Chainguard Guardener GitHub App

Mon, 13 Jul 2026 00:00:00 +0000

The Chainguard Guardener GitHub App is a single, hardened bot that runs against your repositories. Its capabilities are opt-in per repository through configuration files committed to a .chainguard/ directory, so installing the app has no effect on a repository until you enable a capability.

Note: Chainguard Guardener is in beta. Available to organizations that have installed and linked the Chainguard Guardener GitHub App.

Getting set up

Getting started — Install the GitHub App and link your Chainguard organization to your GitHub organization.
Configuration — Understand the .chainguard/ configuration model that all the GitHub App capabilities share.

Capabilities

Hardened Actions — Recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents, either through non-blocking pull request review comments or automated migration pull requests.
Commit Verification — Enforces cryptographically signed commits against a policy you control, supporting both keyless (Sigstore) signatures and static keys such as GPG.

Each capability is configured with its own file in the .chainguard/ directory.

Chainguard Guardener Dockerfile Migration

Mon, 13 Jul 2026 00:00:00 +0000

The Dockerfile migration feature converts your Dockerfiles to use Chainguard Containers. It uses AI to iteratively translate instructions, build images, compare results, and fix issues until the migrated Dockerfile works as expected.

Unlike the Guardener’s Hardened Actions and Commit Verification features, Dockerfile migration does not run through the GitHub App or the .chainguard/ configuration directory. Instead, you drive it locally through chainctl agent dockerfile commands. The AI runs server-side and scans your workspace to perform its analysis, while Docker builds and file access remain local to your machine.

Chainguard Guardener on

Chainguard Guardener GitHub App

Getting set up

Capabilities

Chainguard Guardener Dockerfile Migration