birdnet-go: resolve MariaDB host to IPv4 before connecting

On HAOS >=17.3 the Supervisor network gained IPv6, but the MariaDB addon
only grants the service user from the IPv4 subnet. Connecting via IPv6
causes auth failure and makes CREATE DATABASE appear to lack privileges.
Mirror the fix from the photoprism addon: resolve via getent ahostsv4
and add --skip-ssl. Password remains in MYSQL_PWD env var (safer than
--password= on the CLI).

.github/workflows/archived_lint-checks.yaml

@@ -13,7 +13,7 @@ jobs:
     container: ghcr.io/hadolint/hadolint:latest-alpine
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get changed files
         id: changed_files
@@ -34,7 +34,7 @@ jobs:
     container: koalaman/shellcheck-alpine:latest
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Get changed files
         id: changed_files
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           # Full git history is needed to get a proper list of changed files within `super-linter`
           fetch-depth: 0

.github/workflows/daily_README.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Install jq + yq (v4)
         run: |

.github/workflows/generate_stargazer_map.yml

@@ -9,7 +9,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up Python
         uses: actions/setup-python@v6

.github/workflows/helper_stats_graphs.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Install apps
         run: |
           git pull --rebase origin master

.github/workflows/lint.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -82,7 +82,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/on_issues.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
     - name: Assign issues
       run: |
         # Init

.github/workflows/on_issues_ping_submitter.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Ping mapped submitter when add-on is mentioned
         env:

.github/workflows/onpr_check-pr.yaml

@@ -18,7 +18,7 @@ jobs:
       changedChangelogFiles: ${{ steps.changed-files.outputs.changelogs_files }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Find changed addon directories
         id: find_addons
         run: |
@@ -72,7 +72,7 @@ jobs:
         addon: ${{ fromJSON(needs.check-addon-changes.outputs.changedAddons) }}
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: 🔎 Run Home Assistant Add-on Lint
         uses: frenck/action-addon-linter@v2
@@ -90,7 +90,7 @@ jobs:
         addon: ${{ fromJSON(needs.check-addon-changes.outputs.changedAddons) }}
     steps:
       - name: ↩️ Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: ℹ️ Gather addon info
         id: information

.github/workflows/onpush_builder.yaml

@@ -22,7 +22,7 @@ jobs:
       changedAddons: ${{ steps.find_addons.outputs.changed_addons }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -108,7 +108,7 @@ jobs:
       matrix:
         addon: ${{ fromJSON(needs.detect-changed-addons.outputs.changedAddons) }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Run Home Assistant Add-on Lint
         uses: frenck/action-addon-linter@v2
         with:
@@ -133,7 +133,7 @@ jobs:
           - arch: aarch64
             runner: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
 
@@ -331,7 +331,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -402,7 +402,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/weekly_crlftolf.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository contents
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Use action to check for CRLF endings
         uses: erclu/check-crlf@v1
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest # Use a Linux runner
     steps:
       - name: Checkout repository contents
-        uses: actions/checkout@v6 # Use the checkout action
+        uses: actions/checkout@v7 # Use the checkout action
       - name: Find files with CRLF endings
         uses: erclu/check-crlf@v1.2.0 # Use the check-crlf action
         id: check-crlf # Assign an id to this step

.github/workflows/weekly_reduceimagesize.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
 
       - name: Compress Images
         id: calibre

.github/workflows/weekly_stats.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
       - name: Create stats
         run: |
           echo "Starting"

birdnet-go/CHANGELOG.md

@@ -1,3 +1,8 @@
+## nightly-20260615-2 (2026-06-23)
+- MariaDB auto-config: resolve MariaDB hostname to IPv4 before connecting — on HAOS >=17.3 the Supervisor network gained IPv6 but the MariaDB addon only grants the service user from the IPv4 subnet, causing authentication failures and `CREATE DATABASE` errors; also add `--skip-ssl` to match the connection approach used by other addons
+- MariaDB auto-config: disabling `mariadb_auto_config` now reverts to SQLite only when `output.mysql.host` in config.yaml matches the HA MariaDB host (avoids clobbering manually-configured MySQL pointing at a different server)
+- Added `mariadb-client` to the addon packages so the `mysql` CLI used for database creation is available inside the container
+
  - MQTT auto-config now also enables BirdNET-Go's native Home Assistant MQTT auto-discovery: detection sensors appear in Home Assistant automatically with no manual YAML (existing UI/config.yaml edits are preserved)
 - MQTT auto-config seeds `realtime.mqtt.retain: true` (only when unset) so sensor states survive Home Assistant restarts
 - Added supervisor watchdog (tcp://[HOST]:[PORT:8080]) so the add-on is automatically restarted if BirdNET-Go stops responding

birdnet-go/Dockerfile

@@ -62,7 +62,7 @@ COPY ha_automodules.sh /ha_automodules.sh
 RUN chmod 744 /ha_automodules.sh && /ha_automodules.sh "$MODULES" && rm /ha_automodules.sh
 
 # Manual apps
-ENV PACKAGES="alsa-utils libasound2-plugins nginx yq"
+ENV PACKAGES="alsa-utils libasound2-plugins mariadb-client nginx yq"
 
 # Automatic apps & bashio
 COPY ha_autoapps.sh /ha_autoapps.sh

birdnet-go/config.yaml

@@ -128,5 +128,5 @@ slug: birdnet-go
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/birdnet-go
 usb: true
-version: "nightly-20260615"
-watchdog: tcp://[HOST]:[PORT:8080]
+version: "nightly-20260615-2"
+video: true

birdnet-go/rootfs/etc/cont-init.d/33-mariadb.sh

@@ -6,8 +6,17 @@ set -e
 # credentials directly into BirdNET-Go's config.yaml. Upstream reads MySQL
 # settings only from YAML (no env-var overrides exist), so this is the only
 # way to auto-configure them. The behaviour is opt-in via the
-# mariadb_auto_config addon option. When the option is off but MariaDB is
-# detected, we log a one-shot hint pointing users at the option.
+# mariadb_auto_config addon option.
+#
+# When the option is off but MariaDB is detected, we log a one-shot hint and
+# ensure config.yaml falls back to SQLite (reverting any previously written
+# mysql block). This is safe because BirdNET-Go's config.yaml defaults to
+# SQLite and the mysql block is only ever written by this script.
+#
+# When the option is on we:
+#   1. Create the "birdnet" database if it does not already exist — birdnet-go
+#      connects to an existing schema and does not create it automatically.
+#   2. Write the MySQL credentials into config.yaml and disable SQLite.
 
 CONFIG_LOCATION="/config/config.yaml"
 MYSQL_DATABASE="birdnet"
@@ -23,13 +32,27 @@ MYSQL_PASS="$(bashio::services 'mysql' 'password')"
 
 if ! bashio::config.true 'mariadb_auto_config'; then
     bashio::log.green "---"
-    bashio::log.yellow "Home Assistant MariaDB addon detected. Set 'mariadb_auto_config: true' in the addon options to wire it into BirdNET-Go automatically (and disable SQLite). Connection details:"
+    bashio::log.yellow "Home Assistant MariaDB addon detected but mariadb_auto_config is disabled; ensuring BirdNET-Go uses SQLite."
+    bashio::log.yellow "Set 'mariadb_auto_config: true' in the addon options to wire MariaDB into BirdNET-Go automatically. Connection details:"
     bashio::log.blue "Database user    : ${MYSQL_USER}"
-    bashio::log.blue "Database password: ${MYSQL_PASS}"
+    bashio::log.blue "Database password: [redacted]"
     bashio::log.blue "Database name    : ${MYSQL_DATABASE}"
     bashio::log.blue "Host-name        : ${MYSQL_HOST}"
     bashio::log.blue "Port             : ${MYSQL_PORT}"
     bashio::log.green "---"
+    if [ -f "$CONFIG_LOCATION" ]; then
+        # Only revert if config.yaml points at the HA MariaDB host we would have
+        # written — a mysql block pointing at a different host was set manually.
+        # shellcheck disable=SC2016
+        CURRENT_MYSQL_HOST="$(yq -r '.output.mysql.host // empty' "$CONFIG_LOCATION" 2>/dev/null || true)"
+        if yq -e '.output.mysql.enabled == true' "$CONFIG_LOCATION" >/dev/null 2>&1 \
+            && [ "${CURRENT_MYSQL_HOST}" = "${MYSQL_HOST}" ]; then
+            yq -i -y \
+                '.output.mysql.enabled = false
+                 | .output.sqlite.enabled = true' \
+                "$CONFIG_LOCATION"
+        fi
+    fi
     exit 0
 fi
 
@@ -39,12 +62,36 @@ if [ ! -f "$CONFIG_LOCATION" ]; then
 fi
 
 bashio::log.green "---"
-bashio::log.blue "mariadb_auto_config enabled; writing Home Assistant MariaDB credentials into BirdNET-Go config and disabling SQLite"
+bashio::log.blue "mariadb_auto_config enabled; creating MariaDB database and wiring credentials into BirdNET-Go config"
 bashio::log.blue "Host:     ${MYSQL_HOST}:${MYSQL_PORT}"
 bashio::log.blue "User:     ${MYSQL_USER}"
-bashio::log.blue "Database: ${MYSQL_DATABASE} (will be created by BirdNET-Go on first connect)"
+bashio::log.blue "Database: ${MYSQL_DATABASE}"
 bashio::log.green "---"
 
+# Resolve MariaDB hostname to IPv4: on HAOS >=17.3 the Supervisor network
+# gained IPv6, but the MariaDB addon only grants its user from the IPv4
+# subnet. Fall back to the raw hostname if resolution fails.
+MYSQL_HOST_RESOLVED="$(getent ahostsv4 "${MYSQL_HOST}" 2>/dev/null | awk '{print $1; exit}')"
+MYSQL_HOST_RESOLVED="${MYSQL_HOST_RESOLVED:-${MYSQL_HOST}}"
+if [ "${MYSQL_HOST_RESOLVED}" != "${MYSQL_HOST}" ]; then
+    bashio::log.blue "Resolved ${MYSQL_HOST} -> ${MYSQL_HOST_RESOLVED} (forcing IPv4)"
+fi
+
+# Create the database — birdnet-go connects to an existing schema and does NOT
+# create it automatically. MYSQL_PWD avoids exposing the password via the
+# process command line.
+if ! MYSQL_PWD="${MYSQL_PASS}" mysql \
+    --skip-ssl \
+    --host="${MYSQL_HOST_RESOLVED}" \
+    --port="${MYSQL_PORT}" \
+    --user="${MYSQL_USER}" \
+    --connect-timeout=10 \
+    -e "CREATE DATABASE IF NOT EXISTS \`${MYSQL_DATABASE}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"; then
+    bashio::log.error "Failed to create MariaDB database '${MYSQL_DATABASE}' — verify the MariaDB addon is running and the user has CREATE DATABASE privileges"
+    exit 1
+fi
+bashio::log.blue "Database '${MYSQL_DATABASE}' is ready"
+
 # Upstream config.go stores port as a string; pass it as such to match.
 # $host / $port / etc. are jq/yq variables, not shell expansions — the
 # single quotes around the filter are intentional.