tronador-cli

A cross-platform CLI for CloudOps Works Tronador workflows, AWS resource automation, IaC module auditing, and repository template lifecycle management.

---

This project is part of our comprehensive approach towards DevOps Acceleration.

It's 100% Open Source and licensed under the APACHE2.

Introduction

• AWS resource automation: Apply consistent organization metadata, remediate S3/EC2 security controls, copy Secrets Manager secrets, and remove default VPCs.
• Infrastructure-as-code module auditing: Run tronador iac module in .cloudopsworks/.iac workspaces to report Terragrunt module source pins, list available patch/minor/major targets, detect missing Terraform git:: prefixes, and optionally update module refs safely.
• Binary naming: Published release automation produces the clean tronador executable; plain local go build from this repository still emits tronador-cli unless -o tronador is passed.
• Repository template lifecycle: Run the Tronador make repos/* workflow from the CLI with tronador repos, including template detection, latest-tag upgrades, explicit version upgrades, recovery, migration, CICD metadata updates, and push helpers.
• README and docs generation: Port Tronador readme/* and docs/* Makefile targets into the CLI with tronador readme and tronador docs, including GitHub-backed runtime template asset sync.
• Implicit project capabilities: Detect implementation markers and run namespace-free init, version, lint, format, and cleanup capabilities through CLI-native typed pipelines with tronador project.
• Command documentation: Public command surfaces are documented in docs/commands.md, with dedicated guides for AWS automation, IaC module checks, project capabilities, repository lifecycle commands, and README/docs commands.
• Config-driven upgrade paths: Repository templates and migration plans are loaded from JSON, so future upgrade paths such as 5.11 and 5.12 can be added without rewriting command dispatch code.
• Release packages: GoReleaser publishes archives plus native Linux packages (.deb, .rpm, .apk), Homebrew casks, Chocolatey packages, and shell/PowerShell installers from the same release pipeline; release package names remain tronador-cli while the executable is tronador.
• Cross-platform support: Linux, macOS, Windows, and FreeBSD builds are produced from a static CGO_ENABLED=0 binary.

Usage

Command Documentation

Start with the command index in docs/commands.md. Dedicated operator guides are available for:

• AWS command — tagging, secret copy, default VPC removal, and security remediation.
• IaC command — .cloudopsworks/.iac-guarded module source version checks and updates.
• Project command — detection-driven, namespace-free capabilities and typed tool pipelines.
• Repos command — repository template lifecycle workflows.
• README/docs command — generated README files, Make target docs, Terraform docs, copyright headers, and runtime template assets.

Binary Names

Published releases expose the executable as tronador. The repository and package name remains tronador-cli. A plain local go build from the repository root creates ./tronador-cli; use go build -o tronador . when you want a local binary that matches release automation.

Global flags available from the root command:

• --dry-run — show supported changes without applying them.
• -v, --verbose — enable verbose output.

AWS Commands

tronador aws provides AWS automation subcommands. All AWS subcommands share profile, region, and assume-role flags documented in docs/aws-command.md.

• aws tag — tag supported AWS resources with organization metadata.
• aws copysecret — copy Secrets Manager secrets within an account, across regions, or across accounts.
• aws remove-default-vpc — remove default VPCs across regions, with optional region exclusions.
• aws remediation s3 — enforce SSL/TLS-only S3 bucket access.
• aws remediation ec2 — remove unrestricted rules from default security groups.

Infrastructure-as-Code Commands

tronador iac commands run only when --workdir contains .cloudopsworks/.iac.

• iac module — scan terragrunt.hcl files for direct GitHub module sources with ?ref= pins, report available patch/minor/major targets, flag missing git:: prefixes, and optionally mutate the selected tier.
• Compatibility aliases: iac module-versions and iac module_versions.
• --path limits module discovery without changing marker validation; relative paths resolve under --workdir and paths outside --workdir are rejected.

See docs/iac-command.md for supported source forms, mutation flags, dry-run behavior, and CI reporting options.

Repository Template Commands

tronador repos ports the supported public Tronador make repos/* targets into the CLI. tronador repo is an alias for the same command tree.

• repos available / repos avail — list latest compatible template tags.
• repos template init and repos template <kind> — pull configured template repositories.
• repos clean, repos clean template, and repos template clean — clean generated or temporary template files.
• repos upgrade [version] — run the full template upgrade workflow; [version] is optional.
• repos recover — overlay template files without committing.
• repos push — stage and commit template upgrade results.
• repos cicd update — update the workflow-version metadata footer.

repos upgrade preserves implementation-owned GitHub templates: issue templates including config.yml and .github/PULL_REQUEST_TEMPLATE.md are copied only when missing; .github/dependabot.yml is copied only when the template has it and the implementation repository does not; reserved 98_* and 99_* template-only issue forms are never propagated. Existing auto-assign.yml configuration is preserved. The template .gitignore content is managed in a marker-delimited block while user content outside the block is preserved; an unmarked or malformed file is treated as user-owned and receives a fresh managed block.

The command uses the embedded JSON catalog at internal/repos/default_config.json by default. Override it with --config path/to/repos-config.json when testing new repository types or future migration plans.

For the full command mapping and architecture notes, see docs/repos-command.md.

Implicit Project Capabilities

tronador project detects a supported implementation from .cloudopsworks/ and runs namespace-free capabilities such as init, version, lint, and format through CLI-native typed tool pipelines. See docs/project-command.md for detection, tool flags, and safety behavior.

README and Documentation Commands

tronador readme and tronador docs port the Tronador readme/* and docs/* Makefile targets into the release binary.

• readme build — generate README.md from README.yaml with gomplate, resolving or downloading gomplate on demand.
• readme init — create README.yaml from the selected runtime template when missing.
• readme lint — fail when README.md is not up to date.
• readme assets sync — explicitly download canonical README templates from GitHub into the local cache or project override directory.
• docs targets — generate docs/targets.md from make help output.
• docs terraform — generate docs/terraform.md from terraform-docs.
• docs copyright-add — run the configured copyright-header command.

README tool provisioning is per-tool and on-demand: readme build, readme lint, and readme deps resolve gomplate from --gomplate, PATH, then ~/.cloudopsworks/tronador/gomplate, and only download the requested gomplate release when it is missing. The provisioner downloads direct upstream GitHub release assets and does not use tronador-packages.

Tool metadata is JSON-driven instead of hardcoded in Go. The binary ships an embedded tools.json with default definitions for gomplate, gh, boilerplate, gitversion, yq, go, git, terraform, tofu, and terragrunt. Runtime overrides can be supplied from ~/.cloudopsworks/tronador/tools.json, project .cloudopsworks/tronador/tools.json, project .tronador/tools.json, TRONADOR_TOOLS_CONFIG, or --tools-config; overrides merge field-by-field by tool name.

README generator assets resolve in this order: flags, environment variables, project-local .tronador/readme, user config, GitHub sync cache, shared install paths, then embedded fallback assets. Template refresh remains explicit through readme assets sync when you want to refresh templates from GitHub.

See docs/readme-docs-command.md for full flags, dependency expectations, and cache behavior.

Version and Completion

• tronador version — print the release binary version.
• tronador completion <shell> — generate Cobra shell completion scripts.

Make Command Support

The project includes make command support that works with both make and gmake where the Tronador Makefile provides the target:

# Build the application
make build

# Build for all platforms
make build-all

# Run tests with coverage
make test-cover

# Clean build artifacts
make clean

Development

Building

# Build for current platform
make build

# Plain Go source build; outputs ./tronador-cli because of the module directory name
go build .

# Local build matching the release executable name
go build -o tronador .

# Build for all platforms
make build-all

# Run tests
make test

# Run tests with coverage
make test-cover

Release validation

# Validate installer scripts
scripts/validate-installers.sh

# Validate GoReleaser config, including archives, Homebrew, Chocolatey, and nFPM packages
goreleaser check

# Build a local snapshot without publishing
goreleaser release --snapshot --clean --skip=before --skip=publish --skip=sign

Contributing

1. Fork the repository.
2. Create a feature branch.
3. Make your changes.
4. Run tests: make test.
5. Submit a pull request.

Quick Start

Prerequisites

For installed binaries:

• AWS credentials with the required permissions for tronador aws ... commands.
• GitHub authentication through GH_TOKEN, GITHUB_TOKEN, or gh auth login when running tronador repos commands or tronador iac module version checks that query GitHub tags.
• IaC workspaces must contain .cloudopsworks/.iac before tronador iac ... commands will run.

For source builds:

• Go 1.25 or later, matching the module toolchain target.
• make or gmake if you use the repository Makefile targets.

Installation

Install from published GitHub Release artifacts. The release pipeline publishes shell and PowerShell installers, Homebrew and Chocolatey metadata, native Linux packages, and zip archives. See docs/installation.md for version pinning, upgrade, uninstall, and maintainer workflow details.

Platform / manager	Install command
Linux/macOS shell	curl -fsSL https://raw.githubusercontent.com/cloudopsworks/tronador-cli/master/scripts/install.sh | sh
Windows PowerShell	iwr https://raw.githubusercontent.com/cloudopsworks/tronador-cli/master/scripts/install.ps1 -UseB | iex
Homebrew	brew install cloudopsworks/tap/tronador-cli
Chocolatey	choco install tronador-cli

Native Linux packages are attached to each release. Download the asset for your version and architecture, then install it locally:

# Debian / Ubuntu
sudo apt install ./tronador-cli_<version>_<arch>.deb

# RHEL / Fedora / CentOS
sudo dnf install ./tronador-cli-<version>-1.<arch>.rpm
# or: sudo rpm -i ./tronador-cli-<version>-1.<arch>.rpm

# Alpine Linux
sudo apk add --allow-untrusted ./tronador-cli_<version>_<arch>.apk

Direct zip archives remain available for every supported OS/architecture through GitHub Releases. Release archives contain the tronador executable.

For development builds from source:

git clone https://github.com/cloudopsworks/tronador-cli.git
cd tronador-cli
make build

# Plain Go output name from this checkout
go build .          # ./tronador-cli

# Release-style executable name
go build -o tronador .

Examples

Audit IaC module sources

# Report module versions in an IaC workspace
tronador iac module --workdir ../my-iac-workspace

# Report available patch, minor, and major targets for one environment path
tronador iac module --workdir ../my-iac-workspace --path env/dev

# Preview default patch upgrades and missing git:: prefix normalization
tronador iac module --workdir ../my-iac-workspace --path env/dev --upgrade --dry-run

# Apply the default patch target and git:: prefix fixes
tronador iac module --workdir ../my-iac-workspace --path env/dev --upgrade

# Select a broader release tier instead of the default patch target
tronador iac module --workdir ../my-iac-workspace --path env/dev --upgrade --minor
tronador iac module --workdir ../my-iac-workspace --path env/dev --upgrade --major

# Allow alpha and beta prereleases when selecting updates
tronador iac module --workdir ../my-iac-workspace --upgrade --alpha --beta

Tag AWS Resources

tronador aws tag \
  --organization "MyOrg" \
  --organization-unit "DevOps" \
  --application-name "WebApp" \
  --application-type "Service" \
  --target resources

Copy an AWS secret

# Copy within the same account and region
tronador aws copysecret --source my-secret --dest my-secret-copy

# Copy to another region
tronador aws copysecret --source my-secret --dest my-secret-copy --dest-region us-west-2

Remove Default VPCs

tronador aws remove-default-vpc \
  --exclude-regions "us-west-2,eu-west-1"

Remediate AWS security controls

# Preview S3 SSL/TLS enforcement policy changes
tronador aws remediation s3 --dry-run

# Preview EC2 default security group remediation in a region
tronador aws remediation ec2 --region us-east-1 --dry-run

Upgrade repository templates

# Show available template versions for the detected repository type
tronador repos available --workdir ../my-service

# Run the default full upgrade workflow using the latest tag in the current major/minor line
tronador repos upgrade --workdir ../my-service

# Run the same full workflow against an explicit tag or branch
tronador repos upgrade v5.10.12 --workdir ../my-service

# Run the same full workflow against the latest tag in the current major line
tronador repos upgrade major --workdir ../my-service

# Run the same full workflow from the template repository master branch tip
tronador repos upgrade master --workdir ../my-service

repos upgrade intentionally exposes a single public workflow. Internal Makefile stages such as fetch, eval, migrate, and stack are handled inside the command instead of being separate subcommands. Public workflows clean up their temporary .template checkout when they finish or fail.

Generate README and docs

# Create README.yaml when missing
tronador readme init --workdir ../my-service

# Sync editable README generator templates from GitHub into the project
tronador readme assets sync --project --workdir ../my-service

# Build and validate README.md
tronador readme build --workdir ../my-service
tronador readme lint --workdir ../my-service

# Generate Make target and Terraform docs
tronador docs targets --workdir ../my-service --all
tronador docs terraform --workdir ../my-terraform-module

# Preview copyright-header execution
tronador docs copyright-add --workdir ../my-service --software-description "My service" --dry-run

Version and help

tronador version
tronador iac module --help
tronador aws remediation --help

Help

Got a question? We got answers.

File a GitHub issue, send us an email or join our Slack Community.

DevOps Tools

Our Products CI/CD Blueprint Open Source

Slack Community

Newsletter

Resources Directory

Bug Reports & Feature Requests

Please use the issue tracker to report any bugs or file feature requests.

Copyrights

Copyright © 2021-2026 Cloud Ops Works LLC

License

See LICENSE for full details.

Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.

Trademarks

All other trademarks referenced herein are the property of their respective owners.

About

This project is maintained by Cloud Ops Works LLC.

Contributors

Cristian Beraha