Overview of Guardener on GitHub

Guardener’s GitHub capabilities run through the Chainguard App, a single hardened GitHub App that also backs other Chainguard products. Those capabilities are opt-in per repository through configuration files committed to a .chainguard/ directory, so installing the app has no effect on a repository until you enable a capability.

Note: Guardener is in beta. Available to organizations that have installed and linked the Chainguard App.

Getting set up

• Getting started — Install the Chainguard App and link your Chainguard organization to your GitHub organization.
• App connections — Set up, inspect, and remove the connections between your Chainguard organization and your GitHub organizations.
• Configuration — Understand the .chainguard/ configuration model that all of Guardener’s GitHub capabilities share.

Capabilities

• Hardened Actions — Recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents, through non-blocking pull request review comments or automated migration pull requests. Migration pull requests run on a schedule and can also be triggered on demand with chainctl.
• Container Image Suggestions — Recommends Chainguard container images for the container images a pull request adds or changes, through non-blocking review comments with one-click suggested changes where possible.
• Container Image Migration — Replaces the container images a repository already uses with Chainguard container images through a migration pull request. Migration runs on a schedule and can also be triggered on demand with chainctl.
• Commit Verification — Enforces cryptographically signed commits against a policy you control, supporting both keyless (Sigstore) signatures and static keys such as GPG.

Each capability is configured with its own file in the .chainguard/ directory.

Note: For Dockerfile migration, which runs locally through chainctl agent dockerfile rather than the Chainguard App, refer to Dockerfile migration.