Add git-versioning starting_version for Dependabot

[TheJulianJES]

Problem

Dependabot fails to resolve dependencies on this repo with:

× No solution found when resolving dependencies for split (markers:
  python_full_version >= '3.15'):
╰─▶ ... we can conclude that zha:ci depends on itself at an incompatible
    version (zha>=2.0.0). And because your project requires zha[testing] and
    zha:ci, we can conclude that your project's requirements are unsatisfiable.

This is fallout from the recent refactor. zha-quirks now depends on zha, and zha pulls zha-quirks back in via the testing group (for device snapshots), forming a self-referential cycle:

zha[testing] -> zha-quirks -> zha>=2.0.0

uv satisfies zha-quirks's zha requirement with the editable root project. That's fine as long as the root's own version satisfies zha>=2.0.0. Our version is dynamic (setuptools-git-versioning, from git tags):

• Locally / in CI, the latest tag 2.0.0 is reachable → the project resolves as 2.0.0 → the cycle closes → uv lock/uv sync succeed.
• Dependabot re-resolves from scratch in an environment with no reachable tags → setuptools-git-versioning falls back to 0.0.1 → 0.0.1 < 2.0.0 → the cycle is unsatisfiable.

The python_full_version >= '3.15' marker is incidental: requires-python = ">=3.12" has no upper bound, so uv forks the resolution across the Python range and that fork is just where the failure surfaced.

Fix

Set setuptools-git-versioning's starting_version to the current major, so a tagless checkout still computes a version that satisfies zha>=2.0.0:

[tool.setuptools-git-versioning]
enabled = true
starting_version = "2.0.0"

This attacks the root cause (the fallback version) rather than the cycle itself, and needs bumping on each major release.

Why not a uv override-dependencies on zha?

That was the first candidate, but it doesn't work with the pinned uv (uv>=0.11.16): override-dependencies = ["zha"] references the project's own name, so uv requires a [tool.uv.sources] entry for it. The only valid source (workspace = true) collapses the lock from 214 → 46 packages, dropping the homeassistant extra and zha-quirks itself — i.e. exactly the deps the snapshot tests need.

Verification

• Reproduced the exact Dependabot error locally via git clone --no-tags + uv lock on the base branch.
• With the fix, the same tagless clone computes version 2.0.0 and uv lock resolves cleanly.
• The committed uv.lock is byte-identical — locally/CI the git tag still drives the version, so nothing changes there. Only pyproject.toml is touched.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.29%. Comparing base (063f18f) to head (be60c1f).
⚠️ Report is 2 commits behind head on dev.

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #807      +/-   ##
==========================================
- Coverage   97.29%   97.29%   -0.01%     
==========================================
  Files          55       55              
  Lines       10934    10933       -1     
==========================================
- Hits        10638    10637       -1     
  Misses        296      296              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TheJulianJES]

In the future, we may look at breaking out the device snapshots from ZHA somewhat, introducing an alternative to Dependabot, or keeping a fixed ZHA version in pyproject.toml that's automatically bumped.

For now, this should be fine. We only need to bump it when zha-quirks depends on a newer ZHA version (and thus ZHA depends on that newer ZAH version itself).

Technically, I guess we could also set a really high number here, but the current 2.0.0 keeps it more in-line with what we're on.

[Copilot]

Pull request overview

This PR updates the project’s dynamic versioning configuration to ensure dependency resolution succeeds in tagless environments (notably Dependabot), avoiding an unsatisfiable self-referential dependency cycle when zha-quirks requires zha>=2.0.0.

Changes:

• Configure setuptools-git-versioning with a starting_version = "2.0.0" fallback for checkouts with no reachable git tags.
• Document why the fallback is needed (Dependabot/tagless clones) and note that it should be bumped on each major release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.