GitHub on

Chainguard Checks overview

Thu, 08 Oct 2026 00:00:00 +0000

Chainguard Checks runs your repository’s CI on Chainguard’s infrastructure instead of on GitHub Actions runners. You define your checks, such as linting and tests, in a .chainguard/ci.yaml file in your repository. On every pull request, Chainguard Checks runs each check in its own microVM, built on Chainguard OS, and reports the results on the pull request as GitHub checks.

CI runners usually hold long-lived secrets and can reach the whole internet while they run untrusted code, such as a pull request’s changes or a compromised dependency. In Chainguard Checks, each check runs in a fresh VM that has no long-lived credentials, and no network access unless the check lists the hosts it needs.

Guardener on GitHub

Mon, 13 Jul 2026 00:00:00 +0000

Guardener’s GitHub capabilities run through the Chainguard App, a single hardened GitHub App that also backs other Chainguard products. Those capabilities are opt-in per repository through configuration files committed to a .chainguard/ directory, so installing the app has no effect on a repository until you enable a capability.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Getting set up

Getting started — Install the Chainguard App and link your Chainguard organization to your GitHub organization.
App connections — Set up, inspect, and remove the connections between your Chainguard organization and your GitHub organizations.
Configuration — Understand the .chainguard/ configuration model that all of Guardener’s GitHub capabilities share.

Capabilities

Hardened Actions — Recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents, through non-blocking pull request review comments or automated migration pull requests. Migration pull requests run on a schedule and can also be triggered on demand with chainctl.
Container Image Suggestions — Recommends Chainguard container images for the container images a pull request adds or changes, through non-blocking review comments with one-click suggested changes where possible.
Container Image Migration — Replaces the container images a repository already uses with Chainguard container images through a migration pull request. Migration runs on a schedule and can also be triggered on demand with chainctl.
Commit Verification — Enforces cryptographically signed commits against a policy you control, supporting both keyless (Sigstore) signatures and static keys such as GPG.

Each capability is configured with its own file in the .chainguard/ directory.

Getting started with Guardener

Wed, 08 Jul 2026 00:00:00 +0000

This guide walks you through everything you need to start using Guardener on your GitHub repositories:

Install the Chainguard App on your GitHub organization.
Link your Chainguard organization to your GitHub organization.
Verify the link and enable your first feature.

Once the app is installed, Guardener can respond on your public repositories. Linking connects that activity to your Chainguard organization and unlocks the features that require one, such as private repository coverage — there is no separate entitlement step.

Get started with Chainguard Checks

Thu, 08 Oct 2026 00:00:00 +0000

This guide walks you through signing up for Chainguard Checks, adding checks to one of your GitHub repositories, and seeing them run on a pull request. It uses a Go repository as the example and takes about 15 minutes.

Note: Chainguard Checks is in beta. Available to organizations that turn it on with chainctl develop init, which comes with a free monthly compute allowance, or that arrange access with their Chainguard account team.

Managing Chainguard App connections

Mon, 03 Aug 2026 00:00:00 +0000

Guardener acts on your GitHub repositories on behalf of your Chainguard organization. The bridge between the two is a connection: a Chainguard App installation on a GitHub organization, linked to a Chainguard organization. This page explains how connections work and how to set up, inspect, change, and remove them.

For a first-time walkthrough, refer to Getting started. This page is the fuller reference for managing connections over time.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Guardener Dockerfile migration

Mon, 13 Jul 2026 00:00:00 +0000

The Dockerfile migration feature converts your Dockerfiles to use Chainguard Containers. It uses AI to iteratively translate instructions, build images, compare results, and fix issues until the migrated Dockerfile works as expected.

Unlike Guardener’s Hardened Actions and Commit Verification features, Dockerfile migration does not run through the Chainguard App or the .chainguard/ configuration directory. Instead, you drive it locally through chainctl agent dockerfile commands. The AI runs server-side and scans your workspace to perform its analysis, while Docker builds and file access remain local to your machine.

Configuring Guardener

Wed, 08 Jul 2026 00:00:00 +0000

Guardener is configured entirely through files committed to a .chainguard/ directory — either in each repository, or once at the organization level in your .github repository. This page explains the configuration model that all Guardener features share. For the specific options of each feature, refer to its dedicated page.

The `.chainguard/` directory

Guardener reads its configuration from the .chainguard/ directory at the root of each repository. Every feature has its own file:

Use Chainguard Checks on GitHub

Thu, 08 Oct 2026 00:00:00 +0000

Chainguard Checks runs on your GitHub repositories through the Chainguard App and reports its results as GitHub checks. This page explains when Chainguard Checks runs, how its results appear on GitHub, and how to use them to protect your branches.

When Checks runs

Chainguard Checks runs on a repository when the Chainguard App is installed on the repository, its GitHub account is linked to a Chainguard organization with access to Chainguard Checks, and the repository has a .chainguard/ci.yaml file or a .chainguard/ci/ directory. For a pull request, Chainguard Checks looks for the configuration on the pull request’s branch and on its base branch.

Guardener Hardened Actions

Wed, 08 Jul 2026 00:00:00 +0000

The Hardened Actions feature recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents. Pinning actions to a specific commit SHA — rather than a mutable tag or branch — protects your workflows from supply chain attacks in which an upstream tag is moved to point at malicious code.

Hardened Actions operates in two independent modes:

Pull request recommendations — non-blocking review comments that suggest hardened action alternatives, with one-click suggestion blocks.
Automated migration pull requests — a periodically maintained pull request that updates workflows across your repository. You can also trigger this migration on demand with chainctl instead of waiting for the next scheduled run.

You can enable either mode on its own or both together.

Guardener Container Image Suggestions

Fri, 02 Oct 2026 00:00:00 +0000

Guardener reviews pull requests that add or change container image references and recommends the Chainguard container image that replaces each upstream image. Where it can, Guardener includes the replacement as a one-click suggested change.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Guardener reads only the lines a pull request adds or changes, so it catches upstream images as they’re introduced but doesn’t review the images a repository already uses. To replace those images, turn on Container Image Migration, which opens a pull request for the whole repository. To list replacements for every image without changing any files, run chainctl images discover.

Guardener Container Image Migration

Thu, 08 Oct 2026 02:59:03 +0000

Guardener scans the default branch of a repository for container image references and opens a pull request that replaces them with Chainguard container images your organization already has. As your repository and your organization’s images change, Guardener keeps that pull request up to date.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Container Image Migration and Container Image Suggestions work together. Image Suggestions reviews the images that each new pull request adds, and migration replaces the images the repository already uses. Each has its own setting in .chainguard/images.yaml, so you can use either one or both.

Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.

Migrate from GitHub Actions to Chainguard Checks

Thu, 08 Oct 2026 00:00:00 +0000

If your repository runs its pull request checks with GitHub Actions, you can move them to Chainguard Checks one workflow at a time. Chainguard Checks and GitHub Actions can run on the same pull requests, so you can compare their results before you remove a workflow.

You can convert workflows by hand, or start from a draft that the chainctl checks migrate command writes for you.

If you’d rather keep your workflows on GitHub Actions, Chainguard Actions replaces the actions they use with hardened equivalents, and Guardener’s Hardened Actions feature can migrate them for you.

GitHub on

Chainguard Checks overview

Guardener on GitHub

Getting set up

Capabilities

Getting started with Guardener

Get started with Chainguard Checks

Managing Chainguard App connections

Guardener Dockerfile migration

Configuring Guardener

The .chainguard/ directory

Use Chainguard Checks on GitHub

When Checks runs

Guardener Hardened Actions

Guardener Container Image Suggestions

Guardener Container Image Migration

Guardener Commit Verification

Migrate from GitHub Actions to Chainguard Checks

The `.chainguard/` directory