Chainguard

Chainguard's GitHub App connects your repositories to the Chainguard platform. It runs your CI in secure microVMs, gives you and your coding agents disposable cloud development environments, and helps keep your workflows and commits secure.

Installing the app does nothing on its own. Each feature is opted in to separately, so you adopt only what you need.

🧪 Technology Preview: Chainguard Checks and Chainguard Workspaces are Technology Previews. Features and configuration may change. We'd love your feedback at support@chainguard.dev.

Get started in one command

chainctl develop init

This command signs you in, creates a Chainguard organization if you don't have one, links your GitHub account through this app, and turns on Checks and Workspaces with a monthly compute allowance on the Starter plan. If the app isn't installed yet, chainctl gives you the install link.

Don't have chainctl? Install it here.

Features

✅ Chainguard Checks: secure, hosted CI

Run your pull request checks on Chainguard's infrastructure. Each check runs in its own isolated microVM, built from Chainguard packages, with network egress denied by default. Results come back as native GitHub check runs.

• Declarative config. Define checks in .chainguard/ci.yaml, with no shell scripting or expression language.
• Default-deny network. A check can reach only the hosts you list.
• Native GitHub integration. Each pull request gets per-check results plus one aggregate Chainguard Checks (presubmit) check that you can require in branch protection.
• Run on demand. Mark expensive checks when: {requested: true} and trigger them with a ci/run:<check> label. Mark non-blocking checks advisory: true.
• Migrate from GitHub Actions. chainctl checks migrate drafts a Checks config from your existing Actions presubmits and proves it on the platform.
• Debug from the CLI. chainctl checks status, logs, failures, and trace show you why a check failed.

Opting in: commit a .chainguard/ci.yaml to a repository the app is installed on, and open a pull request.

version: 1
environment:
  packages: [go]
checks:
  build:
    network:
      egress: [proxy.golang.org, sum.golang.org]
    steps:
      - name: compile
        cmd: [go, build, ./...]
      - name: test
        cmd: [go, test, ./...]

Run chainctl checks validate in your checkout to lint the config before you push.

💻 Chainguard Workspaces: cloud dev environments for you and your agents

Open a resident development session on any repository in a disposable microVM. Your working tree, including unpushed changes, syncs in when you attach. The session parks when you go idle and resumes where you left off.

• Built for coding agents. Run Claude Code, Codex, and other agents in an isolated VM, away from your laptop.
• No credentials in the VM. GitHub, Chainguard registries, and model APIs are reached through a host-side broker. No tokens or keys are ever stored in the session.
• You approve access. A session starts with narrow defaults. Anything beyond them is asked about once, and you can review or revoke it with chainctl develop creds.
• Same environment as CI. A workspace builds its environment from the repository's .chainguard/ci.yaml. chainctl develop check runs your Checks inside the session before you push.

chainctl develop            # open (or reattach to) a session for the current checkout
chainctl develop check      # run the repository's checks inside the session

To have git and gh in a workspace act as your own GitHub account, connect it with chainctl develop github login. This uses the companion Chainguard Develop app.

🔧 Actions: secure your GitHub Actions

Recommends Chainguard's hardened, SHA-pinned equivalents for the upstream actions you use, and can migrate them for you:

• Pull request recommendations. When a PR changes a workflow under .github/workflows/, the app posts a non-blocking review comment with a one-click suggestion.
• Automated migration PRs. The app maintains a single PR that migrates upstream actions across your workflows, on a cadence you choose. It respects your ignore lists and keeps your existing pins.

Opting in: commit a .chainguard/actions.yaml to the root of your repository.

🔒 Commit verification: enforce signed commits

Verifies that every commit in a pull request is signed by an authorized signer, using a policy you control, and reports the result as a GitHub check run. It supports keyless Sigstore/gitsign signatures and static keys, including GitHub's web-flow key.

Opting in: commit a .chainguard/source.yaml policy to the root of your repository.

Permissions

The app requests only the access its features need:

If a new feature needs more access, we'll request it and document it here.

Learn more

• 📖 Documentation: edu.chainguard.dev
• 🌐 Product: chainguard.dev
• ✉️ Support & feedback: support@chainguard.dev

Use of Chainguard Checks is subject to the Code Analysis Terms. Use of Chainguard Workspaces is subject to the Secured Platform Terms.