Managing tag-based Custom Assembly with Terraform

Mon, 28 Sep 2026 16:33:22 +0000

Note: Tag-based Custom Assembly is in beta. Contact your Chainguard account team to enable it for your organization.

This guide shows how to manage tag-based Custom Assembly with the Chainguard Terraform provider. You define overlays with the chainguard_image_overlay resource and bind them to repositories with the chainguard_image_overlay_binding resource.

For an explanation of overlays, bindings, and tag selectors, see Overview of tag-based Custom Assembly.

Prerequisites

Before you start, you need the following:

Guardener Hardened Actions

Wed, 08 Jul 2026 00:00:00 +0000

The Hardened Actions feature recommends and migrates your GitHub Actions to Chainguard’s hardened, SHA-pinned equivalents. Pinning actions to a specific commit SHA — rather than a mutable tag or branch — protects your workflows from supply chain attacks in which an upstream tag is moved to point at malicious code.

Hardened Actions operates in two independent modes:

Pull request recommendations — non-blocking review comments that suggest hardened action alternatives, with one-click suggestion blocks.
Automated migration pull requests — a periodically maintained pull request that updates workflows across your repository. You can also trigger this migration on demand with chainctl instead of waiting for the next scheduled run.

You can enable either mode on its own or both together.

Automation on

Managing tag-based Custom Assembly with Terraform

Prerequisites

Guardener Hardened Actions