Chainguard introduced Chainguard Checks, a continuous verification engine designed to integrate continuous integration (CI) directly into AI-driven development workflows. Rather than waiting until code is submitted, the tool verifies software as it is being written. By enabling developers and AI agents to run consistent, signed verification checks through tool calls, Chainguard Checks delivers trusted results within seconds. The approach helps eliminate CI bottlenecks, reduce computing costs, and identify software supply chain risks before code reaches a pull request.
Waiting on CI is the new cost of AI development
AI agents are writing more code than ever, and CI has become the bottleneck. CI was built for developers who push code a few times a day. Agents iterate constantly, so every change lands in the same queue, and the faster they write code, the longer the queue gets. By the time results come back, the agent has lost the context it was working in, and teams are paying for the same setup work over and over.
The root problem is where CI sits: outside the development loop, after the work is done. Security adds another layer of complexity. Runners typically combine long-lived secrets with untrusted code, so a single prompt-injected agent or malicious install script can steal static keys straight from memory. Chainguard Checks removes this friction while making CI more secure.
“Agents shouldn’t just write code faster. They should be able to prove it works,” said Dan Lorenc, CEO and Co-founder, Chainguard. “We built Checks because our own engineers work alongside thousands of AI agents, and traditional CI was the slowest and least secure part of how we build. Now verification happens while the agent is still working, and every passing run comes with signed proof that travels with the code.”
Verification that happens where the work happens
Paired with the newly launched Chainguard Workspaces, an agent session suspends during check execution to halt compute consumption, then resumes in seconds with structured failure logs injected directly into its context to iterate until tests pass. Every passing run generates a signed attestation that travels with the code. Downstream merge gates can then verify attestation and merge the code immediately, without re-running the CI test suite, eliminating CI bottlenecks and saving compute spend.
Chainguard Checks includes:
- Warm snapshots: Every CI run starts from a warm snapshot with dependencies already installed. Snapshots are rebuilt whenever the lockfile changes, so the setup cost is paid once in the background instead of on every commit.
- Chainguard hardened, microVM execution environments: Each workflow step runs in its own hardware-isolated microVM environment built from zero-CVE Chainguard OS Packages, including FIPS-compliant toolchains, so untrusted code can’t reach other workloads.
- No credentials to steal: Runners hold no long-lived credentials. A host-side proxy adds short-lived credentials to outbound requests in flight, and tools that need a credential on disk get an encrypted, short-lived stand-in.
- Network access by approval only: Declarative egress policies block connections to unapproved endpoints and can be configured to automatically deny requests or destroy the microVM to prevent data exfiltration and unauthorized network access.
- Signed attestations: Every run produces a signed attestation tying together the environment, test result, and commit.
- Merge without re-running: Merge gates can verify the passing attestation and merge without running tests again, eliminating queue time and redundant compute spend.
“Banks, fintechs, and corporates across Australia rely on Cuscal to move money safely. As we expand our digital payments infrastructure, giving engineers fast, secure workflows for AI adoption is a top priority. For CI, agents are exposing the flaws in traditional systems, from broken security models that give runners ambient access to secrets to inefficiencies like cold setups and delayed post-commit validation. We’re excited to work hand-in-hand with Chainguard as an early design partner to shape the future of software development end-to-end,” said Brad McCoy, Senior Manager, Cloud Platforms, Cuscal.
“Existing CI pipeline platforms and tools are struggling under the massive increase in load generated by agentic software development, leading to downtime, lost developer productivity, and unshipped code,” James Governor, Analyst and Co-founder, RedMonk. ”Chainguard Checks is designed to enable true shift left security and assurance, while also preventing CI from being a bottleneck.”
For more information about Chainguard Checks, (available now in Beta) visit the website here. https://www.chainguard.dev/checks
Related News:
Chainguard Reaches 94% Coverage Across Python, Java, and JavaScript
Chainguard Container Images Surpass 500 Million Container Build Manifests
