🐛 Fix Hetzner Cloud missing public IPv4 in cloud.instance

The Hetzner metadata service returns public-ipv4 but the cloud instance
resource was not extracting it, leaving publicIpv4 always empty.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: tas50

providers/os/config/config.go

@@ -13,7 +13,7 @@ import (
 var Config = plugin.Provider{
 	Name:    "os",
 	ID:      "go.mondoo.com/cnquery/v9/providers/os",
-	Version: "13.6.0",
+	Version: "13.6.1",
 	ConnectionTypes: []string{
 		shared.Type_Local.String(),
 		shared.Type_SSH.String(),

providers/os/id/hetzner/testdata/instance_linux.toml

@@ -36,4 +36,23 @@ hostname: ubuntu-8gb-hil-1
 region: us-west
 availability-zone: hil-dc1
 local-ipv4: ""
+public-ipv4: 5.78.107.208
+public-keys:
+- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwjdTGb2Brk8c99PdqDHgOIjmHBQfE4tT9MGXTsfkss
+network-config:
+  config:
+  - mac_address: "92:00:06:96:49:21"
+    name: eth0
+    subnets:
+    - ipv4: true
+      type: dhcp
+    - address: "2a01:4ff:1f0:4c7b::1/64"
+      dns_nameservers:
+      - "2a01:4ff:ff00::add:2"
+      - "2a01:4ff:ff00::add:1"
+      gateway: "fe80::1"
+      ipv6: true
+      type: static
+    type: physical
+  version: 1
 """

providers/os/id/hetznercloud/hetznercloud.go

@@ -50,6 +50,7 @@ type hetznerMetadata struct {
 	Region           string `yaml:"region"`
 	AvailabilityZone string `yaml:"availability-zone"`
 	LocalIPv4        string `yaml:"local-ipv4"`
+	PublicIPv4       string `yaml:"public-ipv4"`
 }
 
 type commandInstanceMetadata struct {

providers/os/id/hetznercloud/hetznercloud_test.go

@@ -50,4 +50,5 @@ func TestRawMetadataLinux(t *testing.T) {
 	assert.Equal(t, "ubuntu-8gb-hil-1", m["hostname"])
 	assert.Equal(t, "us-west", m["region"])
 	assert.Equal(t, "hil-dc1", m["availability-zone"])
+	assert.Equal(t, "5.78.107.208", m["public-ipv4"])
 }

providers/os/id/hetznercloud/testdata/metadata_linux.toml

@@ -16,4 +16,23 @@ hostname: ubuntu-8gb-hil-1
 region: us-west
 availability-zone: hil-dc1
 local-ipv4: ""
+public-ipv4: 5.78.107.208
+public-keys:
+- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwjdTGb2Brk8c99PdqDHgOIjmHBQfE4tT9MGXTsfkss
+network-config:
+  config:
+  - mac_address: "92:00:06:96:49:21"
+    name: eth0
+    subnets:
+    - ipv4: true
+      type: dhcp
+    - address: "2a01:4ff:1f0:4c7b::1/64"
+      dns_nameservers:
+      - "2a01:4ff:ff00::add:2"
+      - "2a01:4ff:ff00::add:1"
+      gateway: "fe80::1"
+      ipv6: true
+      type: static
+    type: physical
+  version: 1
 """

providers/os/resources/cloud/hetzner.go

@@ -18,6 +18,11 @@ type hetznerCloud struct {
 	conn shared.Connection
 }
 
+// NewHetznerCloud creates a new Hetzner cloud instance.
+func NewHetznerCloud(conn shared.Connection) (OSCloud, error) {
+	return &hetznerCloud{conn: conn}, nil
+}
+
 func (h *hetznerCloud) Provider() Provider {
 	return HETZNER
 }
@@ -57,5 +62,11 @@ func (h *hetznerCloud) Instance() (*InstanceMetadata, error) {
 		}
 	}
 
+	if value, ok := m["public-ipv4"]; ok {
+		if publicIP, ok := value.(string); ok && publicIP != "" {
+			instanceMd.PublicIpv4 = []Ipv4Address{{IP: publicIP}}
+		}
+	}
+
 	return &instanceMd, nil
 }

providers/os/resources/cloud/hetzner_test.go

@@ -0,0 +1,62 @@
+// Copyright Mondoo, Inc. 2024, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package cloud_test
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.mondoo.com/mql/v13/providers-sdk/v1/inventory"
+	"go.mondoo.com/mql/v13/providers/os/connection/mock"
+	"go.mondoo.com/mql/v13/providers/os/detector"
+	"go.mondoo.com/mql/v13/providers/os/resources/cloud"
+)
+
+func newHetznerCloud(t *testing.T, path string) cloud.OSCloud {
+	t.Helper()
+	conn, err := mock.New(0, &inventory.Asset{}, mock.WithPath(path))
+	require.NoError(t, err)
+
+	platform, ok := detector.DetectOS(conn)
+	require.True(t, ok)
+	conn.Asset().Platform = platform
+
+	hc, err := cloud.NewHetznerCloud(conn)
+	require.NoError(t, err)
+	return hc
+}
+
+func TestHetznerInstance(t *testing.T) {
+	hc := newHetznerCloud(t, "../../id/hetznercloud/testdata/metadata_linux.toml")
+
+	md, err := hc.Instance()
+	require.NoError(t, err)
+
+	assert.Equal(t, "ubuntu-8gb-hil-1", md.PrivateHostname)
+	assert.Equal(t, "5.78.107.208", md.PublicIP())
+
+	require.Len(t, md.PublicIpv4, 1)
+	assert.Equal(t, "5.78.107.208", md.PublicIpv4[0].IP)
+
+	// local-ipv4 is empty in test data, so PrivateIpv4 should be empty
+	assert.Empty(t, md.PrivateIpv4)
+}
+
+func TestHetznerInstanceWithLocalIP(t *testing.T) {
+	hc := newHetznerCloud(t, "./testdata/hetzner_with_local_ip.toml")
+
+	md, err := hc.Instance()
+	require.NoError(t, err)
+
+	assert.Equal(t, "ubuntu-8gb-hil-1", md.PrivateHostname)
+	assert.Equal(t, "5.78.107.208", md.PublicIP())
+	assert.Equal(t, "10.0.0.5", md.PrivateIP())
+
+	require.Len(t, md.PublicIpv4, 1)
+	assert.Equal(t, "5.78.107.208", md.PublicIpv4[0].IP)
+
+	require.Len(t, md.PrivateIpv4, 1)
+	assert.Equal(t, "10.0.0.5", md.PrivateIpv4[0].IP)
+}

providers/os/resources/cloud/testdata/hetzner_with_local_ip.toml

@@ -0,0 +1,38 @@
+[commands."uname -s"]
+stdout = "Linux"
+
+[commands."uname -m"]
+stdout = "x86_64"
+
+[commands."uname -r"]
+stdout = "5.15.0-91-generic"
+
+[commands.d4923e3c7f9c8dec0409fddee98da395085699bbb2cc9cfc8c3527e02f746c41]
+  command = "curl --retry 3 --retry-delay 1 --connect-timeout 1 --retry-max-time 5 --max-time 10 --noproxy '*' http://169.254.169.254/hetzner/v1/metadata"
+  exit_status = 0
+  stdout = """
+instance-id: 110512417
+hostname: ubuntu-8gb-hil-1
+region: us-west
+availability-zone: hil-dc1
+local-ipv4: 10.0.0.5
+public-ipv4: 5.78.107.208
+public-keys:
+- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwjdTGb2Brk8c99PdqDHgOIjmHBQfE4tT9MGXTsfkss
+network-config:
+  config:
+  - mac_address: "92:00:06:96:49:21"
+    name: eth0
+    subnets:
+    - ipv4: true
+      type: dhcp
+    - address: "2a01:4ff:1f0:4c7b::1/64"
+      dns_nameservers:
+      - "2a01:4ff:ff00::add:2"
+      - "2a01:4ff:ff00::add:1"
+      gateway: "fe80::1"
+      ipv6: true
+      type: static
+    type: physical
+  version: 1
+"""