Repositories list

• actions

  Public
  A collection of reusable Github Actions workflows.

  TypeScript

  •

  Apache License 2.0

  •79•159•18•10•Updated Feb 27, 2026Feb 27, 2026

• image-comparison

  Public
  Comparison of Chainguard Images to others

  securitydatacontainers+ 1no-ghaudit-branch-protections

  HTML

  •

  Apache License 2.0

  •7•21•0•0•Updated Feb 27, 2026Feb 27, 2026

• terraform-provider-apko

  Public
  buildterraformterraform-provider+ 1container-image

  Go

  •

  Mozilla Public License 2.0

  •30•18•10•2•Updated Feb 27, 2026Feb 27, 2026

• vulnerability-scanner-support

  Public
  Resources to help vulnerability scanners

  Go

  •

  Apache License 2.0

  •12•11•0•3•Updated Feb 27, 2026Feb 27, 2026

• ghscan

  Public
  Scan GitHub Actions Workflow logs for IOCs

  iocworkflowscanner+ 9detectionlogssupply-chainactionssecretsgithub-actionssupply-chain-security+ 2

  Go

  •

  Apache License 2.0

  •2•16•0•2•Updated Feb 27, 2026Feb 27, 2026

• edu

  Public
  Docs and Tutorials for Chainguard

  SCSS

  •

  Other

  •107•90•23•10•Updated Feb 27, 2026Feb 27, 2026

• malcontent

  Public
  #supply #chain #attack #detection

  macoslinuxbinary+ 3reverse-engineeringmalware-analysisno-ghaudit-default-permissions

  YARA

  •

  Apache License 2.0

  •60•646•7•0•Updated Feb 27, 2026Feb 27, 2026

• terraform-provider-oci

  Public
  Terraform provider to perform OCI image operations

  terraformocicontainer-registry+ 1container-image

  Go

  •

  Mozilla Public License 2.0

  •19•15•6•3•Updated Feb 26, 2026Feb 26, 2026

• melange

  Public
  build APKs from source code

  Go

  •

  Apache License 2.0

  •169•571•161•76•Updated Feb 26, 2026Feb 26, 2026

• homebrew-tap

  Public
  Chainguard Homebrew Tap

  homebrewtaphomebrew-formula+ 3homebrew-tapchainguardno-ghaudit-branch-protections

  Ruby

  •

  Apache License 2.0

  •11•5•0•1•Updated Feb 26, 2026Feb 26, 2026

• yam

  Public
  A sweet little formatter for YAML

  Go

  •

  Apache License 2.0

  •17•34•7•2•Updated Feb 26, 2026Feb 26, 2026

• terraform-provider-imagetest

  Public
  Go

  •

  Mozilla Public License 2.0

  •29•5•3•4•Updated Feb 26, 2026Feb 26, 2026

• omnibump

  Public
  Universal declarative depenency bump tool

  gogradlemaven+ 1cargo

  Go

  •

  Apache License 2.0

  •2•1•0•6•Updated Feb 26, 2026Feb 26, 2026

• terraform-infra-common

  Public
  A repository containing a collection of "glue" modules for encapsulating common Cloud Run patterns.

  Go

  •

  Apache License 2.0

  •42•28•22•0•Updated Feb 26, 2026Feb 26, 2026

• tw

  Public
  Go

  •32•0•6•11•Updated Feb 26, 2026Feb 26, 2026

• cargobump

  Public
  Rust tool to declaratively bump dependencies using cargo

  Go

  •

  Apache License 2.0

  •8•3•0•0•Updated Feb 26, 2026Feb 26, 2026

• apko

  Public
  Build OCI images from APK packages directly without Dockerfile

  dockercontainersoci

  Go

  •

  Apache License 2.0

  •206•1.6k•87•45•Updated Feb 26, 2026Feb 26, 2026

• terraform-provider-chainguard

  Public
  Go

  •

  Apache License 2.0

  •27•1•5•2•Updated Feb 26, 2026Feb 26, 2026

• ghaudit

  Public
  A simple CLI tool for checking GitHub organization and repository administration policies.

  Go

  •

  Apache License 2.0

  •7•9•3•0•Updated Feb 26, 2026Feb 26, 2026

• terraform-provider-cosign

  Public
  Terraform provider for Sigstore Cosign

  Go

  •

  Mozilla Public License 2.0

  •17•12•4•3•Updated Feb 26, 2026Feb 26, 2026

• rules_apko

  Public
  Bazel rules for apko

  apkbazelbazel-rules+ 1no-ghaudit-default-permissions

  Starlark

  •

  Apache License 2.0

  •31•33•3•1•Updated Feb 26, 2026Feb 26, 2026

• bazel-central-registry

  Public
  The central registry of Bazel modules for the Bzlmod external dependency system.

  no-ghaudit-branch-protections

  Starlark

  •

  Apache License 2.0

  •681•0•0•0•Updated Feb 26, 2026Feb 26, 2026

• terraform-provider-helm

  Public
  Go

  •

  Apache License 2.0

  •5•0•0•1•Updated Feb 25, 2026Feb 25, 2026

• malcontent-action

  Public
  Run malcontent security scanner on pull requests to detect malicious behavior changes between commits

  JavaScript

  •7•10•0•2•Updated Feb 25, 2026Feb 25, 2026

• stigs

  Public
  HTML

  •

  Apache License 2.0

  •9•20•0•0•Updated Feb 25, 2026Feb 25, 2026

• incert

  Public
  Add CA certificates into containers

  golangcontainerca-certificates

  Go

  •

  Apache License 2.0

  •24•166•6•0•Updated Feb 24, 2026Feb 24, 2026

• .github

  Public
  Default files to be used for any public repository under the chainguard-dev organization.

  Apache License 2.0

  •22•3•0•2•Updated Feb 23, 2026Feb 23, 2026

• exitdir

  Public
  Common packages.

  Go

  •

  Apache License 2.0

  •5•8•0•0•Updated Feb 23, 2026Feb 23, 2026

• cgr-compliance

  Public
  Generate CVE related POA&Ms and FedRAMP KSIs

  nistcompliancefedramp

  Shell

  •

  Apache License 2.0

  •1•0•0•0•Updated Feb 23, 2026Feb 23, 2026

• sdk

  Public
  Public SDK for integrating with the Chainguard platform

  audit

  Go

  •

  Apache License 2.0

  •21•1•1•0•Updated Feb 20, 2026Feb 20, 2026