feat(release): automate security releases and improve release management

- Add automated security releases with focused changelogs
- Configure release-drafter with conventional commit support
- Set up Renovate for automated dependency management
  - Auto-merge for minor and patch updates
  - Immediate PRs and releases for security updates
  - Weekly schedule for regular updates
- Ensure security updates are removed from draft releases

.github/release-drafter.yml

@@ -0,0 +1,76 @@
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'v$RESOLVED_VERSION'
+categories:
+  - title: '🚨 Breaking Changes'
+    labels:
+      - 'breaking'
+    collapse-after: 5
+  - title: '🔒 Security Updates'
+    labels:
+      - 'security'
+    collapse-after: 5
+  - title: '🚀 Features'
+    labels:
+      - 'feature'
+      - 'enhancement'
+    collapse-after: 5
+  - title: '🐛 Bug Fixes'
+    labels:
+      - 'fix'
+      - 'bugfix'
+      - 'bug'
+    collapse-after: 5
+  - title: '🧰 Maintenance'
+    labels:
+      - 'chore'
+      - 'dependencies'
+    collapse-after: 5
+
+# Add conventional commit support
+autolabeler:
+  - label: 'security'
+    title:
+      - '/^fix\(security\):/i'
+  - label: 'bug'
+    title:
+      - '/^fix:/i'
+  - label: 'feature'
+    title:
+      - '/^feat:/i'
+  - label: 'chore'
+    title:
+      - '/^chore:/i'
+  - label: 'breaking'
+    title:
+      - '/^BREAKING CHANGE:/i'
+      - '/!:/i'
+
+change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+
+version-resolver:
+  major:
+    labels:
+      - 'major'
+      - 'breaking'
+  minor:
+    labels:
+      - 'minor'
+      - 'feature'
+      - 'enhancement'
+  patch:
+    labels:
+      - 'patch'
+      - 'fix'
+      - 'bugfix'
+      - 'bug'
+      - 'security'
+      - 'dependencies'
+      - 'chore'
+  default: patch
+
+template: |
+  ## What's Changed
+  $CHANGES
+
+  ## 👨‍💻 Contributors
+  $CONTRIBUTORS

.github/renovate.json

@@ -6,9 +6,27 @@
   "schedule": ["before 4am on monday"],
   "packageRules": [
     {
-      "matchUpdateTypes": ["minor", "patch"],
+      "matchUpdateTypes": ["patch", "pin", "digest"],
+      "labels": ["dependencies", "patch"],
       "automerge": true,
       "automergeType": "branch"
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "labels": ["dependencies", "major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "labels": ["dependencies", "minor"],
+      "automerge": true,
+      "automergeType": "branch"
+    },
+    {
+      "matchSecurityUpdates": true,
+      "labels": ["security"],
+      "automerge": true,
+      "automergeType": "branch",
+      "prCreation": "immediate"
     }
   ],
   "platformAutomerge": true,

.github/workflows/release-drafter.yml

@@ -0,0 +1,22 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  # Allow manual trigger
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  update_release_draft:
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: release-drafter/release-drafter@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,26 +1,81 @@
 name: "Release"
 
 on:
+  # Trigger on published releases (manual releases)
   release:
     types:
       - "published"
+  # Trigger on merged PRs (for automated security updates)
+  pull_request:
+    types:
+      - "closed"
+    branches:
+      - "main"  # Only run on PRs targeting main branch
 
 permissions: {}
 
 jobs:
   release:
     name: "Release"
+    # Run if either:
+    # 1. It's a published release event
+    # 2. It's a merged Renovate PR with security label
+    if: |
+      (github.event_name == 'release') ||
+      (github.event_name == 'pull_request' &&
+       github.event.pull_request.merged == true &&
+       github.event.pull_request.user.login == 'renovate[bot]' &&
+       contains(github.event.pull_request.labels.*.name, 'security'))
     runs-on: "ubuntu-latest"
     permissions:
       contents: write
     steps:
       - name: "Checkout the repository"
         uses: "actions/[email protected]"
 
+      - name: "Get version"
+        id: version
+        shell: "bash"
+        run: |
+          if [ "${{ github.event_name }}" = "release" ]; then
+            echo "version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+          else
+            # Extract version from Renovate PR title
+            VERSION=$(echo "${{ github.event.pull_request.title }}" | grep -oP '(?<=to v)[0-9]+\.[0-9]+\.[0-9]+')
+            echo "version=v${VERSION}" >> $GITHUB_OUTPUT
+          fi
+
+      # For security updates, create a focused release
+      - name: "Create Security Release"
+        if: github.event_name == 'pull_request'
+        uses: release-drafter/release-drafter@v6
+        with:
+          version: ${{ steps.version.outputs.version }}
+          name: "🔒 Security Release ${{ steps.version.outputs.version }}"
+          tag: ${{ steps.version.outputs.version }}
+          publish: true
+          # Override template to only include the security update
+          template: |
+            ## 🔒 Security Update
+
+            - ${{ github.event.pull_request.title }} (#${{ github.event.pull_request.number }})
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # Remove the security update from the existing draft release
+      - name: "Update Draft Release"
+        if: github.event_name == 'pull_request'
+        uses: release-drafter/release-drafter@v6
+        with:
+          version: next
+          publish: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: "Adjust version number"
         shell: "bash"
         run: |
-          yq -i -o json '.version="${{ github.event.release.tag_name }}"' \
+          yq -i -o json '.version="${{ steps.version.outputs.version }}"' \
             "${{ github.workspace }}/custom_components/cowboy/manifest.json"
 
       - name: "ZIP the integration directory"
@@ -32,4 +87,5 @@ jobs:
       - name: "Upload the ZIP file to the release"
         uses: softprops/[email protected]
         with:
+          tag_name: ${{ steps.version.outputs.version }}
           files: ${{ github.workspace }}/custom_components/cowboy/cowboy-ha.zip