[cdalar]

Summary

• Adds ovh as a supported cloud provider, following the existing CloudProviderInterface pattern used by aws/azure/gcp/hetzner
• New internal/providerovh (client construction via OVH's app-key/app-secret/consumer-key auth) and pkg/cloud/ovh.go (Deploy/Destroy/Pause/Resume/List/ListPaused/CreateSSHKey/SSHInto/GetByName)
• Pause/Resume map directly onto OVH's built-in shelve/unshelve instance actions, which already stop billing server-side — no manual snapshot juggling needed like Hetzner's Pause
• Behavior note: OVH's Public Cloud instance API has no tags/labels (confirmed against the live API schema), so unlike the other providers, onctl treats every instance in the configured ovh.serviceName project as its own for ls/destroy. Documented prominently in onctl.yaml and README — don't point onctl at an OVH project with unrelated VMs
• Request/response field names (flavor/image/instance/sshkey) were verified against the live OVH API schema (eu.api.ovh.com/1.0/cloud.json), not guessed
• First of three planned providers (OVH, Scaleway, StackIT) growing out of the docs/static/notes/ sovereign-cloud research; plan at docs/plans/ovh-provider.md

Test plan

• go build ./... and go vet ./...
• go test ./... — new pkg/cloud/ovh_test.go uses a real *ovh.Client against an httptest server (same style as hetzner_images_test.go), covering Deploy (flavor/image name→id resolution, create payload, poll-to-ACTIVE), Pause/Resume (shelve/unshelve), List/ListPaused, GetByName, Destroy, and CreateSSHKey (idempotent match-by-fingerprint)
• pause_resume_test.go's cross-provider contract test extended to cover ProviderOvh
• Manual smoke test against a real OVH Public Cloud account (needs OVH credentials I don't have): onctl init → fill in ovh.serviceName → export OVH_APPLICATION_KEY=... OVH_APPLICATION_SECRET=... OVH_CONSUMER_KEY=... → onctl create -p ovh / onctl ls -p ovh / onctl pause / onctl resume / onctl destroy. A few specifics (exact BUILD→ACTIVE timing, userData base64-vs-plain-text) are documented from the API schema but not yet exercised live — flagged in the plan's Verification section rather than claimed as fully verified

Note: two pre-existing cmd test failures (TestReadConfig_NoConfigDirectory, TestCreateFlagsBindToViper) reproduce identically on main without this branch's changes — they read this machine's real ~/.onctl, a pre-existing test-isolation issue unrelated to this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JhQDPNcYjg8iAJ2HGZYYwm

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​ovh/​go-ovh@​v1.9.0

View full report