Guardener GitHub App on

Getting started with Guardener

Wed, 08 Jul 2026 00:00:00 +0000

This guide walks you through everything you need to start using Guardener on your GitHub repositories:

Install the Guardener GitHub App on your GitHub organization.
Link your Chainguard organization to your GitHub organization.
Verify the link and enable your first feature.

Once the app is installed, Guardener can respond on your public repositories. Linking connects that activity to your Chainguard organization and unlocks the features that require one, such as private repository coverage — there is no separate entitlement step.

Managing GitHub App connections

Mon, 03 Aug 2026 00:00:00 +0000

Guardener acts on your GitHub repositories on behalf of your Chainguard organization. The bridge between the two is a connection: a Guardener GitHub App installation on a GitHub organization, linked to a Chainguard organization. This page explains how connections work and how to set up, inspect, change, and remove them.

For a first-time walkthrough, refer to Getting started. This page is the fuller reference for managing connections over time.

Note: Guardener is in beta. Available to organizations that have installed and linked the Guardener GitHub App.

Configuring Guardener

Wed, 08 Jul 2026 00:00:00 +0000

Guardener is configured entirely through files committed to a .chainguard/ directory — either in each repository, or once at the organization level in your .github repository. This page explains the configuration model that all Guardener features share. For the specific options of each feature, refer to its dedicated page.

The `.chainguard/` directory

Guardener reads its configuration from the .chainguard/ directory at the root of each repository. Every feature has its own file:

Guardener Hardened Actions

Wed, 08 Jul 2026 00:00:00 +0000

The Hardened Actions feature recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents. Pinning actions to a specific commit SHA — rather than a mutable tag or branch — protects your workflows from supply chain attacks in which an upstream tag is moved to point at malicious code.

Hardened Actions operates in two independent modes:

Pull request recommendations — non-blocking review comments that suggest hardened action alternatives, with one-click suggestion blocks.
Automated migration pull requests — a periodically maintained pull request that updates workflows across your repository. You can also trigger this migration on demand with chainctl instead of waiting for the next scheduled run.

You can enable either mode on its own or both together.

Guardener container image suggestions

Fri, 02 Oct 2026 00:00:00 +0000

The container image suggestions feature reviews pull requests that add or change container image references, and recommends the Chainguard Container that replaces each upstream image. Where it can, Guardener includes the replacement as a one-click suggested change.

Note: Guardener is in beta. Available to organizations that have installed and linked the Guardener GitHub App.

Image suggestions catch upstream images as they are introduced. They don’t review the images a repository already uses: only the lines a pull request adds or changes are read. To find replacements for every image in a repository, run chainctl images discover.

Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.

Guardener GitHub App on

Getting started with Guardener

Managing GitHub App connections

Configuring Guardener

The .chainguard/ directory

Guardener Hardened Actions

Guardener container image suggestions

Guardener Commit Verification

The `.chainguard/` directory