fix: sync Docker runtime Python with builder and harden Renovate config

Renovate PR #598 bumped the runtime Python image from 3.13 to 3.14
independently of the builder stage, causing ModuleNotFoundError in all
three Docker images. The venv is built with Python 3.13 site-packages
but the 3.14 runtime looks under python3.14/, so nothing is found.

- Revert all three Dockerfiles to Python 3.13 runtime, matching builder
- Drop Debian codename from runtime tags (python:3.13-slim instead of
  python:3.13-slim-bookworm) so latest Debian is used automatically
- Disable Renovate dockerfile manager for python images to prevent
  independent runtime bumps that break builder/runtime compatibility
- Add missing files to Renovate postUpgradeTasks: addon-dev Dockerfile,
  _build-and-release.yml, build-binary.yml, hotfix-release.yml,
  performance-tests.yml
- Add sed command for runtime image tags (python:3.X-slim pattern)

Author: Sergey

.github/workflows/pr.yml

@@ -18,7 +18,7 @@ jobs:
     name: Ruff Lint
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/astral-sh/uv:0.9.30-python3.13-bookworm-slim
+      image: ghcr.io/astral-sh/uv:0.9.30-python3.13-trixie-slim
     timeout-minutes: 5
 
     steps:
@@ -35,7 +35,7 @@ jobs:
     name: Unit Tests
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/astral-sh/uv:0.9.30-python3.13-bookworm-slim
+      image: ghcr.io/astral-sh/uv:0.9.30-python3.13-trixie-slim
     timeout-minutes: 5
 
     steps:

Dockerfile

@@ -5,7 +5,7 @@
 # Base images pinned by digest - Renovate will create PRs for updates
 
 # --- Build stage: install dependencies with uv ---
-FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca AS builder
+FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-trixie-slim@sha256:a4174f4f3f3bc082b09e7c7d4de288c66b5a70c3cce22bbec35f23f0d24a8679 AS builder
 
 WORKDIR /app
 
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --locked --no-dev
 
 # --- Runtime stage: clean image without uv ---
-FROM python:3.14-slim-bookworm@sha256:f0540d0436a220db0a576ccfe75631ab072391e43a24b88972ef9833f699095f
+FROM python:3.13-slim@sha256:3de9a8d7aedbb7984dc18f2dff178a7850f16c1ae7c34ba9d7ecc23d0755e35f
 
 LABEL org.opencontainers.image.title="Home Assistant MCP Server" \
       org.opencontainers.image.description="AI assistant integration for Home Assistant via Model Context Protocol" \

homeassistant-addon-dev/Dockerfile

@@ -4,7 +4,7 @@
 # WARNING: This is unstable and may break at any time
 
 # --- Build stage: install dependencies with uv ---
-FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca AS builder
+FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-trixie-slim@sha256:a4174f4f3f3bc082b09e7c7d4de288c66b5a70c3cce22bbec35f23f0d24a8679 AS builder
 
 WORKDIR /app
 
@@ -22,7 +22,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --locked --no-dev --no-editable
 
 # --- Runtime stage: clean image without uv ---
-FROM python:3.14-slim-bookworm@sha256:f0540d0436a220db0a576ccfe75631ab072391e43a24b88972ef9833f699095f
+FROM python:3.13-slim@sha256:3de9a8d7aedbb7984dc18f2dff178a7850f16c1ae7c34ba9d7ecc23d0755e35f
 
 WORKDIR /app
 

homeassistant-addon/Dockerfile

@@ -5,7 +5,7 @@
 # No bashio needed - pure Python startup script
 
 # --- Build stage: install dependencies with uv ---
-FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca AS builder
+FROM ghcr.io/astral-sh/uv:0.9.30-python3.13-trixie-slim@sha256:a4174f4f3f3bc082b09e7c7d4de288c66b5a70c3cce22bbec35f23f0d24a8679 AS builder
 
 WORKDIR /app
 
@@ -23,7 +23,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
     uv sync --locked --no-dev --no-editable
 
 # --- Runtime stage: clean image without uv ---
-FROM python:3.14-slim-bookworm@sha256:f0540d0436a220db0a576ccfe75631ab072391e43a24b88972ef9833f699095f
+FROM python:3.13-slim@sha256:3de9a8d7aedbb7984dc18f2dff178a7850f16c1ae7c34ba9d7ecc23d0755e35f
 
 WORKDIR /app
 

renovate.json

@@ -27,6 +27,16 @@
     }
   ],
   "packageRules": [
+    {
+      "description": "Python runtime images - managed by asdf postUpgradeTasks, not independently",
+      "matchManagers": [
+        "dockerfile"
+      ],
+      "matchPackageNames": [
+        "python"
+      ],
+      "enabled": false
+    },
     {
       "description": "Python version upgrades - wait 6 months after release",
       "matchManagers": [
@@ -45,21 +55,27 @@
           "sed -i \"s/requires-python = \\\">=3\\.[0-9]\\+,<3\\.[0-9]\\+\\\"/requires-python = \\\">=${PYTHON_VERSION},<${PYTHON_NEXT}\\\"/\" pyproject.toml",
           "sed -i '/Programming Language :: Python :: 3\\.[0-9]\\+/d' pyproject.toml",
           "sed -i \"/Programming Language :: Python :: 3\\\",/a\\\\    \\\"Programming Language :: Python :: ${PYTHON_VERSION}\\\",\" pyproject.toml",
-          "sed -i \"s/python3\\.[0-9]\\+-bookworm-slim/python${PYTHON_VERSION}-bookworm-slim/\" Dockerfile",
-          "sed -i \"s/python3\\.[0-9]\\+-bookworm/python${PYTHON_VERSION}-bookworm/\" homeassistant-addon/Dockerfile",
+          "sed -i \"s/python3\\.[0-9]\\+\\(-[a-z]\\+-slim\\)/python${PYTHON_VERSION}\\1/\" Dockerfile homeassistant-addon/Dockerfile homeassistant-addon-dev/Dockerfile .github/workflows/pr.yml",
+          "sed -i \"s/python:3\\.[0-9]\\+-slim/python:${PYTHON_VERSION}-slim/\" Dockerfile homeassistant-addon/Dockerfile homeassistant-addon-dev/Dockerfile",
           "sed -i \"s/Python 3\\.[0-9]\\+ - Security/Python ${PYTHON_VERSION} - Security/\" Dockerfile homeassistant-addon/Dockerfile",
-          "sed -i \"s/PYTHON_VERSION: \\\"3\\.[0-9]\\+\\\"/PYTHON_VERSION: \\\"${PYTHON_VERSION}\\\"/\" .github/workflows/pr.yml .github/workflows/test.yml .github/workflows/e2e-tests.yml .github/workflows/semver-release.yml",
-          "git add .python-version pyproject.toml Dockerfile homeassistant-addon/Dockerfile .github/workflows/pr.yml .github/workflows/test.yml .github/workflows/e2e-tests.yml .github/workflows/semver-release.yml"
+          "sed -i \"s/PYTHON_VERSION: \\\"3\\.[0-9]\\+\\\"/PYTHON_VERSION: \\\"${PYTHON_VERSION}\\\"/\" .github/workflows/pr.yml .github/workflows/test.yml .github/workflows/e2e-tests.yml .github/workflows/semver-release.yml .github/workflows/hotfix-release.yml .github/workflows/performance-tests.yml",
+          "sed -i \"s/python-version: '3\\.[0-9]\\+'/python-version: '${PYTHON_VERSION}'/\" .github/workflows/_build-and-release.yml .github/workflows/build-binary.yml",
+          "git add .python-version pyproject.toml Dockerfile homeassistant-addon/Dockerfile homeassistant-addon-dev/Dockerfile .github/workflows/pr.yml .github/workflows/test.yml .github/workflows/e2e-tests.yml .github/workflows/semver-release.yml .github/workflows/hotfix-release.yml .github/workflows/performance-tests.yml .github/workflows/_build-and-release.yml .github/workflows/build-binary.yml"
         ],
         "fileFilters": [
           ".python-version",
           "pyproject.toml",
           "Dockerfile",
           "homeassistant-addon/Dockerfile",
+          "homeassistant-addon-dev/Dockerfile",
           ".github/workflows/pr.yml",
           ".github/workflows/test.yml",
           ".github/workflows/e2e-tests.yml",
-          ".github/workflows/semver-release.yml"
+          ".github/workflows/semver-release.yml",
+          ".github/workflows/hotfix-release.yml",
+          ".github/workflows/performance-tests.yml",
+          ".github/workflows/_build-and-release.yml",
+          ".github/workflows/build-binary.yml"
         ],
         "executionMode": "branch"
       }