Description: The workflow uses third-party GitHub Actions by mutable tags (e.g., actions/checkout@v6
and softprops/action-gh-release@v2) instead of pinning to immutable commit SHAs, which
creates a supply-chain risk if an upstream tag is moved or compromised, especially with
contents: write permissions.
release.yml [16-60]

  uses: actions/checkout@v6

- name: Build release ZIP (integration root at ZIP root)
  shell: bash
  run: |
    set -euo pipefail
    rm -f "${{ github.workspace }}/pollenlevels.zip"
    cd "${{ github.workspace }}/custom_components/pollenlevels"
    zip "${{ github.workspace }}/pollenlevels.zip" -r ./

- name: Validate ZIP structure (zip_release-compatible)
  shell: bash
  run: |
    set -euo pipefail
    python - <<'PY'
    import zipfile

    zip_path = "pollenlevels.zip"
    required = {"manifest.json", "__init__.py"}

    with zipfile.ZipFile(zip_path) as zf:


 ... (clipped 24 lines)

• Create ticket/issue

Follow the guide to enable codebase context checks.

Objective: To create a detailed and reliable record of critical system actions for security analysis
and compliance.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all identifiers clearly express their purpose and intent, making code
self-documenting

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure comprehensive error handling that provides meaningful context and graceful
degradation

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To prevent the leakage of sensitive system information through error messages while
providing sufficient detail for internal debugging.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: To ensure logs are useful for debugging and auditing without exposing sensitive
information like PII, PHI, or cardholder data.

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent
vulnerabilities

Status: Passed

Learn more about managing compliance generic rules or creating your own custom rules

Change the zip command from zip -r ./ to zip -r ./* to prevent a leading ./
prefix in archive paths, which would break the validation step.

.github/workflows/package-test.yml [22]

-zip "${{ github.workspace }}/pollenlevels.zip" -r ./
+zip "${{ github.workspace }}/pollenlevels.zip" -r ./*

• Apply / Chat

Set content_in_root to true in hacs.json to align with the new ZIP structure and
ensure correct installation by HACS.

hacs.json [4]

-"content_in_root": false,
+"content_in_root": true,

• Apply / Chat

Extract the duplicated build and validation logic from release.yml and
package-test.yml into a reusable composite GitHub Action to improve
maintainability and avoid inconsistencies.

Examples:

      - name: Build release ZIP (integration root at ZIP root)
        shell: bash
        run: |
          set -euo pipefail
          rm -f "${{ github.workspace }}/pollenlevels.zip"
          cd "${{ github.workspace }}/custom_components/pollenlevels"
          zip "${{ github.workspace }}/pollenlevels.zip" -r ./

      - name: Validate ZIP structure (zip_release-compatible)
        shell: bash

 ... (clipped 27 lines)

      - name: Build release ZIP (integration root at ZIP root)
        shell: bash
        run: |
          set -euo pipefail
          rm -f "${{ github.workspace }}/pollenlevels.zip"
          cd "${{ github.workspace }}/custom_components/pollenlevels"
          zip "${{ github.workspace }}/pollenlevels.zip" -r ./

      - name: Validate ZIP structure (zip_release-compatible)
        shell: bash

 ... (clipped 27 lines)

Solution Walkthrough:

Before:

# In .github/workflows/package-test.yml
jobs:
  package:
    steps:
      - uses: actions/checkout@v6
      - name: Build release ZIP
        run: |
          # ... build logic ...
      - name: Validate ZIP structure
        run: |
          # ... validation logic ...
      - uses: actions/upload-artifact@v6

# In .github/workflows/release.yml
jobs:
  package-and-upload:
    steps:
      - uses: actions/checkout@v6
      - name: Build release ZIP
        run: |
          # ... identical build logic ...
      - name: Validate ZIP structure
        run: |
          # ... identical validation logic ...
      - uses: softprops/action-gh-release@v2

After:

# In .github/actions/build-and-validate/action.yml (new file)
name: 'Build and Validate Package'
runs:
  using: 'composite'
  steps:
    - name: Build release ZIP
      shell: bash
      run: |
        # ... build logic ...
    - name: Validate ZIP structure
      shell: bash
      run: |
        # ... validation logic ...

# In .github/workflows/package-test.yml & release.yml
jobs:
  ...
    steps:
      - uses: actions/checkout@v6
      - uses: ./.github/actions/build-and-validate
      - name: Upload artifact/release asset
        uses: ...