[tylerpaxton]

What

This updates the Chainguard Checks pages for two changes to chainctl checks and the Checks platform, and for one limit that remains:

• chainctl checks list lists your organization's pull request runs and runs after merging, not just the runs you started with chainctl checks run.
• The commands that read runs find a run by a directory or a commit SHA.
• During the beta, you still can't rerun checks after merging, either with Re-run on GitHub or with chainctl checks rerun. The pages now say what you see when you try.

Why

The pages still said "these never find your repositories' runs" and that chainctl checks list shows only your own runs. Readers who followed them would skip commands that work. The pages also didn't say that Re-run on a postsubmit check leaves it queued, so readers would wait for a run that never starts.

Stacked on #4271

This branch is stacked on #4271. Merge it after #4271 merges.

Changes by page

• chainctl checks command reference
  • Name a run: adds the directory and commit SHA forms of REF, and explains run ID prefixes, including the post- prefix of runs after merging. Says that a pull request run or a run after merging from October 16, 2026, or earlier needs its whole ID, which only the commands that read runs accept. Explains which commit to pass to find a pull request's runs.
  • chainctl checks list: describes the runs it lists, the --ref and --trigger flags, the output columns, and the JSON fields. Notes that COMMIT is a short SHA, and that runs started with chainctl checks run have - under REF and PR.
  • chainctl checks rerun: REF can now be a directory, a commit SHA, or a run ID, as long as it names a pull request's run. Quotes the error the command prints for a run after merging, and documents --watch and the JSON output.
  • chainctl checks cancel: after you cancel a run, says how to run a pull request's checks again, and how to run checks after merging again.
• Use Chainguard Checks on GitHub: says that Re-run on Chainguard Checks (postsubmit) shows the check as queued, but no run starts and the check stays queued. Also says that chainctl checks rerun fails for runs after merging.
• Inspect and run checks with chainctl: adds the directory and commit SHA forms, and explains how to find the runs you started in chainctl checks list.
• Workload identities and trust: reads the repository ID from a pull request or from a commit that ran checks after merging, because . returns no ID when the commit has no run. The example now passes --parent, so chainctl doesn't prompt for an organization in the middle of the pipe.
• Troubleshoot Chainguard Checks: lists when a lookup by commit finds no run, including the earlier commits that a merge commit brings in. Links to the reference instead of repeating it.

How it was checked

• Compared every claim with the chainctl 0.2.388 source, whose checks code matches 0.2.386, the documented minimum version. Also compared it with the Checks server code deployed today.
• Live tests of reruns after merging:
  • chainctl checks rerun on a run after merging failed with cannot rerun: ... is neither a postsubmit Run nor a pull request's.
  • Re-run on Chainguard Checks (postsubmit) marked the check as queued on GitHub. Five minutes later, no run had started, and the check was still queued.
• Ran read-only chainctl checks list and chainctl checks status commands against a test organization. They confirmed the documented columns and JSON fields, and that pull request runs from October 7 and 8 aren't listed. status found a run after merging by its full commit SHA and by a post- prefix of its ID, and printed the Repo ID: line.
• Ran the repository's pre-commit hooks and markdownlint-cli2 0.23.3 on the changed files. Both pass.
• Confirmed that all internal links and anchors on the changed pages resolve.

For reviewers

• The pages don't say what TRIGGER shows for a run started with chainctl checks run, because it depends on when the run started. Runs from before a server change deployed on October 20, 2026, show -, which a read-only chainctl checks list confirmed for runs from October 14 and 15. In the chainctl 0.2.388 code, newer runs of this kind show presubmit, but --trigger presubmit doesn't list them. This wasn't tested live, because no newer run of this kind was available and starting one creates a run in production.
• In chainctl 0.2.388, chainctl checks rerun --help says the command reruns a finished postsubmit run, but the server refuses these runs. The pages document what happens today. If reruns after merging start working, the rerun paragraphs on the reference and GitHub pages need an update.
• Runs created before about 17:00 UTC on October 16, 2026, aren't in the newer format. The pages say "October 16, 2026, or earlier" to cover that whole day.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
chainguard-docs-preview	Ready	Preview	Oct 21, 2026 12:21am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
chainguard-docs	Ignored		Oct 21, 2026 12:21am UTC