Octo-Sts on

Octo STS Overview

Tue, 23 Dec 2025 15:04:05 +0100

Octo STS is a GitHub App developed by Chainguard that acts as a Security Token Service (STS) for the GitHub API. It enables workloads running anywhere that can produce OIDC tokens to federate with GitHub, exchanging those tokens for short-lived GitHub access tokens. The primary goal is to eliminate the need for GitHub Personal Access Tokens (PATs), which are long-lived credentials that pose significant security risks.

Why Octo STS Matters

Long-lived access tokens are a common target in security incidents. When attackers gain access to a PAT, they can exploit it to access repositories, make changes, and pivot to other resources. These tokens often have broad permissions and no expiration date, making them particularly dangerous if compromised.

Octo STS FAQ

Mon, 22 Dec 2025 15:04:05 +0100

This page answers frequently asked questions about Octo STS, including setup, security, troubleshooting, and common use cases.

General Questions

What is Octo STS?

Octo STS is a GitHub App developed by Chainguard that acts as a Security Token Service for GitHub. It allows workloads with OIDC tokens from various identity providers (GitHub Actions, cloud providers, Kubernetes, etc.) to exchange those tokens for short-lived GitHub access tokens. The primary goal is to eliminate the need for long-lived Personal Access Tokens (PATs).

Updating Container Images with Renovate (and no PATs!)

Tue, 23 Dec 2025 09:30:00 +0100

In this video, Developer Relations Engineer Adrian Mouat shows you how you can update container images using Renovate with Octo STS, eliminating the need for GitHub Personal Access Tokens.

Video

What You’ll Learn

How to set up Renovate as a GitHub Action
Using Octo STS to eliminate Personal Access Tokens
Configuring trust policies for automated workflows
Setting up assumable identities for private registries
Automating container image and GitHub Actions updates

Transcript

In this video, I’m going to show you how you can use Renovate to update container images and GitHub actions. At Chainguard, we do talk a lot about the need to keep software up to date. And in my opinion, it’s essential you do that for both security and maintainability. So, if you stay on an old version of a package for too long, there’s a strong chance that you’ll be bitten by an unpatched vulnerability. But also, the longer you stay on an old version, the harder updating becomes. So, it’s much better to do frequent small updates than it is to occasionally be forced into having to do major breaking updates.