Chainguard Checks

How Chainguard Checks and Chainguard Workspaces work together, and how to sign up for both with chainctl develop init and give teammates access.

Learn how Chainguard Checks runs your repository's CI checks in isolated microVMs on every GitHub pull request, with no network access unless a check asks for it.

Walk the whole loop of Chainguard Checks and Chainguard Workspaces: let Claude Code change a small Go project in a session, run the checks with run-ci, open a pull request, read a failing check with chainctl checks failures, and have Claude Code fix it.

The security model of Chainguard Checks and Chainguard Workspaces in one place: microVM isolation, credentials kept outside the VM, network allowlists, trust rings, and the run and session lifecycles.

Sign up for Chainguard Checks, add checks to one of your GitHub repositories, and see them run on a pull request.

Reference for the .chainguard/ci.yaml file that defines Chainguard Checks: file layouts, packages, commands, network access, conditions, triggers, resources, and environment variables.

Run a Chainguard Checks check once per variation, pass files between checks, check out another repository, start services such as a database or Docker, run checks as another user, and reuse Go build output with caches.