Chainguard Actions

Chainguard is a software supply-chain security company that provides trusted open-source artifacts for containers, language libraries, VM images, CI/CD actions, and AI agent skills. Its artifacts are rebuilt from source, include verified manifests, provenance and software bills of materials, and are designed to replace vulnerable or malicious public packages. Chainguard also offers CVE backports, hardened actions and community skills, sandbox-based package analysis for suspicious behavior, Helm charts, and an agent called Guardener. Its container service includes rapid remediation commitments, including a one-day SLA for known exploited vulnerabilities; the videos also describe a minimal rolling Linux distribution with 1-, 7-, and 14-day remediation SLAs. The company is associated with the creators of Kubernetes, Sigstore, SLSA, and Google Distroless.

Chainguard Agent Skills is a Chainguard service for distributing hardened versions of third-party AI-agent skills. Chainguard processes upstream skills through deterministic and agentic hardening steps; organizations can also submit their own skills for hardening and internal sharing. Chainguard’s homepage describes the offering as a collection of more than 1,000 hardened community skills intended to protect against malicious instructions.

Chainguard Containers are hardened container images from Chainguard, built from source and rebuilt daily. The images include verified manifests and provenance information, attached software bills of materials, and vulnerability remediation commitments; Chainguard says its catalog contains more than 3,000 images with substantially fewer CVEs than public alternatives. The images are distributed through Chainguard's registry and are intended to reduce the vulnerability and malware exposure of containerized applications.

Chainguard Libraries is a trusted catalog of language dependencies for Python, Java, JavaScript, Go, and .NET. It provides replacement repositories for public package registries such as PyPI, npm, and Maven Central; Chainguard takes upstream source, builds and scans the resulting artifacts, and serves them for use instead of relying on live access to public registries. Chainguard says its packages are detonated in a sandbox to identify suspicious behavior and are supplied as hardened artifacts intended to reduce malware and vulnerability risk in software dependencies. The service is developed and hosted by Chainguard.

A CI/CD and automation platform from GitHub (Microsoft) that runs YAML-defined workflows in response to repository events, schedules, or API calls. Workflows orchestrate jobs on GitHub-hosted or self-hosted runners (Ubuntu, Windows, macOS or custom runners), invoke container, JavaScript or composite actions, and produce artifacts (build outputs, test reports, generated files). It supports secrets, caching, matrix and reusable workflows, the Actions Marketplace, and can run arbitrary CLI tools (for example, invoking a D2 CLI in a workflow to generate architecture diagrams from D2 source files).