pp-render

What this skill does

<!-- GENERATED FILE — DO NOT EDIT.
     This file is a verbatim mirror of library/cloud/render/SKILL.md,
     regenerated post-merge by tools/generate-skills/. Hand-edits here are
     silently overwritten on the next regen. Edit the library/ source instead.
     See the repository agent guide, section "Generated artifacts: registry.json, cli-skills/". -->

# Render — Printing Press CLI

## Prerequisites: Install the CLI

This skill drives the `render-pp-cli` binary. **You must verify the CLI is installed before invoking any command from this skill.** If it is missing, install it first:

1. Install via the Printing Press installer. It defaults binaries to `$HOME/.local/bin` on macOS/Linux and `%LOCALAPPDATA%\Programs\PrintingPress\bin` on Windows:
   ```bash
   npx -y @mvanhorn/printing-press-library install render --cli-only
   ```
2. Verify: `render-pp-cli --version`
3. Ensure the reported install directory is on `$PATH` for the agent/runtime that will invoke this skill.

If the `npx` install fails (no Node, offline, etc.), fall back to a direct Go install (requires Go 1.26.3 or newer):

```bash
go install github.com/mvanhorn/printing-press-library/library/cloud/render/cmd/render-pp-cli@latest
```

If `--version` reports "command not found" after install, the runtime cannot see the binary directory on `$PATH`. Do not proceed with skill commands until verification succeeds.

## When to Use This CLI

Use render-pp-cli when you need to reason about your Render footprint as a whole, not one resource at a time. It shines for env-var promotion across environments, blueprint drift checks in CI, monthly cost rollups, preview cleanup, and audit-log forensics. For one-off interactive workflows like `render psql` or `render ssh`, the official CLI is fine — render-pp-cli covers those too but its real value is the analytical commands the dashboard hides.

## Unique Capabilities

These capabilities aren't available in any other tool for this API.

### Local state that compounds
- **`env diff`** — Compare env vars between any two services, env-groups, or a service vs an env-group, three-way diff style.

  _Reach for this when promoting config across environments — it's the cheapest way to see what's actually different without click-through._

  ```bash
  render-pp-cli env diff srv-staging-api srv-prod-api --json
  ```
- **`env promote`** — Copy env vars from a source service or env-group to a target with --only/--exclude/--dry-run.

  _Use when shipping a known-good staging config to prod without dragging dev-only keys along._

  ```bash
  render-pp-cli env promote --from srv-staging-api --to srv-prod-api --exclude DEBUG_TOKEN --dry-run
  ```
- **`drift`** — Compare a checked-in render.yaml against live workspace state and report added/removed/modified entities by name.

  _Run this in CI to fail builds when someone edits prod through the dashboard instead of the blueprint._

  ```bash
  render-pp-cli drift --blueprint render.yaml --json
  ```
- **`cost`** — Sum monthly cost across services, postgres, key-value, redis, and disks; group by project, environment, or owner.

  _Reach for this on the Friday cost-review or when finance asks 'what would happen if we downsized these three services?'_

  ```bash
  render-pp-cli cost --group-by project --json
  ```
- **`rightsize`** — For each service, fetch last --since 7d of CPU and memory; compute p95 utilization; flag services breaching --high or --low thresholds against plan capacity.

  _Run this before the cost rollup to find quick downsizing wins or services about to throttle._

  ```bash
  render-pp-cli rightsize --since 7d --high 80 --low 20 --json
  ```

### Lifecycle hygiene
- **`preview-cleanup`** — List preview services older than --stale-days N; delete in bulk on --confirm.

  _Use when the monthly bill spikes and you suspect orphaned preview envs._

  ```bash
  render-pp-cli preview-cleanup --stale-days 14 --confirm
  ```
- **`orphans`** — Find unattached disks, empty env-groups, custom-domains pointing at deleted services, registry credentials referenced by no service, and disk snapshots beyond retention.

  _Audit cleanup, billing review, and SOC 2 evidence-gathering all start here._

  ```bash
  render-pp-cli orphans --json
  ```

### Agent-native plumbing
- **`env where`** — For a given env-var key, list every service and env-group that defines it with hash, length, and last-modified timestamp (never raw value).

  _First call during a credential rotation or a 'who uses this secret' audit._

  ```bash
  render-pp-cli env where STRIPE_KEY --json
  ```
- **`incident-timeline`** — Merge deploys, events, and audit-logs for one service into one chronological table for a given window.

  _First command on-call should run during a 2am page after a deploy._

  ```bash
  render-pp-cli incident-timeline srv-checkout-api --since 2h --json
  ```
- **`audit search`** — FTS5 search across cached audit logs by actor, target, action, and time window.

  _Use during SOC 2 evidence-gathering or to answer 'who rotated this key last quarter'._

  ```bash
  render-pp-cli audit search --actor [email protected] --target STRIPE_KEY --since 30d --json
  ```
- **`deploys diff`** — Show commit range, env-var changes, image-tag changes, and plan/region/scale changes between two deploys of one service.

  _First command in a post-deploy regression triage — answers 'what actually changed'._

  ```bash
  render-pp-cli deploys diff srv-checkout-api dep-aaa dep-bbb --json
  ```

## Command Reference

**blueprints** — [Blueprints](https://render.com/docs/infrastructure-as-code) allow you to define your resources in a `render.yaml` file and automatically sync changes to your Render services.
The API gives control over how your Blueprints are used to create and manage resources.

- `render-pp-cli blueprints disconnect` — Disconnect the Blueprint with the provided ID. Disconnecting a Blueprint stops automatic resource syncing via the...
- `render-pp-cli blueprints list` — List Blueprints for the specified workspaces. If no workspaces are provided, returns all Blueprints the API key has...
- `render-pp-cli blueprints retrieve` — Retrieve the Blueprint with the provided ID.
- `render-pp-cli blueprints update` — Update the Blueprint with the provided ID.
- `render-pp-cli blueprints validate` — Validate a `render.yaml` Blueprint file without creating or modifying any resources. This endpoint checks the syntax...

**cron-jobs** — Manage cron jobs


**disks** — [Disks](https://render.com/docs/disks) allow you to attach persistent storage to your services.

- `render-pp-cli disks add` — Attach a persistent disk to a web service, private service, or background worker. The service must be redeployed for...
- `render-pp-cli disks delete` — Delete a persistent disk attached to a service. **All data on the disk will be lost.** The disk's associated service...
- `render-pp-cli disks list` — List persistent disks matching the provided filters. If no filters are provided, returns all disks you have...
- `render-pp-cli disks retrieve` — Retrieve the persistent disk with the provided ID.
- `render-pp-cli disks update` — Update the persistent disk with the provided ID. The disk's associated service must be deployed and active for...

**env-groups** — Manage env groups

- `render-pp-cli env-groups create` — Create a new environment group.
- `render-pp-cli env-groups delete` — Delete the environment group with the provided ID, including all environment variables and secret files it contains.
- `render-pp-cli env-groups list` — List environment groups matching the provided filters. If no filters are provided, all environment groups are returned.
- `render-pp-cli env-groups retrieve` — Retrieve an environment group by ID.
- `render-pp-cli env-groups update` — Update the attributes of an environment group.

**environments** — Manage environments

- `render-pp-cli environments create` — Create a new environment belonging to the project with the provided ID.
- `