Add SSH port and passphrase support with config migration

[Copilot]

This updates ssh_docker to support the new ssh_command.execute inputs port and passphrase, including backward-compatible migration for existing entries. Existing configs are migrated to port=22 and passphrase="", while discovery preserves the discovered/original port.

• Config + options surface

  • Added port (after host) and passphrase (after key_file) to config flow, options flow, and localized form strings.
  • Defaults:
    • New/manual entry: port=22, passphrase=""
    • Discovered entry: discovered/copied port, passphrase prefilled from source options (or empty)

• SSH payload wiring

  • Threaded port through all SSH service payload construction paths.
  • Added conditional passphrase forwarding: only included in ssh_command.execute payload when non-empty.

• Entry migration

  • Bumped config flow version to 2.
  • Added async_migrate_entry to inject missing fields into legacy entries:
    • port: 22
    • passphrase: ""

• Documentation

  • Updated README configuration table and discovery behavior notes to cover port and passphrase, including conditional passphrase forwarding.

service_data = {
    "host": options["host"],
    "port": options.get("port", 22),
    "username": options["username"],
    "command": command,
    "timeout": timeout,
}
if options.get("passphrase"):
    service_data["passphrase"] = options["passphrase"]

[Copilot]

🟡 Changes recommended

passphrase can be forwarded even when no key_file is configured and port currently lacks schema coercion/range validation, which can result in inconsistent or invalid ssh_command.execute payloads.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR extends the ssh_docker Home Assistant integration to support SSH port and passphrase across config flow, options flow, discovery prefill, SSH service payload construction, and config entry migration from version 1 → 2.

Changes:

• Added port and passphrase fields to config/options flows and localized strings, with defaults (22 / empty string).
• Threaded port through ssh_command.execute payloads and forwarded passphrase conditionally when set.
• Introduced config entry migration to backfill missing port and passphrase on legacy entries, plus unit tests covering migration and payload behavior.

File summaries

File	Description
translations/en.json	Adds English UI labels/descriptions for port and passphrase.
translations/de.json	Adds German UI labels/descriptions for port and passphrase.
strings.json	Adds base strings for port and passphrase across config/options forms.
README.md	Documents new config options and discovery behavior for port/passphrase.
const.py	Introduces CONF_PORT, CONF_PASSPHRASE, and defaults.
options_flow.py	Adds fields + wires port/passphrase into validation/service payload and stored options.
config_flow.py	Bumps flow VERSION to 2, adds fields to schemas, and forwards port/passphrase for validation/existence checks.
coordinator.py	Threads port/passphrase into runtime SSH execution payloads.
__init__.py	Adds async_migrate_entry and includes port/passphrase in discovery prefill data.
tests/unit_tests/test_options_flow.py	Updates options-flow tests and adds coverage for passphrase omission/inclusion + port forwarding.
tests/unit_tests/test_init.py	Adds migration tests and updates fixtures to include new defaults.
tests/unit_tests/test_config_flow.py	Extends discovery/payload tests for port and passphrase.

Review details

Suppressed comments (2)

options_flow.py:167

• The port field in the options form schema should coerce and validate the port range (1-65535) to prevent invalid values from being saved.

                vol.Required(CONF_HOST, default=current.get(CONF_HOST, "")): str,
                vol.Optional(CONF_PORT, default=current.get(CONF_PORT, DEFAULT_PORT)): int,
                vol.Required(CONF_USERNAME, default=current.get(CONF_USERNAME, "")): str,

config_flow.py:147

• The pre-filled user schema for config flow should also coerce/validate port (1-65535) so discovery/user re-renders can't accept invalid values.

            vol.Required(CONF_NAME, default=defaults.get(CONF_NAME, "")): str,
            vol.Required(CONF_SERVICE, default=defaults.get(CONF_SERVICE, "")): str,
            vol.Required(CONF_HOST, default=defaults.get(CONF_HOST, "")): str,
            vol.Optional(CONF_PORT, default=defaults.get(CONF_PORT, DEFAULT_PORT)): int,
            vol.Required(CONF_USERNAME, default=defaults.get(CONF_USERNAME, "")): str,

• Files reviewed: 12/12 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.