[adamoutler]

Proposed change

Adds a new integration for PiKVM IP-KVM appliances with a sensor platform (CPU temperature, CPU utilization, memory utilization, fan speed, and mass storage usage).

New dependency: pikvm-aio==0.1.6 (https://github.com/adamoutler/pikvm-aio)

Type of change

• Dependency upgrade
• Bugfix (non-breaking change which fixes an issue)
• New integration (thank you!)
• New feature (which adds functionality to an existing integration)
• Deprecation (breaking change to happen in the future)
• Breaking change (fix/feature causing existing functionality to break)
• Code quality improvements to existing code or addition of tests

Additional information

• This PR fixes or closes issue: fixes #
• This PR is related to issue: Add PiKVM core integration brand images brands#11394
• Link to documentation pull request: Add PiKVM integration documentation home-assistant.io#50095
• Link to contributors documentation pull request:
• Link to frontend pull request:

Checklist

• I understand the code I am submitting and can explain how it works.
• The code change is tested and works locally.
• Local tests pass. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.
• I have followed the development checklist
• I have followed the perfect PR recommendations
• The code has been formatted using Ruff (ruff format homeassistant tests)
• Tests have been added to verify that the new code works.
• Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

• The manifest file has all fields filled out correctly.
  Updated and included derived files by running: python3 -m script.hassfest.
• New or updated dependencies have been added to requirements_all.txt.
  Updated by running python3 -m script.gen_requirements_all.
• For the updated dependencies a diff between library versions and ideally a link to the changelog/release notes is added to the PR description.

To help with the load of incoming pull requests:

• I have reviewed two other open pull requests in this repository.

[Copilot]

🟡 Changes recommended

The one-time-code check rejects all numeric secrets, including valid 32-character Base32 secrets containing only digits 2–7, instead of limiting rejection to six- or eight-digit codes.

1 open issue

• Allow numeric Base32 secrets longer than OTP codes · New

What changed in this PR

Adds a PiKVM integration to Home Assistant for monitoring appliance health through local polling.

Changes:

• Adds UI configuration with credentials, optional two-factor authentication, and TLS verification settings.
• Exposes five diagnostic sensors with shared polling and device registration.
• Adds tests, fixtures, snapshots, and integration registration and typing metadata.

File	Description
tests/​components/​pikvm/​test_sensor.py	Tests sensor snapshots and optional hardware handling.
tests/​components/​pikvm/​test_init.py	Tests setup, unloading, device details, and polling recovery.
tests/​components/​pikvm/​test_config_flow.py	Tests configuration, validation, and duplicate detection.
tests/​components/​pikvm/​snapshots/​test_sensor.ambr	Records expected sensor states and registry entries.
tests/​components/​pikvm/​snapshots/​test_init.ambr	Records expected device metadata.
tests/​components/​pikvm/​fixtures/​msd.json	Provides mass-storage response data.
tests/​components/​pikvm/​fixtures/​info.json	Provides appliance health and hardware data.
tests/​components/​pikvm/​conftest.py	Defines shared client mocks and setup fixtures.
tests/​components/​pikvm/​__init__.py	Defines the integration test package.
requirements_all.txt	Adds the pikvm-aio dependency.
mypy.ini	Enables strict integration type checking.
homeassistant/​generated/​integrations.json	Registers PiKVM integration metadata.
homeassistant/​generated/​config_flows.py	Registers the configuration flow.
homeassistant/​components/​pikvm/​strings.json	Adds configuration, sensor, and error strings.
homeassistant/​components/​pikvm/​sensor.py	Defines the five diagnostic sensors.
homeassistant/​components/​pikvm/​quality_scale.yaml	Records quality-scale rule status.
homeassistant/​components/​pikvm/​manifest.json	Declares integration metadata and dependency.
homeassistant/​components/​pikvm/​entity.py	Provides shared entity identity and device details.
homeassistant/​components/​pikvm/​coordinator.py	Creates the client and polls every 30 seconds.
homeassistant/​components/​pikvm/​const.py	Defines shared integration constants.
homeassistant/​components/​pikvm/​config_flow.py	Implements user setup and credential validation.
homeassistant/​components/​pikvm/​__init__.py	Handles integration setup and unloading.
CODEOWNERS	Assigns ownership for integration code and tests.
.strict-typing	Includes PiKVM in strict typing checks.

_{Review effort: Balanced}

[github-actions]

Quality scale review

✅ No issues found at d05f941. Checked 25 done/exempt rules for pikvm (all newly claimed, plus related rules touching the diff); none are violated by the changed lines.

Generated by quality-scale-reviewer · copilot · auto · 76.1 AIC · ⌖ 5.17 AIC · ⊞ 8.5K · ◷

[github-actions]

Check requirements

Checked at commit d05f941.

⚠️ Some checks require attention — see the details below.

Package	Old	New	No Advisories	Not Yanked	Repo Public	CI Upload	Release Pipeline	Security	PR Link	Async Safe
pikvm-aio	—	0.1.5	✅	✅	✅	⚠️	❌	☑️	❌	❌

📦 pikvm-aio: 0.1.5

• No Advisories: ✅ No active advisories reported by PyPI for version 0.1.5.
• Not Yanked: ✅ Version 0.1.5 is a live (non-yanked) release.
• Repo Public: ✅ https://github.com/adamoutler/pikvm-aio is publicly accessible (it currently redirects to the renamed repository adamoutler/pikvm-cli, which is also public).
• CI Upload: ⚠️ No PEP 740 provenance attestation present on PyPI. Upload method cannot be verified from PyPI alone.
• Release Pipeline: ❌ Both .github/workflows/ci.yml and .forgejo/workflows/ci.yml publish to PyPI using a static TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }} / PYPI_API_TOKEN secret rather than OIDC/Trusted Publishing. A static token is acceptable for a version bump, but for a brand-new dependency it does not meet the preferred bar.
• Security: ☑️ Baseline scan found nothing obvious in pyproject.toml, src/pikvm_aio/__init__.py, client.py, cli.py, security.py, and tls.py. No install-time network code, no exec/eval of decoded data, no reads of Home Assistant internals/secrets, and no off-purpose network destinations were found (the .forgejo/workflows/ci.yml CI job does POST test logs to dpaste.com, but this only runs in the upstream's own CI and is not part of the installed package). This is not a security review — only the cheap checks were run.
• PR Link: ❌ PR description must link to the source repository at https://github.com/adamoutler/pikvm-aio. A PyPI page link is not sufficient. The PR body currently only links to a home-assistant.io documentation PR.
• Async Safe: ❌ _file_chunk_generator in client.py:403-404 performs a blocking open()/f.read() inside the async generator consumed by the public async def upload_msd_image(...), blocking the event loop while streaming potentially multi-GB ISO images to the device.

Generated by Check requirements (AW) · copilot · auto · 153.8 AIC · ⌖ 6.22 AIC · ⊞ 5K · ◷

[Copilot]

🟡 Changes recommended

HTTP URLs are accepted, exposing passwords and optional one-time codes in plaintext even when SSL verification is enabled.

1 open issue

• Reject HTTP URLs to prevent sending credentials in plaintext · New

1 previously missed issue

In code that hasn't changed since last review

Trim whitespace before validating one-time codes

homeassistant/​components/​pikvm/​config_flow.py:35

Trim surrounding whitespace before checking for one-time codes. A pasted value such as "123456\n" bypasses this guard, but the client strips it and uses it as a static OTP, so setup can succeed and authentication then fails when the code expires.

1 resolved since last review

• Allow numeric Base32 secrets longer than OTP codes

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The initial-value filter omits core health sensors when their first reading is unavailable, leaving them permanently missing even after valid readings return.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Core health sensors are omitted when initial readings are unavailable

homeassistant/​components/​pikvm/​sensor.py:93

Create the core health sensors even when their first reading is unavailable. This filter also excludes CPU temperature, CPU utilization, and memory utilization when their initial value is None; later coordinator refreshes only update existing entities, so those sensors remain missing even after valid readings return. Restrict this filtering to the optional hardware sensors.

1 resolved since last review

• Reject HTTP URLs to prevent sending credentials in plaintext

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

An unpublished finding about a mismatch between the PR description and the implemented sensors requires human assessment.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because updating the host can retain the old SSL-verification setting, causing certificate validation to fail after reload despite successful validation during reconfiguration.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The pinned pikvm-aio 0.1.5 source could not be retrieved, leaving TLS, authentication, and optional-hardware contracts unverified, while branding assets and required validation results remain unconfirmed.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Unavailable pikvm-aio source and documentation leave real-device mass-storage polling, TLS/TOTP and session SSL behavior, and quality-scale claims requiring human verification.

No open issues 🎉

_{Review effort: Balanced}

[github-actions]

Check requirements

Checked at commit b4537e5.

All requirements checks passed. ✅

Package	Old	New	No Advisories	Not Yanked	Repo Public	CI Upload	Release Pipeline	Security	PR Link	Async Safe
pikvm-aio	—	0.1.6	✅	✅	✅	✅	✅	☑️	✅	✅

📦 pikvm-aio: 0.1.6

• No Advisories: ✅ No active advisories reported by PyPI for version 0.1.6.
• Not Yanked: ✅ Version 0.1.6 is a live (non-yanked) release.
• Repo Public: ✅ https://github.com/adamoutler/pikvm-aio is publicly accessible.
• CI Upload: ✅ Trusted Publisher attestation found (GitHub).
• Release Pipeline: ✅ OIDC via Trusted Publisher attestation (GitHub); automated CI upload verified by PyPI.
• Security: ☑️ Baseline scan found nothing obvious in pyproject.toml, src/pikvm_aio/__init__.py, src/pikvm_aio/client.py, src/pikvm_aio/security.py, src/pikvm_aio/tls.py, src/pikvm_aio/exceptions.py, src/pikvm_aio/validators.py, src/pikvm_aio/cli.py, src/pikvm_client/*, src/pikvm_cli/*. No install-time network/exec code, no secret exfiltration paths, no reads outside the library's own scope, no off-purpose network destinations. This is not a security review — only the cheap checks were run.
• PR Link: ✅ PR description links directly to https://github.com/adamoutler/pikvm-aio.
• Async Safe: ✅ New dependency reviewed in full (client.py, tls.py, cli.py). All I/O uses aiohttp/asyncio; file reads and blocking stat/open calls are dispatched via asyncio.to_thread; key-tap delays use asyncio.sleep. No blocking calls (requests, time.sleep, sync sockets/files/DB, subprocess) found inside any async def.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• raw.githubusercontent.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "raw.githubusercontent.com"

See Network Configuration for more information.

Generated by Check requirements (AW) · copilot · auto · 60.3 AIC · ⌖ 7.76 AIC · ⊞ 5K · ◷