Chainguard Checks examples

Thu, 12 Nov 2026 14:46:46 +0000

This page gives complete Chainguard Checks configurations for common kinds of projects. Copy the one closest to your project, then change its packages, commands, and network access to match. Each example passes chainctl checks validate. For what each key does, refer to the Chainguard Checks configuration reference, and for services and caches, refer to Variations, inputs, services, and caches.

Keep the following in mind when you adapt an example:

A check reaches only the hosts in its network.egress list. If your build downloads from somewhere else, such as a private package registry, add that host. Refer to Find the hosts a check needs.
A cache does nothing until your default branch’s .chainguard/ci/identities.yaml file defines cache pools, as described in Set up cache pools. The examples that use caches also run after merging, with trigger: [presubmit, postsubmit], so that runs on your default branch fill the cache that pull requests start from.
Chainguard Workspaces sessions can use these files for their packages, but they don’t start services or mount caches other than gobuild. Refer to Configure a Chainguard Workspaces session’s environment.

Java with Maven

This file installs a JDK and Maven, and runs the build’s tests with mvn verify:

Examples on

Chainguard Checks examples

Java with Maven