diff --git a/debian_todo/__init__.py b/debian_todo/__init__.py
index cc141fc..ce2768b 100644
--- a/debian_todo/__init__.py
+++ b/debian_todo/__init__.py
@@ -5,12 +5,15 @@ packages where a new upstream version is available. Filters out pre-release
 versions and shows team/uploader metadata.
 """
 
+import datetime
 import json
 import re
 import glob
 import os
+import shutil
 import subprocess
 import sys
+import urllib.error
 from pathlib import Path
 from typing import Any, Optional, cast
 from urllib.request import urlopen
@@ -38,6 +41,97 @@ HIDE_UPLOADER = "Edward Betts <edward@4angle.com>"
 DEBIAN_SRC_BASE = Path.home() / "src" / "debian"
 
 
+class PackageUpdateError(Exception):
+    """Base exception for package update operations."""
+    pass
+
+
+class PackageNotFoundError(PackageUpdateError):
+    """Package not found in source info."""
+    pass
+
+
+class RepositoryStateError(PackageUpdateError):
+    """Repository in invalid state (uncommitted changes, etc)."""
+    pass
+
+
+class ExternalCommandError(PackageUpdateError):
+    """External command failed (salsa, gbp, dch)."""
+    def __init__(self, command: str, returncode: int, message: str):
+        self.command = command
+        self.returncode = returncode
+        super().__init__(message)
+
+
+class MissingToolError(PackageUpdateError):
+    """Required external tool not available."""
+    pass
+
+
+def run_command(
+    cmd: list[str],
+    cwd: Path,
+    description: str,
+    capture_output: bool = False,
+    check: bool = True,
+) -> subprocess.CompletedProcess:
+    """Run command with consistent error handling.
+
+    Args:
+        cmd: Command and arguments to run
+        cwd: Working directory for the command
+        description: Human-readable description of what the command does
+        capture_output: Whether to capture stdout/stderr
+        check: Whether to raise exception on non-zero exit
+
+    Returns:
+        CompletedProcess instance
+
+    Raises:
+        ExternalCommandError: If command fails and check=True
+        MissingToolError: If command not found
+    """
+    try:
+        result = subprocess.run(
+            cmd,
+            cwd=cwd,
+            capture_output=capture_output,
+            text=True,
+        )
+        if check and result.returncode != 0:
+            cmd_str = " ".join(cmd)
+            raise ExternalCommandError(
+                command=cmd_str,
+                returncode=result.returncode,
+                message=f"{description} failed: {cmd_str} (exit code {result.returncode})",
+            )
+        return result
+    except FileNotFoundError as e:
+        raise MissingToolError(
+            f"Command not found: {cmd[0]}. Please install it to continue."
+        ) from e
+
+
+def check_required_tools() -> None:
+    """Check that required external tools are available.
+
+    Raises:
+        MissingToolError: If a required tool is not found
+    """
+    required_tools = ["salsa", "gbp", "dch"]
+    missing_tools = []
+    for tool in required_tools:
+        if not shutil.which(tool):
+            missing_tools.append(tool)
+
+    if missing_tools:
+        tools_str = ", ".join(missing_tools)
+        raise MissingToolError(
+            f"Required tools not found: {tools_str}. Please install them to continue."
+        )
+
+
 def parse_details(details: str) -> tuple[str, Optional[str]]:
     """Parse version details string into new and current versions.
 
@@ -195,11 +289,40 @@ def load_source_info_map() -> dict[str, SourceInfo]:
     return vcs_by_source
 
 
-def fetch_todo_list() -> TodoList:
-    """Fetch the TODO list from UDD as JSON."""
-    with urlopen(TODO_URL) as response:
-        payload = response.read().decode("utf-8")
-    return cast(TodoList, json.loads(payload))
+def fetch_todo_list(timeout: int = 30) -> TodoList:
+    """Fetch the TODO list from UDD as JSON.
+
+    Args:
+        timeout: Request timeout in seconds (default: 30)
+
+    Returns:
+        List of TODO items
+
+    Raises:
+        PackageUpdateError: If network request fails or JSON is invalid
+    """
+    try:
+        with urlopen(TODO_URL, timeout=timeout) as response:
+            payload = response.read().decode("utf-8")
+    except urllib.error.HTTPError as e:
+        raise PackageUpdateError(
+            f"HTTP error {e.code} while fetching TODO list from {TODO_URL}: {e.reason}"
+        ) from e
+    except urllib.error.URLError as e:
+        raise PackageUpdateError(
+            f"Network error while fetching TODO list from {TODO_URL}: {e.reason}"
+        ) from e
+    except TimeoutError as e:
+        raise PackageUpdateError(
+            f"Timeout after {timeout}s while fetching TODO list from {TODO_URL}"
+        ) from e
+
+    try:
+        return cast(TodoList, json.loads(payload))
+    except json.JSONDecodeError as e:
+        raise PackageUpdateError(
+            f"Invalid JSON in TODO list response: {e}"
+        ) from e
 
 
 def save_todo_list(todo_list: TodoList) -> None:
@@ -328,8 +451,13 @@ def list_todos(include_prerelease: bool) -> None:
     """
     if not TODO_PATH.exists():
         print("Downloading todo.json...")
-        todo_list = fetch_todo_list()
-        save_todo_list(todo_list)
+        try:
+            todo_list = fetch_todo_list()
+            save_todo_list(todo_list)
+        except PackageUpdateError as e:
+            print(f"Error: {e}", file=sys.stderr)
+            print("Please try again later or check your network connection.", file=sys.stderr)
+            sys.exit(1)
     else:
         with TODO_PATH.open("r", encoding="utf-8") as handle:
             todo_list = cast(TodoList, json.load(handle))
@@ -394,7 +522,14 @@ def update_todos() -> None:
     if TODO_PATH.exists():
         with TODO_PATH.open("r", encoding="utf-8") as handle:
             old_list = cast(TodoList, json.load(handle))
-    todo_list = fetch_todo_list()
+
+    try:
+        todo_list = fetch_todo_list()
+    except PackageUpdateError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        print("Failed to fetch updated TODO list.", file=sys.stderr)
+        sys.exit(1)
+
     save_todo_list(todo_list)
     print_changes(filter_todo_list(old_list), filter_todo_list(todo_list))
 
@@ -464,21 +599,39 @@ def add_changelog_entry(pkg_dir: Path) -> bool:
     return result.returncode == 0
 
 
-def update_package(package: str) -> None:
-    """Update a Debian package to a new upstream version.
+def validate_package_info(package: str) -> SourceInfo:
+    """Validate package exists in source info map.
 
-    Checks out the package if not already present, imports the new upstream
-    version using gbp, and creates a new changelog entry.
+    Args:
+        package: Package name to validate
+
+    Returns:
+        Source info dictionary containing vcs_git and uploaders
+
+    Raises:
+        PackageNotFoundError: If package not found or has no vcs_git
     """
     source_info_map = load_source_info_map()
     source_info = source_info_map.get(package)
 
     if not source_info or not source_info.get("vcs_git"):
-        print(
-            f"Error: Could not find team info for package '{package}'", file=sys.stderr
+        raise PackageNotFoundError(
+            f"Could not find team info for package '{package}'"
         )
-        sys.exit(1)
 
+    return source_info
+
+
+def resolve_package_directories(package: str, source_info: SourceInfo) -> tuple[Path, Path, Path]:
+    """Resolve team_dir, pkg_dir, and repo_dir paths.
+
+    Args:
+        package: Package name
+        source_info: Source info dictionary with vcs_git
+
+    Returns:
+        Tuple of (team_dir, pkg_dir, repo_dir)
+    """
     team_slug = source_info["vcs_git"]
     display_team = team_slug_to_display_name(team_slug).lower()
 
@@ -486,46 +639,508 @@ def update_package(package: str) -> None:
     pkg_dir = team_dir / package
     repo_dir = pkg_dir / package
 
-    # Create package directory if it doesn't exist
-    pkg_dir.mkdir(parents=True, exist_ok=True)
+    return team_dir, pkg_dir, repo_dir
 
-    if not repo_dir.exists():
-        # Package not checked out, do salsa checkout
-        print(f"Checking out {package} into {pkg_dir}...")
-        salsa_path = f"{team_slug}/deps/{package}"
-        result = subprocess.run(
-            ["salsa", "checkout", salsa_path],
-            cwd=pkg_dir,
+
+def ensure_package_checkout(package: str, source_info: SourceInfo, pkg_dir: Path) -> None:
+    """Checkout package from salsa.
+
+    Args:
+        package: Package name
+        source_info: Source info dictionary with vcs_git
+        pkg_dir: Directory to check out into
+
+    Raises:
+        ExternalCommandError: If salsa checkout fails
+        RepositoryStateError: If directory creation fails
+    """
+    try:
+        pkg_dir.mkdir(parents=True, exist_ok=True)
+    except OSError as e:
+        raise RepositoryStateError(
+            f"Failed to create directory {pkg_dir}: {e}"
+        ) from e
+
+    print(f"Checking out {package} into {pkg_dir}...")
+    team_slug = source_info["vcs_git"]
+    salsa_path = f"{team_slug}/deps/{package}"
+    run_command(
+        ["salsa", "checkout", salsa_path],
+        pkg_dir,
+        f"Checkout {salsa_path}",
+    )
+
+
+def validate_repository_state(repo_dir: Path) -> None:
+    """Validate repository has no uncommitted changes.
+
+    Args:
+        repo_dir: Repository directory to check
+
+    Raises:
+        RepositoryStateError: If there are uncommitted changes
+    """
+    if has_uncommitted_changes(repo_dir):
+        raise RepositoryStateError(
+            f"{repo_dir} has uncommitted changes. "
+            "Please commit or stash them first."
         )
-        if result.returncode != 0:
-            print(f"Error: salsa checkout failed for {salsa_path}", file=sys.stderr)
-            sys.exit(1)
-    else:
-        # Package already checked out, check for uncommitted changes
-        if has_uncommitted_changes(repo_dir):
-            print(
-                f"Error: {repo_dir} has uncommitted changes. "
-                "Please commit or stash them first.",
-                file=sys.stderr,
+
+
+def run_gbp_pq_workflow(repo_dir: Path) -> None:
+    """Run gbp pq import and switch.
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If gbp pq commands fail
+    """
+    run_command(
+        ["gbp", "pq", "import"],
+        repo_dir,
+        "Import patch queue",
+    )
+
+    run_command(
+        ["gbp", "pq", "switch"],
+        repo_dir,
+        "Switch to patch branch",
+    )
+
+
+def import_upstream_version(repo_dir: Path) -> None:
+    """Import new upstream version using gbp.
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If gbp import-orig fails
+    """
+    print("Importing new upstream version...")
+    run_command(
+        ["gbp", "import-orig", "--uscan", "--pristine-tar", "--no-interactive"],
+        repo_dir,
+        "Import upstream version",
+    )
+
+
+def update_debian_control(repo_dir: Path) -> None:
+    """Update debian/control file.
+
+    - Removes obsolete 'Priority: optional' (now default)
+    - Removes obsolete 'Rules-Requires-Root: no' (now default)
+    - Updates Standards-Version to current (4.7.3)
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If dch command fails
+    """
+    control_path = repo_dir / "debian" / "control"
+    if not control_path.exists():
+        return
+
+    lines = control_path.read_text().splitlines()
+    current_standards_version = "4.7.3"
+    new_lines = []
+
+    for line in lines:
+        if line == "Priority: optional":
+            run_command(
+                ["dch", "-a", "Remove 'Priority: optional', now the default."],
+                repo_dir,
+                "Add changelog entry for Priority removal",
             )
-            sys.exit(1)
+            continue
+        if line == "Rules-Requires-Root: no":
+            run_command(
+                ["dch", "-a", "Remove 'Rules-Requires-Root: no', now the default."],
+                repo_dir,
+                "Add changelog entry for Rules-Requires-Root removal",
+            )
+            continue
+        if line.startswith("Standards-Version: "):
+            standards_version = line[len("Standards-Version: "):]
+            if standards_version != current_standards_version:
+                line = "Standards-Version: " + current_standards_version
+                run_command(
+                    ["dch", "-a", "Update Standards-Version."],
+                    repo_dir,
+                    "Add changelog entry for Standards-Version update",
+                )
+
+        new_lines.append(line)
+
+    control_path.write_text("\n".join(new_lines) + "\n")
+
+
+def update_debian_copyright_year(repo_dir: Path) -> None:
+    """Update Edward Betts' copyright years in debian/copyright.
+
+    Transforms:
+      - "Copyright: 2025 Edward Betts <...>" -> "Copyright: 2025-2026 Edward Betts <...>"
+      - "Copyright: 2022-2024 Edward Betts <...>" -> "Copyright: 2022-2026 Edward Betts <...>"
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If dch command fails
+    """
+    copyright_path = repo_dir / "debian" / "copyright"
+    if not copyright_path.exists():
+        return
+
+    full_name_email = "Edward Betts <edward@4angle.com>"
+    year = datetime.date.today().year
+    original = copyright_path.read_text(encoding="utf-8")
+
+    holder_re = re.escape(full_name_email)
+    copyright_line_re = re.compile(
+        rf"^(?P<indent>\s*)"
+        rf"(?:(?P<label>Copyright:\s+))?"
+        rf"(?P<years>\d{{4}}(?:-\d{{4}})?)"
+        rf"(?P<suffix>\s+{holder_re}\s*)$"
+    )
+
+    copyright_field_start_re = re.compile(r"^\s*Copyright:\s+")
+    field_start_re = re.compile(r"^(?:\S[^:]*):\s*")
+    continuation_re = re.compile(r"^\s+")
+
+    def update_years_token(years: str) -> Optional[str]:
+        """Return an updated years token, or None if no change is needed."""
+        if "-" in years:
+            start_s, end_s = years.split("-", 1)
+            start = int(start_s)
+            end = int(end_s)
+        else:
+            start = end = int(years)
+
+        if end >= year:
+            return None
+
+        return f"{start}-{year}" if start != year else str(year)
+
+    lines = original.splitlines(keepends=True)
+    out: list[str] = []
+    in_copyright_field = False
+
+    for line in lines:
+        stripped = line.rstrip("\n")
+
+        if field_start_re.match(stripped) and not copyright_field_start_re.match(stripped):
+            in_copyright_field = False
+
+        if copyright_field_start_re.match(stripped):
+            in_copyright_field = True
+
+        m = copyright_line_re.match(stripped)
+
+        should_consider = False
+        if m and m.group("label"):
+            should_consider = True
+        elif m and in_copyright_field and continuation_re.match(stripped):
+            should_consider = True
+
+        if should_consider and m:
+            new_years = update_years_token(m.group("years"))
+            if new_years is not None:
+                indent = m.group("indent")
+                label = m.group("label") or ""
+                suffix = m.group("suffix")
+                line = f"{indent}{label}{new_years}{suffix}\n"
+
+        out.append(line)
+
+    updated = "".join(out)
+
+    if updated != original:
+        copyright_path.write_text(updated, encoding="utf-8")
+        run_command(
+            ["dch", "-a", "Update copyright year."],
+            repo_dir,
+            "Add changelog entry for copyright year update",
+        )
+
+
+def update_debian_watch(repo_dir: Path) -> None:
+    """Upgrade debian/watch from version 4 to version 5.
+
+    Supports GitHub and PyPI watch entries.
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If dch command fails
+    """
+    watch_path = repo_dir / "debian" / "watch"
+    if not watch_path.exists():
+        return
+
+    try:
+        original = watch_path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return
+
+    # Already version 5
+    if re.search(r"(?im)^\s*Version:\s*5\s*$", original):
+        return
+
+    # GitHub URL patterns
+    github_url_re = re.compile(
+        r"""(?xi)
+        https?://github\.com/
+        (?P<owner>[^/\s]+)/(?P<repo>[^/\s#?]+)
+        (?:/(?:releases|tags))?
+        (?:[^\s]*)?
+        """
+    )
+
+    # PyPI URL patterns
+    pypi_debian_net_re = re.compile(
+        r"""(?xi)
+        https?://pypi\.debian\.net/
+        (?P<name>[a-z0-9][a-z0-9._-]*)
+        /
+        """
+    )
+
+    pypi_python_org_source_re = re.compile(
+        r"""(?xi)
+        https?://pypi(?:\.python)?\.org/
+        packages/source/
+        (?P<letter>[a-z0-9])/
+        (?P<name>[a-z0-9][a-z0-9._-]*)
+        /
+        """
+    )
+
+    pythonhosted_re = re.compile(
+        r"""(?xi)
+        https?://files\.pythonhosted\.org/
+        packages/source/
+        (?P<letter>[a-z0-9])/
+        (?P<name>[a-z0-9][a-z0-9._-]*)
+        /
+        """
+    )
+
+    # Join wrapped lines
+    joined_lines = []
+    buf = ""
+    for line in original.splitlines():
+        if line.rstrip().endswith("\\"):
+            buf += line.rstrip()[:-1] + " "
+        else:
+            joined_lines.append(buf + line)
+            buf = ""
+    if buf:
+        joined_lines.append(buf)
+    joined = "\n".join(joined_lines)
+
+    # Try GitHub first
+    m = github_url_re.search(joined)
+    if m:
+        owner, repo = m.group("owner"), m.group("repo")
+        if repo.endswith(".git"):
+            repo = repo[:-4]
+        new_body = (
+            "Version: 5\n"
+            "\n"
+            "Template: GitHub\n"
+            f"Owner: {owner}\n"
+            f"Project: {repo}\n"
+        )
+    else:
+        # Try PyPI
+        pypi_name = None
+        for pattern in [pypi_debian_net_re, pypi_python_org_source_re, pythonhosted_re]:
+            m = pattern.search(joined)
+            if m:
+                pypi_name = m.group("name")
+                break
+
+        if not pypi_name:
+            # Can't upgrade this watch file
+            return
+
+        new_body = f"Version: 5\n\nTemplate: Pypi\nDist: {pypi_name}\n"
+
+    # Preserve leading comments
+    leading = []
+    for line in original.splitlines(keepends=True):
+        if line.lstrip().startswith("#") or not line.strip():
+            leading.append(line)
+            continue
+        break
+    header = "".join(leading).rstrip()
+    if header:
+        header += "\n\n"
+
+    new_contents = header + new_body
+
+    if new_contents != original:
+        watch_path.write_text(new_contents, encoding="utf-8")
+        run_command(
+            ["dch", "-a", "Update debian/watch to format version 5."],
+            repo_dir,
+            "Add changelog entry for debian/watch update",
+        )
+
+
+def add_salsa_ci(repo_dir: Path) -> None:
+    """Add debian/salsa-ci.yml if missing.
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If git or dch commands fail
+    """
+    salsa_ci_path = repo_dir / "debian" / "salsa-ci.yml"
+    if salsa_ci_path.exists():
+        return
+
+    control_path = repo_dir / "debian" / "control"
+    if not control_path.exists():
+        return
+
+    # Extract salsa repo from Vcs-Git
+    vcs_git_re = re.compile(r"^Vcs-Git: https://salsa\.debian\.org/(.*).git$")
+    salsa_repo = None
+    with control_path.open() as f:
+        for line in f:
+            if not line.startswith("Vcs-Git"):
+                continue
+            m = vcs_git_re.match(line.rstrip())
+            if m:
+                salsa_repo = m.group(1)
+                break
+
+    if not salsa_repo:
+        return
+
+    content = """---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
+"""
+
+    salsa_ci_path.write_text(content)
+
+    run_command(
+        ["git", "add", str(salsa_ci_path)],
+        repo_dir,
+        "Add debian/salsa-ci.yml to git",
+    )
+
+    run_command(
+        ["dch", "-a", "Add debian/salsa-ci.yml."],
+        repo_dir,
+        "Add changelog entry for salsa-ci.yml",
+    )
+
+    # Update salsa project settings for homeassistant-team
+    if salsa_repo.startswith("homeassistant-team"):
+        run_command(
+            [
+                "salsa",
+                "update_projects",
+                salsa_repo,
+                "--jobs",
+                "yes",
+                "--ci-config-path",
+                "debian/salsa-ci.yml",
+            ],
+            repo_dir,
+            "Update salsa project CI settings",
+            check=False,  # Don't fail if this doesn't work
+        )
+
+
+def run_package_updates(repo_dir: Path) -> None:
+    """Run all package update operations.
+
+    Performs the following updates:
+    - Update debian/control (remove obsolete fields, update Standards-Version)
+    - Update copyright year
+    - Upgrade debian/watch to version 5
+    - Add debian/salsa-ci.yml if missing
+
+    Args:
+        repo_dir: Repository directory
+
+    Raises:
+        ExternalCommandError: If any update command fails
+    """
+    print("Updating package files...")
+    update_debian_control(repo_dir)
+    update_debian_copyright_year(repo_dir)
+    update_debian_watch(repo_dir)
+    add_salsa_ci(repo_dir)
+
+
+def update_package(package: str) -> None:
+    """Update a Debian package to a new upstream version.
+
+    Checks out the package if not already present, imports the new upstream
+    version using gbp, and creates a new changelog entry.
+
+    Raises:
+        PackageNotFoundError: If package not found in source info
+        RepositoryStateError: If repository has uncommitted changes
+        ExternalCommandError: If any external command fails
+        MissingToolError: If required tools are not available
+    """
+    # Validate package exists and check required tools
+    source_info = validate_package_info(package)
+    check_required_tools()
+
+    # Resolve directory paths
+    team_dir, pkg_dir, repo_dir = resolve_package_directories(package, source_info)
+
+    # Checkout package if needed, or validate existing checkout
+    if not repo_dir.exists():
+        ensure_package_checkout(package, source_info, pkg_dir)
+    else:
+        validate_repository_state(repo_dir)
         print(f"Package {package} already checked out at {pkg_dir}")
 
+    # Run gbp pq workflow
+    run_gbp_pq_workflow(repo_dir)
+
     # Import new upstream version
-    print("Importing new upstream version...")
-    result = subprocess.run(
-        ["gbp", "import-orig", "--uscan", "--pristine-tar", "--no-interactive"],
-        cwd=repo_dir,
-    )
-    if result.returncode != 0:
-        print("Error: gbp import-orig failed", file=sys.stderr)
-        sys.exit(1)
+    import_upstream_version(repo_dir)
 
     # Add changelog entry
     print("Adding changelog entry...")
-    if not add_changelog_entry(repo_dir):
-        print("Error: Failed to add changelog entry", file=sys.stderr)
-        sys.exit(1)
+    version = extract_upstream_version_from_git_log(repo_dir)
+    if not version:
+        raise ExternalCommandError(
+            "git log",
+            0,
+            "Could not find upstream version in git log.",
+        )
+
+    new_version = f"{version}-1"
+    run_command(
+        [
+            "dch",
+            "--release-heuristic",
+            "log",
+            "--newversion",
+            new_version,
+            "New upstream release.",
+        ],
+        repo_dir,
+        "Add changelog entry",
+    )
+
+    # Run package updates
+    run_package_updates(repo_dir)
 
     print(f"Successfully updated {package}")
     print(repo_dir)
@@ -557,7 +1172,11 @@ def update_command() -> None:
 @cli.command("update-pkg", help="Update a package to a new upstream version.")
 @click.argument("package")
 def update_pkg_command(package: str) -> None:
-    update_package(package)
+    try:
+        update_package(package)
+    except PackageUpdateError as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
 
 
 def main() -> None:
diff --git a/tests/test_update_pkg.py b/tests/test_update_pkg.py
new file mode 100644
index 0000000..266d310
--- /dev/null
+++ b/tests/test_update_pkg.py
@@ -0,0 +1,914 @@
+"""Tests for update-pkg command functions."""
+
+import datetime
+import json
+import os
+import subprocess
+import urllib.error
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+import debian_todo
+
+
+class TestRunCommand:
+    """Tests for run_command helper function."""
+
+    def test_successful_command(self, tmp_path):
+        """Test running a successful command."""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(returncode=0, stdout="", stderr="")
+            result = debian_todo.run_command(
+                ["echo", "test"], tmp_path, "Test command"
+            )
+            assert result.returncode == 0
+
+    def test_command_with_capture_output(self, tmp_path):
+        """Test running a command with output capture."""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                returncode=0, stdout="output", stderr=""
+            )
+            result = debian_todo.run_command(
+                ["echo", "test"], tmp_path, "Test command", capture_output=True
+            )
+            assert result.stdout == "output"
+            mock_run.assert_called_once_with(
+                ["echo", "test"], cwd=tmp_path, capture_output=True, text=True
+            )
+
+    def test_command_failure_with_check(self, tmp_path):
+        """Test command failure raises ExternalCommandError when check=True."""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(returncode=1, stdout="", stderr="")
+            with pytest.raises(debian_todo.ExternalCommandError) as exc_info:
+                debian_todo.run_command(
+                    ["false"], tmp_path, "Test command", check=True
+                )
+            assert exc_info.value.returncode == 1
+            assert "false" in exc_info.value.command
+            assert "Test command failed" in str(exc_info.value)
+
+    def test_command_failure_without_check(self, tmp_path):
+        """Test command failure returns result when check=False."""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(returncode=1, stdout="", stderr="")
+            result = debian_todo.run_command(
+                ["false"], tmp_path, "Test command", check=False
+            )
+            assert result.returncode == 1
+
+    def test_missing_command(self, tmp_path):
+        """Test missing command raises MissingToolError."""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.side_effect = FileNotFoundError("command not found")
+            with pytest.raises(debian_todo.MissingToolError) as exc_info:
+                debian_todo.run_command(
+                    ["nonexistent"], tmp_path, "Test command"
+                )
+            assert "nonexistent" in str(exc_info.value)
+
+
+class TestCheckRequiredTools:
+    """Tests for check_required_tools function."""
+
+    def test_all_tools_available(self):
+        """Test when all required tools are available."""
+        with patch("debian_todo.shutil.which") as mock_which:
+            mock_which.return_value = "/usr/bin/tool"
+            debian_todo.check_required_tools()
+            assert mock_which.call_count == 3
+
+    def test_missing_salsa(self):
+        """Test when salsa is missing."""
+        with patch("debian_todo.shutil.which") as mock_which:
+            def which_side_effect(tool):
+                return None if tool == "salsa" else "/usr/bin/tool"
+            mock_which.side_effect = which_side_effect
+            with pytest.raises(debian_todo.MissingToolError) as exc_info:
+                debian_todo.check_required_tools()
+            assert "salsa" in str(exc_info.value)
+
+    def test_missing_gbp(self):
+        """Test when gbp is missing."""
+        with patch("debian_todo.shutil.which") as mock_which:
+            def which_side_effect(tool):
+                return None if tool == "gbp" else "/usr/bin/tool"
+            mock_which.side_effect = which_side_effect
+            with pytest.raises(debian_todo.MissingToolError) as exc_info:
+                debian_todo.check_required_tools()
+            assert "gbp" in str(exc_info.value)
+
+    def test_missing_multiple_tools(self):
+        """Test when multiple tools are missing."""
+        with patch("debian_todo.shutil.which") as mock_which:
+            mock_which.return_value = None
+            with pytest.raises(debian_todo.MissingToolError) as exc_info:
+                debian_todo.check_required_tools()
+            error_msg = str(exc_info.value)
+            assert "salsa" in error_msg
+            assert "gbp" in error_msg
+            assert "dch" in error_msg
+
+
+class TestFetchTodoListErrors:
+    """Tests for fetch_todo_list error handling."""
+
+    def test_http_error(self):
+        """Test HTTP error handling."""
+        with patch("debian_todo.urlopen") as mock_urlopen:
+            mock_urlopen.side_effect = urllib.error.HTTPError(
+                debian_todo.TODO_URL, 404, "Not Found", {}, None
+            )
+            with pytest.raises(debian_todo.PackageUpdateError) as exc_info:
+                debian_todo.fetch_todo_list()
+            assert "HTTP error 404" in str(exc_info.value)
+            assert "Not Found" in str(exc_info.value)
+
+    def test_network_error(self):
+        """Test network error handling."""
+        with patch("debian_todo.urlopen") as mock_urlopen:
+            mock_urlopen.side_effect = urllib.error.URLError("Connection refused")
+            with pytest.raises(debian_todo.PackageUpdateError) as exc_info:
+                debian_todo.fetch_todo_list()
+            assert "Network error" in str(exc_info.value)
+            assert "Connection refused" in str(exc_info.value)
+
+    def test_timeout_error(self):
+        """Test timeout error handling."""
+        with patch("debian_todo.urlopen") as mock_urlopen:
+            mock_urlopen.side_effect = TimeoutError("Request timed out")
+            with pytest.raises(debian_todo.PackageUpdateError) as exc_info:
+                debian_todo.fetch_todo_list(timeout=10)
+            assert "Timeout after 10s" in str(exc_info.value)
+
+    def test_invalid_json(self):
+        """Test invalid JSON response handling."""
+        with patch("debian_todo.urlopen") as mock_urlopen:
+            mock_response = MagicMock()
+            mock_response.read.return_value = b"not valid json {"
+            mock_response.__enter__ = lambda self: self
+            mock_response.__exit__ = lambda self, *args: None
+            mock_urlopen.return_value = mock_response
+            with pytest.raises(debian_todo.PackageUpdateError) as exc_info:
+                debian_todo.fetch_todo_list()
+            assert "Invalid JSON" in str(exc_info.value)
+
+    def test_successful_fetch(self):
+        """Test successful fetch."""
+        with patch("debian_todo.urlopen") as mock_urlopen:
+            mock_response = MagicMock()
+            mock_response.read.return_value = b'[{"source": "pkg1"}]'
+            mock_response.__enter__ = lambda self: self
+            mock_response.__exit__ = lambda self, *args: None
+            mock_urlopen.return_value = mock_response
+            result = debian_todo.fetch_todo_list()
+            assert result == [{"source": "pkg1"}]
+
+
+class TestTeamSlugToDisplayName:
+    """Tests for team_slug_to_display_name function."""
+
+    def test_homeassistant_team(self):
+        assert debian_todo.team_slug_to_display_name("homeassistant-team") == "HA"
+
+    def test_python_team(self):
+        assert debian_todo.team_slug_to_display_name("python-team") == "python"
+
+    def test_openstack_team(self):
+        assert debian_todo.team_slug_to_display_name("openstack-team") == "openstack"
+
+    def test_other_team(self):
+        assert debian_todo.team_slug_to_display_name("rust-team") == "rust"
+
+    def test_no_team_suffix(self):
+        assert debian_todo.team_slug_to_display_name("username") == "username"
+
+
+class TestHasUncommittedChanges:
+    """Tests for has_uncommitted_changes function."""
+
+    def test_no_changes(self, tmp_path):
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(stdout="", returncode=0)
+            assert debian_todo.has_uncommitted_changes(tmp_path) is False
+            mock_run.assert_called_once_with(
+                ["git", "status", "--porcelain"],
+                cwd=tmp_path,
+                capture_output=True,
+                text=True,
+            )
+
+    def test_has_changes(self, tmp_path):
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(stdout=" M file.txt\n", returncode=0)
+            assert debian_todo.has_uncommitted_changes(tmp_path) is True
+
+    def test_untracked_files(self, tmp_path):
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(stdout="?? newfile.txt\n", returncode=0)
+            assert debian_todo.has_uncommitted_changes(tmp_path) is True
+
+    def test_whitespace_only_output(self, tmp_path):
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(stdout="   \n", returncode=0)
+            assert debian_todo.has_uncommitted_changes(tmp_path) is False
+
+
+class TestExtractUpstreamVersionFromGitLog:
+    """Tests for extract_upstream_version_from_git_log function."""
+
+    def test_extracts_version(self, tmp_path):
+        git_log_output = """commit abc123
+Author: Someone <someone@example.com>
+Date:   Mon Jan 1 12:00:00 2024 +0000
+
+    Update upstream source from tag 'upstream/1.2.3'
+"""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                stdout=git_log_output, returncode=0
+            )
+            result = debian_todo.extract_upstream_version_from_git_log(tmp_path)
+            assert result == "1.2.3"
+
+    def test_extracts_complex_version(self, tmp_path):
+        git_log_output = """commit abc123
+Author: Someone <someone@example.com>
+Date:   Mon Jan 1 12:00:00 2024 +0000
+
+    Update upstream source from tag 'upstream/2024.1.0rc1'
+"""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                stdout=git_log_output, returncode=0
+            )
+            result = debian_todo.extract_upstream_version_from_git_log(tmp_path)
+            assert result == "2024.1.0rc1"
+
+    def test_no_upstream_tag(self, tmp_path):
+        git_log_output = """commit abc123
+Author: Someone <someone@example.com>
+Date:   Mon Jan 1 12:00:00 2024 +0000
+
+    Fixed a bug
+"""
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(
+                stdout=git_log_output, returncode=0
+            )
+            result = debian_todo.extract_upstream_version_from_git_log(tmp_path)
+            assert result is None
+
+    def test_git_log_fails(self, tmp_path):
+        with patch("debian_todo.subprocess.run") as mock_run:
+            mock_run.return_value = MagicMock(stdout="", returncode=1)
+            result = debian_todo.extract_upstream_version_from_git_log(tmp_path)
+            assert result is None
+
+
+class TestValidatePackageInfo:
+    """Tests for validate_package_info function."""
+
+    def test_valid_package(self, monkeypatch):
+        """Test validating a package that exists."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        result = debian_todo.validate_package_info("mypkg")
+        assert result == {"vcs_git": "python-team", "uploaders": ""}
+
+    def test_package_not_found(self, monkeypatch):
+        """Test package not in source info map."""
+        monkeypatch.setattr(debian_todo, "load_source_info_map", lambda: {})
+        with pytest.raises(debian_todo.PackageNotFoundError) as exc_info:
+            debian_todo.validate_package_info("nonexistent")
+        assert "nonexistent" in str(exc_info.value)
+
+    def test_package_no_vcs_git(self, monkeypatch):
+        """Test package with no vcs_git field."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "", "uploaders": ""}},
+        )
+        with pytest.raises(debian_todo.PackageNotFoundError) as exc_info:
+            debian_todo.validate_package_info("mypkg")
+        assert "mypkg" in str(exc_info.value)
+
+
+class TestResolvePackageDirectories:
+    """Tests for resolve_package_directories function."""
+
+    def test_python_team_package(self, tmp_path, monkeypatch):
+        """Test resolving directories for python-team package."""
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+        source_info = {"vcs_git": "python-team", "uploaders": ""}
+        team_dir, pkg_dir, repo_dir = debian_todo.resolve_package_directories(
+            "mypkg", source_info
+        )
+        assert team_dir == tmp_path / "python"
+        assert pkg_dir == tmp_path / "python" / "mypkg"
+        assert repo_dir == tmp_path / "python" / "mypkg" / "mypkg"
+
+    def test_homeassistant_team_package(self, tmp_path, monkeypatch):
+        """Test resolving directories for homeassistant-team package."""
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+        source_info = {"vcs_git": "homeassistant-team", "uploaders": ""}
+        team_dir, pkg_dir, repo_dir = debian_todo.resolve_package_directories(
+            "ha-pkg", source_info
+        )
+        assert team_dir == tmp_path / "ha"
+        assert pkg_dir == tmp_path / "ha" / "ha-pkg"
+        assert repo_dir == tmp_path / "ha" / "ha-pkg" / "ha-pkg"
+
+
+class TestEnsurePackageCheckout:
+    """Tests for ensure_package_checkout function."""
+
+    def test_successful_checkout(self, tmp_path):
+        """Test successful package checkout."""
+        pkg_dir = tmp_path / "python" / "mypkg"
+        source_info = {"vcs_git": "python-team", "uploaders": ""}
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.ensure_package_checkout("mypkg", source_info, pkg_dir)
+            assert pkg_dir.exists()
+            mock_run.assert_called_once_with(
+                ["salsa", "checkout", "python-team/deps/mypkg"],
+                pkg_dir,
+                "Checkout python-team/deps/mypkg",
+            )
+
+    def test_checkout_with_existing_parent(self, tmp_path):
+        """Test checkout when parent directory already exists."""
+        pkg_dir = tmp_path / "python" / "mypkg"
+        pkg_dir.mkdir(parents=True)
+        source_info = {"vcs_git": "python-team", "uploaders": ""}
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.ensure_package_checkout("mypkg", source_info, pkg_dir)
+            assert pkg_dir.exists()
+
+
+class TestValidateRepositoryState:
+    """Tests for validate_repository_state function."""
+
+    def test_clean_repository(self, tmp_path):
+        """Test validating a clean repository."""
+        with patch("debian_todo.has_uncommitted_changes") as mock_has_changes:
+            mock_has_changes.return_value = False
+            debian_todo.validate_repository_state(tmp_path)
+
+    def test_dirty_repository(self, tmp_path):
+        """Test validating a repository with uncommitted changes."""
+        with patch("debian_todo.has_uncommitted_changes") as mock_has_changes:
+            mock_has_changes.return_value = True
+            with pytest.raises(debian_todo.RepositoryStateError) as exc_info:
+                debian_todo.validate_repository_state(tmp_path)
+            assert "uncommitted changes" in str(exc_info.value)
+
+
+class TestRunGbpPqWorkflow:
+    """Tests for run_gbp_pq_workflow function."""
+
+    def test_successful_workflow(self, tmp_path):
+        """Test successful gbp pq import and switch."""
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.run_gbp_pq_workflow(tmp_path)
+            assert mock_run.call_count == 2
+            mock_run.assert_any_call(
+                ["gbp", "pq", "import"], tmp_path, "Import patch queue"
+            )
+            mock_run.assert_any_call(
+                ["gbp", "pq", "switch"], tmp_path, "Switch to patch branch"
+            )
+
+    def test_import_fails(self, tmp_path):
+        """Test when gbp pq import fails."""
+        with patch("debian_todo.run_command") as mock_run:
+            mock_run.side_effect = debian_todo.ExternalCommandError(
+                "gbp pq import", 1, "Import failed"
+            )
+            with pytest.raises(debian_todo.ExternalCommandError):
+                debian_todo.run_gbp_pq_workflow(tmp_path)
+
+
+class TestImportUpstreamVersion:
+    """Tests for import_upstream_version function."""
+
+    def test_successful_import(self, tmp_path, capsys):
+        """Test successful upstream import."""
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.import_upstream_version(tmp_path)
+            mock_run.assert_called_once_with(
+                ["gbp", "import-orig", "--uscan", "--pristine-tar", "--no-interactive"],
+                tmp_path,
+                "Import upstream version",
+            )
+            captured = capsys.readouterr()
+            assert "Importing new upstream version" in captured.out
+
+    def test_import_fails(self, tmp_path):
+        """Test when upstream import fails."""
+        with patch("debian_todo.run_command") as mock_run:
+            mock_run.side_effect = debian_todo.ExternalCommandError(
+                "gbp import-orig", 1, "Import failed"
+            )
+            with pytest.raises(debian_todo.ExternalCommandError):
+                debian_todo.import_upstream_version(tmp_path)
+
+
+class TestRunPackageUpdates:
+    """Tests for run_package_updates function."""
+
+    def test_runs_all_updates(self, tmp_path):
+        """Test that all update functions are called."""
+        with patch("debian_todo.update_debian_control") as mock_control:
+            with patch("debian_todo.update_debian_copyright_year") as mock_copyright:
+                with patch("debian_todo.update_debian_watch") as mock_watch:
+                    with patch("debian_todo.add_salsa_ci") as mock_salsa:
+                        debian_todo.run_package_updates(tmp_path)
+                        mock_control.assert_called_once_with(tmp_path)
+                        mock_copyright.assert_called_once_with(tmp_path)
+                        mock_watch.assert_called_once_with(tmp_path)
+                        mock_salsa.assert_called_once_with(tmp_path)
+
+
+class TestUpdateDebianControl:
+    """Tests for update_debian_control function."""
+
+    def test_removes_priority_optional(self, tmp_path):
+        """Test removing obsolete Priority: optional."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        control_path = debian_dir / "control"
+        control_path.write_text("Source: mypkg\nPriority: optional\n")
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_control(tmp_path)
+            mock_run.assert_called_once()
+            assert "Priority: optional" in mock_run.call_args[0][0][2]
+
+        # Verify Priority: optional was removed
+        content = control_path.read_text()
+        assert "Priority: optional" not in content
+
+    def test_updates_standards_version(self, tmp_path):
+        """Test updating Standards-Version."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        control_path = debian_dir / "control"
+        control_path.write_text("Source: mypkg\nStandards-Version: 4.6.0\n")
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_control(tmp_path)
+            mock_run.assert_called_once()
+            assert "Standards-Version" in mock_run.call_args[0][0][2]
+
+        # Verify Standards-Version was updated
+        content = control_path.read_text()
+        assert "Standards-Version: 4.7.3" in content
+
+    def test_no_changes_needed(self, tmp_path):
+        """Test when no changes are needed."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        control_path = debian_dir / "control"
+        control_path.write_text("Source: mypkg\nStandards-Version: 4.7.3\n")
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_control(tmp_path)
+            mock_run.assert_not_called()
+
+    def test_missing_control_file(self, tmp_path):
+        """Test when debian/control doesn't exist."""
+        debian_todo.update_debian_control(tmp_path)  # Should not raise
+
+
+class TestUpdateDebianCopyrightYear:
+    """Tests for update_debian_copyright_year function."""
+
+    def test_updates_single_year(self, tmp_path):
+        """Test updating a single year to a range."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        copyright_path = debian_dir / "copyright"
+        current_year = datetime.date.today().year
+        last_year = current_year - 1
+        copyright_path.write_text(
+            f"Copyright: {last_year} Edward Betts <edward@4angle.com>\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_copyright_year(tmp_path)
+            mock_run.assert_called_once()
+
+        # Verify year was updated
+        content = copyright_path.read_text()
+        assert f"{last_year}-{current_year}" in content
+
+    def test_updates_year_range(self, tmp_path):
+        """Test extending a year range."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        copyright_path = debian_dir / "copyright"
+        current_year = datetime.date.today().year
+        copyright_path.write_text(
+            f"Copyright: 2020-{current_year - 2} Edward Betts <edward@4angle.com>\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_copyright_year(tmp_path)
+            mock_run.assert_called_once()
+
+        # Verify year range was updated
+        content = copyright_path.read_text()
+        assert f"2020-{current_year}" in content
+
+    def test_no_update_needed(self, tmp_path):
+        """Test when copyright year is already current."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        copyright_path = debian_dir / "copyright"
+        current_year = datetime.date.today().year
+        copyright_path.write_text(
+            f"Copyright: {current_year} Edward Betts <edward@4angle.com>\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_copyright_year(tmp_path)
+            mock_run.assert_not_called()
+
+    def test_missing_copyright_file(self, tmp_path):
+        """Test when debian/copyright doesn't exist."""
+        debian_todo.update_debian_copyright_year(tmp_path)  # Should not raise
+
+
+class TestUpdateDebianWatch:
+    """Tests for update_debian_watch function."""
+
+    def test_upgrades_github_watch(self, tmp_path):
+        """Test upgrading a GitHub watch file."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        watch_path = debian_dir / "watch"
+        watch_path.write_text(
+            "version=4\n"
+            "https://github.com/owner/repo/releases .*/v?([\\d.]+)\\.tar\\.gz\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_watch(tmp_path)
+            mock_run.assert_called_once()
+
+        # Verify watch was upgraded
+        content = watch_path.read_text()
+        assert "Version: 5" in content
+        assert "Template: GitHub" in content
+        assert "Owner: owner" in content
+        assert "Project: repo" in content
+
+    def test_upgrades_pypi_watch(self, tmp_path):
+        """Test upgrading a PyPI watch file."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        watch_path = debian_dir / "watch"
+        watch_path.write_text(
+            "version=4\n"
+            "https://pypi.debian.net/mypackage/mypackage-([\\d.]+)\\.tar\\.gz\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_watch(tmp_path)
+            mock_run.assert_called_once()
+
+        # Verify watch was upgraded
+        content = watch_path.read_text()
+        assert "Version: 5" in content
+        assert "Template: Pypi" in content
+        assert "Dist: mypackage" in content
+
+    def test_already_version_5(self, tmp_path):
+        """Test when watch is already version 5."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        watch_path = debian_dir / "watch"
+        watch_path.write_text("Version: 5\n\nTemplate: GitHub\n")
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.update_debian_watch(tmp_path)
+            mock_run.assert_not_called()
+
+    def test_missing_watch_file(self, tmp_path):
+        """Test when debian/watch doesn't exist."""
+        debian_todo.update_debian_watch(tmp_path)  # Should not raise
+
+
+class TestAddSalsaCi:
+    """Tests for add_salsa_ci function."""
+
+    def test_adds_salsa_ci_yml(self, tmp_path):
+        """Test adding debian/salsa-ci.yml."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        control_path = debian_dir / "control"
+        control_path.write_text(
+            "Source: mypkg\n"
+            "Vcs-Git: https://salsa.debian.org/python-team/packages/mypkg.git\n"
+        )
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.add_salsa_ci(tmp_path)
+            assert mock_run.call_count == 2  # git add and dch
+
+        # Verify file was created
+        salsa_ci_path = debian_dir / "salsa-ci.yml"
+        assert salsa_ci_path.exists()
+        content = salsa_ci_path.read_text()
+        assert "salsa-ci-team/pipeline" in content
+
+    def test_already_exists(self, tmp_path):
+        """Test when debian/salsa-ci.yml already exists."""
+        debian_dir = tmp_path / "debian"
+        debian_dir.mkdir()
+        salsa_ci_path = debian_dir / "salsa-ci.yml"
+        salsa_ci_path.write_text("existing content\n")
+
+        with patch("debian_todo.run_command") as mock_run:
+            debian_todo.add_salsa_ci(tmp_path)
+            mock_run.assert_not_called()
+
+    def test_missing_control_file(self, tmp_path):
+        """Test when debian/control doesn't exist."""
+        debian_todo.add_salsa_ci(tmp_path)  # Should not raise
+
+
+class TestAddChangelogEntry:
+    """Tests for add_changelog_entry function."""
+
+    def test_adds_changelog_entry(self, tmp_path):
+        with patch.object(
+            debian_todo, "extract_upstream_version_from_git_log"
+        ) as mock_extract:
+            mock_extract.return_value = "1.2.3"
+            with patch("debian_todo.subprocess.run") as mock_run:
+                mock_run.return_value = MagicMock(returncode=0)
+                result = debian_todo.add_changelog_entry(tmp_path)
+                assert result is True
+                mock_run.assert_called_once_with(
+                    [
+                        "dch",
+                        "--release-heuristic",
+                        "log",
+                        "--newversion",
+                        "1.2.3-1",
+                        "New upstream release.",
+                    ],
+                    cwd=tmp_path,
+                )
+
+    def test_dch_fails(self, tmp_path):
+        with patch.object(
+            debian_todo, "extract_upstream_version_from_git_log"
+        ) as mock_extract:
+            mock_extract.return_value = "1.2.3"
+            with patch("debian_todo.subprocess.run") as mock_run:
+                mock_run.return_value = MagicMock(returncode=1)
+                result = debian_todo.add_changelog_entry(tmp_path)
+                assert result is False
+
+    def test_no_version_found(self, tmp_path):
+        with patch.object(
+            debian_todo, "extract_upstream_version_from_git_log"
+        ) as mock_extract:
+            mock_extract.return_value = None
+            result = debian_todo.add_changelog_entry(tmp_path)
+            assert result is False
+
+
+class TestUpdatePackage:
+    """Tests for update_package function."""
+
+    def test_package_not_found(self, monkeypatch):
+        monkeypatch.setattr(
+            debian_todo, "load_source_info_map", lambda: {}
+        )
+        with pytest.raises(debian_todo.PackageNotFoundError) as exc_info:
+            debian_todo.update_package("nonexistent-pkg")
+        assert "nonexistent-pkg" in str(exc_info.value)
+
+    def test_package_no_vcs_git(self, monkeypatch):
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "", "uploaders": ""}},
+        )
+        with pytest.raises(debian_todo.PackageNotFoundError) as exc_info:
+            debian_todo.update_package("mypkg")
+        assert "mypkg" in str(exc_info.value)
+
+    def test_new_checkout(self, tmp_path, monkeypatch):
+        """Test checking out a package that doesn't exist yet."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        subprocess_calls = []
+
+        def mock_subprocess_run(cmd, **kwargs):
+            subprocess_calls.append((cmd, kwargs))
+            result = MagicMock(returncode=0, stdout="", stderr="")
+            # After salsa checkout, create the repo directory
+            if cmd[0] == "salsa":
+                pkg_dir = tmp_path / "python" / "mypkg"
+                repo_dir = pkg_dir / "mypkg"
+                repo_dir.mkdir(parents=True, exist_ok=True)
+            return result
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(
+            debian_todo,
+            "extract_upstream_version_from_git_log",
+            lambda _: "1.0.0",
+        )
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        # Mock the update functions to avoid needing debian/ directory
+        with patch("debian_todo.run_package_updates"):
+            debian_todo.update_package("mypkg")
+
+        # Check salsa checkout was called
+        assert subprocess_calls[0][0] == ["salsa", "checkout", "python-team/deps/mypkg"]
+        # Check gbp pq commands were called
+        assert subprocess_calls[1][0] == ["gbp", "pq", "import"]
+        assert subprocess_calls[2][0] == ["gbp", "pq", "switch"]
+        # Check gbp import-orig was called
+        assert subprocess_calls[3][0] == [
+            "gbp", "import-orig", "--uscan", "--pristine-tar", "--no-interactive"
+        ]
+        # Check dch was called
+        assert subprocess_calls[4][0][0] == "dch"
+
+    def test_existing_checkout_clean(self, tmp_path, monkeypatch):
+        """Test updating a package that's already checked out and clean."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "homeassistant-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        # Create existing repo directory
+        repo_dir = tmp_path / "ha" / "mypkg" / "mypkg"
+        repo_dir.mkdir(parents=True)
+
+        subprocess_calls = []
+
+        def mock_subprocess_run(cmd, **kwargs):
+            subprocess_calls.append((cmd, kwargs))
+            if cmd == ["git", "status", "--porcelain"]:
+                return MagicMock(stdout="", returncode=0)
+            return MagicMock(returncode=0, stdout="", stderr="")
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(
+            debian_todo,
+            "extract_upstream_version_from_git_log",
+            lambda _: "2.0.0",
+        )
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        # Mock the update functions to avoid needing debian/ directory
+        with patch("debian_todo.run_package_updates"):
+            debian_todo.update_package("mypkg")
+
+        # Should not call salsa checkout
+        salsa_calls = [c for c in subprocess_calls if c[0][0] == "salsa"]
+        assert len(salsa_calls) == 0
+
+        # Should call git status, gbp pq, gbp import-orig, dch
+        assert subprocess_calls[0][0] == ["git", "status", "--porcelain"]
+        assert subprocess_calls[1][0] == ["gbp", "pq", "import"]
+        assert subprocess_calls[2][0] == ["gbp", "pq", "switch"]
+        assert subprocess_calls[3][0][0] == "gbp"
+        assert subprocess_calls[4][0][0] == "dch"
+
+    def test_existing_checkout_dirty(self, tmp_path, monkeypatch):
+        """Test that update aborts if there are uncommitted changes."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        # Create existing repo directory
+        repo_dir = tmp_path / "python" / "mypkg" / "mypkg"
+        repo_dir.mkdir(parents=True)
+
+        def mock_subprocess_run(cmd, **kwargs):
+            if cmd == ["git", "status", "--porcelain"]:
+                return MagicMock(stdout=" M dirty.txt\n", returncode=0)
+            return MagicMock(returncode=0)
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        with pytest.raises(debian_todo.RepositoryStateError) as exc_info:
+            debian_todo.update_package("mypkg")
+
+        assert "uncommitted changes" in str(exc_info.value)
+
+    def test_salsa_checkout_fails(self, tmp_path, monkeypatch):
+        """Test error handling when salsa checkout fails."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        def mock_subprocess_run(cmd, **kwargs):
+            if cmd[0] == "salsa":
+                return MagicMock(returncode=1, stdout="", stderr="")
+            return MagicMock(returncode=0, stdout="", stderr="")
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        with pytest.raises(debian_todo.ExternalCommandError) as exc_info:
+            debian_todo.update_package("mypkg")
+
+        assert "salsa" in str(exc_info.value)
+
+    def test_gbp_import_fails(self, tmp_path, monkeypatch):
+        """Test error handling when gbp import-orig fails."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        # Create existing repo directory
+        repo_dir = tmp_path / "python" / "mypkg" / "mypkg"
+        repo_dir.mkdir(parents=True)
+
+        call_count = {"count": 0}
+
+        def mock_subprocess_run(cmd, **kwargs):
+            if cmd == ["git", "status", "--porcelain"]:
+                return MagicMock(stdout="", returncode=0)
+            if cmd[0] == "gbp":
+                call_count["count"] += 1
+                # Fail on third gbp call (import-orig), succeed on pq commands
+                if call_count["count"] >= 3:
+                    return MagicMock(returncode=1, stdout="", stderr="")
+            return MagicMock(returncode=0, stdout="", stderr="")
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        with pytest.raises(debian_todo.ExternalCommandError) as exc_info:
+            debian_todo.update_package("mypkg")
+
+        assert "gbp" in str(exc_info.value)
+
+    def test_changelog_entry_fails(self, tmp_path, monkeypatch):
+        """Test error handling when adding changelog entry fails."""
+        monkeypatch.setattr(
+            debian_todo,
+            "load_source_info_map",
+            lambda: {"mypkg": {"vcs_git": "python-team", "uploaders": ""}},
+        )
+        monkeypatch.setattr(debian_todo, "DEBIAN_SRC_BASE", tmp_path)
+
+        # Create existing repo directory
+        repo_dir = tmp_path / "python" / "mypkg" / "mypkg"
+        repo_dir.mkdir(parents=True)
+
+        def mock_subprocess_run(cmd, **kwargs):
+            if cmd == ["git", "status", "--porcelain"]:
+                return MagicMock(stdout="", returncode=0)
+            return MagicMock(returncode=0, stdout="", stderr="")
+
+        monkeypatch.setattr(debian_todo.subprocess, "run", mock_subprocess_run)
+        monkeypatch.setattr(
+            debian_todo,
+            "extract_upstream_version_from_git_log",
+            lambda _: None,
+        )
+        monkeypatch.setattr(debian_todo.shutil, "which", lambda _: "/usr/bin/tool")
+
+        with pytest.raises(debian_todo.ExternalCommandError) as exc_info:
+            debian_todo.update_package("mypkg")
+
+        assert "upstream version" in str(exc_info.value)