evcc Master übernehmen (neues Energie-UI)

.github/actions/build-toolchain/action.yml

@@ -13,20 +13,20 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
       with:
         go-version-file: go.mod
         cache: false # managed explicitly below to keep the scoped namespaces
 
-    - uses: voidzero-dev/setup-vp@v1
+    - uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
       with:
         node-version: "26"
         cache: true
 
     # Writes are namespaced by cache-scope so a PR build cannot poison the
     # shared "main" cache; PRs still read it through the fallback restore-key.
     - name: Go module and build cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: |
           ~/.cache/go-build

.github/actions/docker-cache/action.yml

@@ -24,7 +24,7 @@ runs:
     # cache, which still covers the third-party packages dominating the build.
     - name: Cache mount contents
       id: cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
       with:
         path: .docker-cache
         key: ${{ runner.os }}-docker-mounts-${{ inputs.cache-scope }}-${{ hashFiles('go.sum', 'package-lock.json') }}

.github/workflows/claude-code-review-run.yml

@@ -30,7 +30,7 @@ jobs:
     steps:
       - name: Check for PR-number artifact
         id: check
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const { data } = await github.rest.actions.listWorkflowRunArtifacts({
@@ -42,7 +42,7 @@ jobs:
 
       - name: Download PR number
         if: steps.check.outputs.found == 'true'
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: pr-number
           run-id: ${{ github.event.workflow_run.id }}
@@ -78,7 +78,7 @@ jobs:
       # publish a commit status on the PR head SHA. This surfaces a "Claude Code
       # Review" check next to the regular CI jobs.
       - name: Report review pending
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             await github.rest.repos.createCommitStatus({
@@ -93,7 +93,7 @@ jobs:
 
       # Default checkout (base ref) only — do NOT check out the untrusted PR head.
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 1
 
@@ -132,7 +132,7 @@ jobs:
         if: always()
         env:
           OUTCOME: ${{ steps.review.outcome }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const ok = process.env.OUTCOME === 'success';

.github/workflows/claude-code-review.yml

@@ -25,7 +25,7 @@ jobs:
         run: echo "$PR_NUMBER" > pr-number.txt
 
       - name: Upload PR number
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: pr-number
           path: pr-number.txt

.github/workflows/claude-issue-agent.yml

@@ -26,9 +26,10 @@ jobs:
       github.event_name == 'issues' &&
       (github.event.action == 'opened' || github.event.sender.login == github.event.issue.user.login)
     permissions:
-      contents: write # create branch + push PR fix
-      issues: write # add labels + comment analysis
-      pull-requests: write # open PR fix
+      contents: write # push the fix branch (open-pr job only, the agent job reduces to read)
+      issues: write # add labels + comment analysis + close duplicates
+      pull-requests: write # open the draft PR
+      discussions: read # read referenced discussions
       id-token: write
       actions: read
     uses: ./.github/workflows/claude-issue-agent-run.yml
@@ -56,7 +57,7 @@ jobs:
     outputs:
       run: ${{ steps.check.outputs.run }}
     steps:
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         id: check
         with:
           script: |
@@ -82,6 +83,8 @@ jobs:
     permissions:
       contents: read # explore the codebase for the answer; no fix/PR in analyze mode
       issues: write # comment
+      pull-requests: write # the reusable job requests it, a caller may not grant less
+      discussions: read # read referenced discussions
       id-token: write
       actions: read
     uses: ./.github/workflows/claude-issue-agent-run.yml
@@ -107,7 +110,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const { owner, repo } = context.repo;
@@ -148,7 +151,7 @@ jobs:
       # base repo checkout only — never the untrusted PR head; the agent reads PR
       # metadata via gh and treats it as data, not instructions, and runs no PR code.
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
@@ -166,7 +169,7 @@ jobs:
           additional_permissions: |
             actions: read
           # labeling is a classification over the file list, Haiku is enough
-          claude_args: '--model claude-haiku-4-5 --allowed-tools "Read,Grep,Glob,Bash(gh label list:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr edit:*)" --disallowed-tools "Task"'
+          claude_args: '--model claude-haiku-4-5 --allowed-tools "Read,Grep,Glob,Bash(gh label list:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr edit:*),Bash(gh api:*)" --disallowed-tools "Task"'
           prompt: |
             You label pull requests for the evcc repository.
             Work on PR #${{ github.event.pull_request.number }}. Fetch its title,
@@ -191,5 +194,12 @@ jobs:
                Skip any label already present. Prefer a couple of precise labels over
                many loose ones; if nothing clearly matches, apply none.
 
+               The `bug` label qualifies a pull request for backport into a bugfix
+               release, so be reluctant with it. A fix-looking diff or body is not
+               enough. Apply `bug` ONLY when the body references an issue
+               (`fixes #N`, `closes #N`, `#N`) whose type is Bug; check with
+               `gh api repos/${{ github.repository }}/issues/N --jq '.type.name'`.
+               No referenced issue, or a referenced issue without type Bug: no `bug`.
+
             Do NOT post a comment, modify any code, or push anything. Labeling is the
             only action for pull requests.

.github/workflows/cli-docs.yml

@@ -18,15 +18,15 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version-file: go.mod
 
-      - uses: voidzero-dev/setup-vp@v1
+      - uses: voidzero-dev/setup-vp@250f29ce396baf5e8f24498e17c0dfdebabc26eb # v1
         with:
           node-version-file: ".node-version"
           cache: true

.github/workflows/codeql.yml

@@ -61,7 +61,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # Add any setup steps before running the `github/codeql-action/init` action.
       # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -71,7 +71,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.2
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -101,6 +101,6 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.38.2
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/command-analyze.yml

@@ -16,6 +16,7 @@ jobs:
       contents: read # explore the codebase for the answer; no fix/PR in analyze mode
       issues: write # comment + minimize the calling comment
       pull-requests: write # comment on PR conversations
+      discussions: read # read referenced discussions
       id-token: write
       actions: read
     uses: ./.github/workflows/claude-issue-agent-run.yml

.github/workflows/command-backport.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: React to comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -46,8 +46,11 @@ jobs:
 
       - name: Resolve target branch
         id: pr
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
+          # creating the release branch is subject to the release/** ruleset, which
+          # GITHUB_TOKEN cannot bypass
+          github-token: ${{ secrets.RELEASE_DEPLOY_TOKEN }}
           script: |
             const { owner, repo } = context.repo;
 
@@ -141,7 +144,7 @@ jobs:
             core.setOutput('sha', pr.merge_commit_sha);
             core.setOutput('title', pr.title);
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           ref: ${{ steps.pr.outputs.target }}
@@ -202,7 +205,7 @@ jobs:
 
       - name: Comment result
         if: always()
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         env:
           TARGET: ${{ steps.pr.outputs.target }}
           URL: ${{ steps.create.outputs.url }}
@@ -225,7 +228,7 @@ jobs:
 
       - name: Resolve command comment
         if: always()
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // collapse the /backport comment as resolved, the result was reported

.github/workflows/command-fix.yml

@@ -5,19 +5,21 @@ on:
     types: [created]
 
 # Triggered by a `/fix` comment on any issue or PR conversation, maintainers only.
-# Delegates to the shared issue agent in fix mode, which investigates, pushes a
-# fix branch, opens a PR, comments with the result, then minimizes the calling
-# `/fix` comment as RESOLVED, whether or not a PR was opened.
+# Delegates to the shared issue agent in fix mode, which investigates, commits a
+# fix that a separate job pushes and opens as a PR, comments with the result,
+# then minimizes the calling `/fix` comment as RESOLVED, whether or not a PR was
+# opened.
 jobs:
   fix:
     name: Fix on demand
     if: |
       startsWith(github.event.comment.body, '/fix') &&
       contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
     permissions:
-      contents: write # create branch + push PR fix
+      contents: write # push the fix branch (open-pr job only, the agent job reduces to read)
       issues: write # comment + minimize the calling comment
       pull-requests: write # open PR fix, comment on PR conversations
+      discussions: read # read referenced discussions
       id-token: write
       actions: read
     uses: ./.github/workflows/claude-issue-agent-run.yml

.github/workflows/command-nightly.yml

@@ -25,7 +25,7 @@ jobs:
       pull-requests: write
     steps:
       - name: React to comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -35,7 +35,7 @@ jobs:
               content: 'eyes',
             });
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: master
           fetch-depth: 0
@@ -75,7 +75,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment result
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const num = context.payload.issue.number;
@@ -89,7 +89,7 @@ jobs:
             await github.rest.issues.createComment({ owner, repo, issue_number: num, body });
 
       - name: Resolve command comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // collapse the /nightly comment as resolved now that the build is done

.github/workflows/command-pr-build.yml

@@ -33,7 +33,7 @@ jobs:
       platforms: ${{ steps.parse.outputs.platforms }}
     steps:
       - name: React to comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             await github.rest.reactions.createForIssueComment({
@@ -77,7 +77,7 @@ jobs:
       matrix:
         arch: ${{ fromJSON(needs.prep.outputs.archs) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ needs.prep.outputs.sha }}
           fetch-depth: 0
@@ -102,7 +102,7 @@ jobs:
           gzip -9 "evcc-linux-${{ matrix.arch }}"
 
       - name: Upload binary
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: evcc-pr-${{ github.event.issue.number }}-linux-${{ matrix.arch }}
           path: evcc-linux-${{ matrix.arch }}.gz
@@ -116,7 +116,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ needs.prep.outputs.sha }}
           fetch-depth: 0
@@ -157,7 +157,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment result
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             const num = context.payload.issue.number;
@@ -195,7 +195,7 @@ jobs:
             }
 
       - name: Resolve command comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
           script: |
             // collapse the /build comment as resolved now that the build is done