Chainguard Guardener on

Getting Started with Chainguard Guardener

Wed, 08 Jul 2026 00:00:00 +0000

This guide walks you through everything you need to start using Chainguard Guardener on your GitHub repositories:

Install the Guardener GitHub App on your GitHub organization.
Link your Chainguard organization to your GitHub organization.
Verify the link and enable your first feature.

Linking your Chainguard organization to your GitHub organization is what entitles you to use the Guardener — there is no separate entitlement step.

Note: Chainguard Guardener is in beta. Available to organizations that have installed and linked the Chainguard Guardener GitHub App.

Configuring Chainguard Guardener

Wed, 08 Jul 2026 00:00:00 +0000

Chainguard Guardener is configured entirely through files committed to the .chainguard/ directory in each repository. This page explains the configuration model that all the Guardener features share. For the specific options of each feature, see its dedicated page.

The `.chainguard/` directory

The Guardener reads its configuration from the .chainguard/ directory at the root of each repository. Every feature has its own file:

Chainguard Guardener Actions Security

Wed, 08 Jul 2026 00:00:00 +0000

The Actions Security feature recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents. Pinning actions to a specific commit SHA — rather than a mutable tag or branch — protects your workflows from supply chain attacks in which an upstream tag is moved to point at malicious code.

Actions Security operates in two independent modes:

Pull request recommendations — non-blocking review comments that suggest hardened action alternatives, with one-click suggestion blocks.
Automated migration pull requests — a periodically maintained pull request that updates workflows across your repository.

You can enable either mode on its own or both together.

Chainguard Guardener Commit Verification

Wed, 08 Jul 2026 00:00:00 +0000

The Commit Verification feature verifies that every commit in a pull request is cryptographically signed by an authorized signer, according to a policy you control. This ensures that changes to your codebase come from identities you trust, and it supports both keyless (Sigstore) signatures and static keys such as GPG.

Keyless commit signatures are verified using gitsign and Sigstore. Static key authorities (such as GPG) are verified directly against the key material you supply, without gitsign.

Chainguard Guardener on

Getting Started with Chainguard Guardener

Configuring Chainguard Guardener

The .chainguard/ directory

Chainguard Guardener Actions Security

Chainguard Guardener Commit Verification

The `.chainguard/` directory