Chainguard Actions overview

Thu, 18 Jun 2026 00:00:00 +0000

Chainguard Actions are a set of hardened drop-in replacements for popular GitHub Actions. Each action preserves the same inputs and outputs as the upstream version, but has been examined and revised to better protect your CI/CD pipelines from supply chain attacks. The only change in your workflow configuration is the name of the action in the uses: line.

Coverage spans GitHub first-party (actions/*), cloud-provider (aws-actions/*, azure/*, google-github-actions/*), Docker, HashiCorp, and security tools actions (Trivy, Grype, CodeQL, Semgrep), as well as a growing catalog of community actions.

Chainguard Actions telemetry and privacy

Thu, 16 Jul 2026 00:00:00 +0000

Every Chainguard hardened action runs a best-effort “phone-home” pre-hook that records a usage event to https://actions.enforce.dev/actions/v1/record. The hook is fire-and-forget, with a 2 second timeout that fails open, so it cannot break your build.

What we collect

What we collect depends on whether your workflow grants id-token: write:

Chainguard Actions on

Chainguard Actions overview

Chainguard Actions telemetry and privacy

What we collect