Set up and use Octo STS

Fri, 02 Oct 2026 13:51:55 +0000

Octo STS is a GitHub App that exchanges OIDC tokens from your workloads for short-lived GitHub tokens, so your automation doesn’t need personal access tokens (PATs). This page shows you how to install Octo STS, write trust policies, exchange tokens, and fix failed exchanges. For background on why Octo STS exists, read Octo STS: Short-lived GitHub tokens without PATs in Supply Chain Security 101.

How the token exchange works

Octo STS issues tokens according to trust policies that you keep in your repositories:

Updating container images with Renovate (and no PATs!)

Tue, 23 Dec 2025 09:30:00 +0100

In this video, Developer Relations Engineer Adrian Mouat shows you how you can update container images using Renovate with Octo STS, eliminating the need for GitHub Personal Access Tokens.

Video

What you’ll learn

How to set up Renovate as a GitHub Action
Using Octo STS to eliminate Personal Access Tokens
Configuring trust policies for automated workflows
Setting up assumable identities for private registries
Automating container image and GitHub Actions updates

Transcript

In this video, I’m going to show you how you can use Renovate to update container images and GitHub actions. At Chainguard, we do talk a lot about the need to keep software up to date. And in my opinion, it’s essential you do that for both security and maintainability. So, if you stay on an old version of a package for too long, there’s a strong chance that you’ll be bitten by an unpatched vulnerability. But also, the longer you stay on an old version, the harder updating becomes. So, it’s much better to do frequent small updates than it is to occasionally be forced into having to do major breaking updates.

Octo-Sts on

Set up and use Octo STS

How the token exchange works

Updating container images with Renovate (and no PATs!)

Video

What you’ll learn

Transcript