Chainguard Guardener

Chainguard Guardener is a tool for managing and hardening your source code. Rather than adding a separate integration for every task, the Guardener provides a growing suite of capabilities that you opt into independently. Some capabilities run through a hardened GitHub App and are configured per repository through files committed to your codebase; others, such as Dockerfile migration, run locally through chainctl.

Note: Chainguard Guardener is in beta. Available to organizations that have installed and linked the Chainguard Guardener GitHub App.

The Guardener’s capabilities fall into two groups:

• GitHub App — Capabilities that run through the Guardener GitHub App and are enabled per repository with .chainguard/ configuration files:
  • Hardened Actions — Recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents, either through non-blocking pull request review comments or automated migration pull requests.
  • Commit Verification — Enforces cryptographically signed commits against a policy you control, supporting both keyless (Sigstore) signatures and static keys such as GPG.
• Dockerfile migration — Uses AI to iteratively convert your Dockerfiles to Chainguard Containers. This capability runs locally through chainctl agent dockerfile commands.

Additional capabilities will be added over time, each with its own opt-in configuration.

Where to start

• GitHub App — Install the app, link your organization, and configure the GitHub App capabilities (Hardened Actions and Commit Verification):
  • Getting started — Install the GitHub App and link your Chainguard organization to your GitHub organization.
  • Configuration — Understand the .chainguard/ configuration model and how features are enabled per repository.
• Dockerfile migration — Migrate your Dockerfiles to Chainguard Containers using the chainctl agent dockerfile commands.

Support

For questions or feedback, contact your Chainguard account team or email support@chainguard.dev.