From 2f001008e3953591776d560f39f1b960c988f723 Mon Sep 17 00:00:00 2001
From: Marcelo Silveira <mhfs@icloud.com>
Date: Tue, 21 Apr 2026 11:36:52 -0300
Subject: [PATCH 1/2] add Render CLI to setup and doctor

Installs render-oss/render via brew on macOS, the linux zip release
on Ubuntu, and render-cli-bin from AUR on Arch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 README.md            |  1 +
 doctor.sh            |  3 +++
 lib/render_doctor.sh | 14 +++++++++++
 lib/render_setup.sh  | 56 ++++++++++++++++++++++++++++++++++++++++++++
 setup.sh             |  3 +++
 5 files changed, 77 insertions(+)
 create mode 100644 lib/render_doctor.sh
 create mode 100644 lib/render_setup.sh

diff --git a/README.md b/README.md
index 35e38f8..915cef4 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,7 @@ Bootstraps a developer machine with the baseline tools required to work on Trust
 - **Colima** — container runtime for macOS (macOS only)
 - **AWS CLI** — Amazon Web Services CLI (no auth configured)
 - **AWS VPN Client** — VPN client for AWS
+- **Render CLI** — Render.com CLI
 - **Private registries** — Bundler and Yarn credentials for private packages
 
 ## Quick start
diff --git a/doctor.sh b/doctor.sh
index 2ca0bd8..4ea2371 100755
--- a/doctor.sh
+++ b/doctor.sh
@@ -132,6 +132,9 @@ source "$SCRIPT_DIR/lib/docker_doctor.sh"
 # shellcheck source=lib/aws_doctor.sh
 source "$SCRIPT_DIR/lib/aws_doctor.sh"
 
+# shellcheck source=lib/render_doctor.sh
+source "$SCRIPT_DIR/lib/render_doctor.sh"
+
 # shellcheck source=lib/registries_doctor.sh
 source "$SCRIPT_DIR/lib/registries_doctor.sh"
 
diff --git a/lib/render_doctor.sh b/lib/render_doctor.sh
new file mode 100644
index 0000000..4fcd7f3
--- /dev/null
+++ b/lib/render_doctor.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+#
+# Doctor check: Render CLI.
+# Sourced by doctor.sh — do not execute directly.
+# Requires: lib/common.sh, doctor helpers (check_pass, check_fail, check_cmd)
+
+fmt_header "Render CLI"
+
+check_cmd "render" "render"
+
+if cmd_exists render; then
+  version_output="$(render --version 2>&1 | head -1)"
+  check_pass "render reports version: $version_output"
+fi
diff --git a/lib/render_setup.sh b/lib/render_setup.sh
new file mode 100644
index 0000000..80b00aa
--- /dev/null
+++ b/lib/render_setup.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# Render CLI setup.
+# Sourced by setup.sh — do not execute directly.
+# Requires: lib/common.sh
+
+fmt_header "Render CLI"
+
+if cmd_exists render; then
+  fmt_ok "render already installed ($(render --version 2>&1 | head -1))"
+else
+  fmt_install "Render CLI"
+  case "$OS" in
+    macos)
+      brew install render-oss/render/render
+      ;;
+    ubuntu)
+      render_arch="amd64"
+      case "$(uname -m)" in
+        aarch64|arm64) render_arch="arm64" ;;
+        armv7l|armv6l) render_arch="arm" ;;
+        i386|i686)     render_arch="386" ;;
+      esac
+
+      if ! cmd_exists unzip; then
+        sudo apt-get install -y -qq unzip
+      fi
+
+      render_tmp="$(mktemp -d)"
+      render_url="$(curl -fsSL https://api.github.com/repos/render-oss/cli/releases/latest \
+        | grep -oE "\"browser_download_url\": \"[^\"]*cli_[0-9.]+_linux_${render_arch}\.zip\"" \
+        | head -1 | cut -d'"' -f4)"
+
+      if [ -z "$render_url" ]; then
+        echo "  ERROR: Could not resolve Render CLI release for linux/${render_arch}."
+        exit 1
+      fi
+
+      curl -fsSL "$render_url" -o "$render_tmp/render.zip"
+      unzip -qo "$render_tmp/render.zip" -d "$render_tmp"
+      render_bin="$(find "$render_tmp" -maxdepth 1 -type f -name 'cli_v*' | head -1)"
+      sudo install -m 0755 "$render_bin" /usr/local/bin/render
+      rm -rf "$render_tmp"
+      ;;
+    arch)
+      if cmd_exists yay; then
+        yay -S --noconfirm render-cli-bin
+      elif cmd_exists paru; then
+        paru -S --noconfirm render-cli-bin
+      else
+        echo "  WARNING: No AUR helper found (yay/paru)."
+        echo "  Install render-cli-bin manually from AUR."
+      fi
+      ;;
+  esac
+fi
diff --git a/setup.sh b/setup.sh
index 8fa6ce4..afb8a1a 100755
--- a/setup.sh
+++ b/setup.sh
@@ -146,6 +146,9 @@ source "$SCRIPT_DIR/lib/docker_setup.sh"
 # shellcheck source=lib/aws_setup.sh
 source "$SCRIPT_DIR/lib/aws_setup.sh"
 
+# shellcheck source=lib/render_setup.sh
+source "$SCRIPT_DIR/lib/render_setup.sh"
+
 # shellcheck source=lib/registries_setup.sh
 source "$SCRIPT_DIR/lib/registries_setup.sh"
 

From 9629dec5641486c368342455944f4dec0a7ae51e Mon Sep 17 00:00:00 2001
From: Marcelo Silveira <mhfs@icloud.com>
Date: Tue, 21 Apr 2026 11:39:40 -0300
Subject: [PATCH 2/2] silence SC2317 on cleanup_tmp (invoked via trap)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 doctor.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doctor.sh b/doctor.sh
index 4ea2371..97b349d 100755
--- a/doctor.sh
+++ b/doctor.sh
@@ -32,6 +32,7 @@ else
   SETUP_REF="${SETUP_REF:-main}"
   DOCTOR_TMPDIR=""
 
+  # shellcheck disable=SC2317 # Invoked indirectly via trap
   cleanup_tmp() { [ -n "$DOCTOR_TMPDIR" ] && rm -rf "$DOCTOR_TMPDIR"; }
   trap cleanup_tmp EXIT