Chainguard installs statistics

Guardener is Chainguard's GitHub automation app — a single, hardened bot that helps secure and maintain your repositories. It hosts a growing suite of features, each opted in to independently, so you adopt only what you need.

Learn more at https://www.chainguard.dev/guardener.

⚠️ Beta: Guardener is in beta. Its features and configuration may change, and you may encounter rough edges. We'd love your feedback — reach out at support@chainguard.dev.

Getting started

Guardener is configured per-repository through files under the .chainguard/ directory. Each feature has its own config file, so installing the app does nothing until you opt a repository in.

More features are on the way.

Features

🔧 Actions — secure your GitHub Actions

Keeps your GitHub Actions secure and up to date by recommending and migrating upstream actions to Chainguard's hardened, SHA-pinned equivalents. It works in two complementary modes:

🔍 Pull request recommendations. When a PR changes a workflow under .github/workflows/, Guardener detects newly added uses: references and posts a non-blocking review comment with a one-click ```suggestion block recommending the hardened equivalent — SHA-pinned with the version in a trailing comment, following GitHub's action-pinning best practice:

uses: chainguard-actions/actions-checkout@<sha> # v6

🤖 Automated migration PRs. For repositories that opt in, Guardener periodically opens and maintains a single migration pull request replacing upstream actions across all your workflows. It preserves your existing pins, summarizes every change (and anything it couldn't migrate) in the PR body, respects your ignore lists, and runs on a cadence you control.

Support & feedback

Questions, bug reports, and feature requests are welcome at support@chainguard.dev.

Description from the GitHub Marketplace listing.