Runs adapter tests on all supported node versions and OSes
+    adapter-tests:
+        needs: [check-and-lint]
+        if: contains(github.event.head_commit.message, '[skip ci]') == false
+
+        runs-on: ${{ matrix.os }}
+        timeout-minutes: 30
+        strategy:
+            # Do not cancel the remaining matrix legs when one of them fails,
+            # otherwise a single flaky OS/node combination hides all other results
+            fail-fast: false
+            matrix:
+                node-version: [22.x, 24.x]
+                os: [ubuntu-latest, windows-latest, macos-latest]
+
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ github.ref }}
-          release_name: Release v${{ steps.extract_release.outputs.VERSION }}
-          draft: false
-          # Prerelease versions create prereleases on Github
-          prerelease: ${{ contains(steps.extract_release.outputs.VERSION, '-') }}
-          body: ${{ steps.extract_release.outputs.BODY }}
-
-      - name: Notify Sentry.io about the release
-        run: |
-          npm i -g @sentry/cli
-          export SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          export SENTRY_URL=https://sentry.iobroker.net
-          export SENTRY_ORG=iobroker
-          export SENTRY_PROJECT=iobroker-switchbot-hub
-          export SENTRY_VERSION=iobroker-switchbot-hub@${{ steps.extract_release.outputs.VERSION }}
-          sentry-cli releases new $SENTRY_VERSION
-          sentry-cli releases finalize $SENTRY_VERSION
-        # Add the following line BEFORE finalize if repositories are connected in Sentry
-        # sentry-cli releases set-commits $SENTRY_VERSION --auto
-
-        # Add the following line BEFORE finalize if sourcemap uploads are needed
-        # sentry-cli releases files $SENTRY_VERSION upload-sourcemaps build/
+            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+        steps:
+            - uses: ioBroker/testing-action-adapter@v1
+              with:
+                  node-version: ${{ matrix.node-version }}
+                  os: ${{ matrix.os }}
+                  # Uncomment the following line if your adapter cannot be installed using 'npm ci'
+                  # install-command: 'npm install'
+
+    # NOTE: Automatic npm releases are configured via npm Trusted Publishing (OIDC)
+    # using ioBroker/testing-action-deploy@v1 and the id-token permission below.
+    # Ensure your npm package is set up for GitHub OIDC; no NPM_TOKEN secret is required.
+
+    # Deploys the final package to NPM
+    deploy:
+        needs: [check-and-lint, adapter-tests]
+
+        # Trigger this step only when a commit on any branch is tagged with a version number
+        if: |
+            contains(github.event.head_commit.message, '[skip ci]') == false &&
+            github.event_name == 'push' &&
+            startsWith(github.ref, 'refs/tags/v')
+
+        runs-on: ubuntu-latest
+
+        # Write permissions are required to create Github releases
+        permissions:
+            contents: write
+            id-token: write
+
+        steps:
+            - uses: ioBroker/testing-action-deploy@v1
+              with:
+                  node-version: '24.x'
+                  # Uncomment the following line if your adapter cannot be installed using 'npm ci'
+                  # install-command: 'npm install'
+                  # npm-token: ${{ secrets.NPM_TOKEN }}  # Commented out for migration to Trusted Publishing
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+
+                  # When using Sentry for error reporting, Sentry can be informed about new releases
+                  # To enable create a API-Token in Sentry (User settings, API keys)
+                  # Enter this token as a GitHub secret (with name SENTRY_AUTH_TOKEN) in the repository options
+                  # Then uncomment and customize the following block:
+                  sentry: true
+                  sentry-token: ${{ secrets.SENTRY_AUTH_TOKEN }}
+                  sentry-project: 'iobroker-switchbot-hub'
+                  sentry-version-prefix: 'iobroker.switchbot-hub'
+                  # If your sentry project is linked to a GitHub repository, you can enable the following option
+                  # sentry-github-integration: true