GitHub on

Overview of Guardener on GitHub

Mon, 13 Jul 2026 00:00:00 +0000

Guardener’s GitHub capabilities run through the Chainguard App, a single hardened GitHub App that also backs other Chainguard products. Those capabilities are opt-in per repository through configuration files committed to a .chainguard/ directory, so installing the app has no effect on a repository until you enable a capability.

Note: Each Guardener capability has its own release stage, listed in Optional Features. The GitHub capabilities are available to organizations that have installed and linked the Chainguard App.

Chainguard Checks overview

Thu, 08 Oct 2026 00:00:00 +0000

Chainguard Checks runs your pull requests’ checks, such as linting and tests, on Chainguard’s infrastructure, and reports the results on the pull request’s Checks tab on GitHub, beside any other checks the repository runs. You define the checks in a .chainguard/ci.yaml file in your repository, in Chainguard Checks’ own format. Chainguard Checks doesn’t run GitHub Actions workflows, so moving a workflow’s jobs to it means writing that file, as described in Migrate from GitHub Actions.

Getting started with Guardener

Wed, 08 Jul 2026 00:00:00 +0000

This guide walks you through everything you need to start using Guardener on your GitHub repositories:

Install the Chainguard App on your GitHub organization.
Link your Chainguard organization to your GitHub organization.
Verify the link and enable your first feature.

Once the app is installed, Guardener can respond on your public repositories. Linking connects that activity to your Chainguard organization and unlocks the features that require one, such as private repository coverage — there is no separate entitlement step.

Get started with Chainguard Checks

Thu, 08 Oct 2026 00:00:00 +0000

Get a first check passing with the quick start, or learn each part in the step-by-step guide.

Quick start

Install chainctl

To install chainctl with Homebrew, run the following command:
```
brew install chainguard-dev/tap/chainctl
```
Or, to install it with curl on macOS or Linux, run the following commands:
```
curl -fL -o chainctl "https://dl.enforce.dev/chainctl/latest/chainctl_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/aarch64/arm64/')"
sudo install -o $UID -g $(id -g) -m 0755 chainctl /usr/local/bin/
```
If you already have chainctl, you need 0.2.386 or later. Update it with sudo chainctl update, or with brew upgrade chainctl if you installed it with Homebrew.
Sign up

In the root of a local clone of a GitHub repository that you can push to, run the following command:
```
chainctl develop init
```
The command creates your Chainguard organization, if you don’t have one, and turns on Chainguard Checks. When it asks which GitHub account to link, choose the one that owns your repository: press Enter for your own user, or enter the organization’s name. If the Chainguard App isn’t installed on that account, the command offers to open its installation page. Give the App access to your repository. If you installed it earlier and GitHub shows that it’s asking for more permissions, accept them. To sign in with an email address and password, first run chainctl config set default.social-login email.
Add a first check

Create a branch and a .chainguard/ci.yaml file with one check:
```
git checkout -b add-chainguard-checks
mkdir -p .chainguard
cat > .chainguard/ci.yaml <<'EOF'
version: 1
environment: {}
checks:
hello:
cmd: ls -la
EOF
```
The check lists the files in its working directory and needs no packages or network access, so it passes on any repository.
Open a pull request

Commit the file and push the branch:
```
git add .chainguard/ci.yaml
git commit -m "Add Chainguard Checks"
git push -u origin add-chainguard-checks
```
Then open a pull request, from the link that git push prints or on github.com.
Read the result

On the pull request’s Checks tab, wait for Chainguard Checks (presubmit) to appear and pass, which usually takes less than a minute. It’s the only check that Chainguard Checks adds for this file, because a check that passes without reporting anything gets no GitHub check of its own. Select it to see the run’s summary: its title reads All 1 check(s) passed, and its table lists hello as passed. If no check appears, refer to A pull request gets no checks.

To replace the first check with your own, refer to Replace the first check with your own. To move checks from your GitHub Actions workflows, refer to Migrate from GitHub Actions.

Managing Chainguard App connections

Mon, 03 Aug 2026 00:00:00 +0000

Guardener acts on your GitHub repositories on behalf of your Chainguard organization. The bridge between the two is a connection: a Chainguard App installation on a GitHub organization, linked to a Chainguard organization. This page explains how connections work and how to set up, inspect, change, and remove them.

For a first-time walkthrough, refer to Getting started. This page is the fuller reference for managing connections over time.

Note: Each Guardener capability has its own release stage, listed in Optional Features. The GitHub capabilities are available to organizations that have installed and linked the Chainguard App.

Guardener Dockerfile migration

Mon, 13 Jul 2026 00:00:00 +0000

The Dockerfile migration feature converts your Dockerfiles to use Chainguard Containers. It uses AI to iteratively translate instructions, build images, compare results, and fix issues until the migrated Dockerfile works as expected.

Unlike Guardener’s Hardened Actions and Commit Verification features, Dockerfile migration does not run through the Chainguard App or the .chainguard/ configuration directory. Instead, you drive it locally through chainctl agent dockerfile commands. The AI runs server-side and scans your workspace to perform its analysis, while Docker builds and file access remain local to your machine.

Configuring Guardener

Wed, 08 Jul 2026 00:00:00 +0000

Guardener is configured entirely through files committed to a .chainguard/ directory — either in each repository, or once at the organization level in your .github repository. This page explains the configuration model that all Guardener features share. For the specific options of each feature, refer to its dedicated page.

The `.chainguard/` directory

Guardener reads its configuration from the .chainguard/ directory at the root of each repository. Every feature has its own file:

Use Chainguard Checks on GitHub

Thu, 08 Oct 2026 00:00:00 +0000

Chainguard Checks runs on your GitHub repositories through the Chainguard App and reports its results as GitHub checks. This page explains when Chainguard Checks runs, how its results appear on GitHub, how to read them with the GitHub API, and how to use them to protect your branches. To watch a pull request’s checks pass, fail, and pass again after a fix, follow the tutorial Fix a failing check with Claude Code.

Guardener Hardened Actions

Wed, 08 Jul 2026 00:00:00 +0000

The Hardened Actions feature recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents. Pinning actions to a specific commit SHA — rather than a mutable tag or branch — protects your workflows from supply chain attacks in which an upstream tag is moved to point at malicious code.

Note: Hardened Actions is in Early Access. It’s available to organizations that have installed and linked the Chainguard App.

Hardened Actions operates in two independent modes:

Guardener Container Image Suggestions

Fri, 02 Oct 2026 00:00:00 +0000

Guardener reviews pull requests that add or change container image references and recommends the Chainguard container image that replaces each upstream image. Where it can, Guardener includes the replacement as a one-click suggested change.

Note: Container Image Suggestions is in Early Access. It’s available to organizations that have installed and linked the Chainguard App.

Guardener reads only the lines a pull request adds or changes, so it catches upstream images as they’re introduced but doesn’t review the images a repository already uses. To replace those images, turn on Container Image Migration, which opens a pull request for the whole repository. To list replacements for every image without changing any files, run chainctl images discover.

Guardener Container Image Migration

Thu, 08 Oct 2026 02:59:03 +0000

Guardener scans the default branch of a repository for container image references and opens a pull request that replaces them with Chainguard container images your organization already has. As your repository and your organization’s images change, Guardener keeps that pull request up to date.

Note: Container Image Migration is in Early Access. It’s available to organizations that have installed and linked the Chainguard App.

Container Image Migration and Container Image Suggestions work together. Image Suggestions reviews the images that each new pull request adds, and migration replaces the images the repository already uses. Each has its own setting in .chainguard/images.yaml, so you can use either one or both.

Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Note: Commit Verification is in beta. Available to organizations that have installed and linked the Chainguard App.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.

Migrate from GitHub Actions to Chainguard Checks

Thu, 08 Oct 2026 00:00:00 +0000

If your repository runs its pull request checks with GitHub Actions, you can move them to Chainguard Checks one workflow at a time. Chainguard Checks and GitHub Actions can run on the same pull requests, so you can compare their results before you remove a workflow.

If you’d rather keep your workflows on GitHub Actions, Chainguard Actions replaces the actions they use with hardened equivalents, and Guardener’s Hardened Actions feature can migrate them for you.

GitHub on

Overview of Guardener on GitHub

Chainguard Checks overview

Getting started with Guardener

Get started with Chainguard Checks

Quick start

Managing Chainguard App connections

Guardener Dockerfile migration

Configuring Guardener

The .chainguard/ directory

Use Chainguard Checks on GitHub

Guardener Hardened Actions

Guardener Container Image Suggestions

Guardener Container Image Migration

Guardener Commit Verification

Migrate from GitHub Actions to Chainguard Checks

The `.chainguard/` directory