# octo sts

Octo STS is a GitHub App that acts as a Security Token Service for the GitHub API, allowing workloads to exchange OIDC tokens for short-lived GitHub credentials.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Running Renovate as a GitHub Action (and NO PAT!)

DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)](<https://devfeed.tech/articles/running-renovate-as-a-github-action-and-no-pat-13214.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/running-renovate-as-a-github-action>)

Published: 2026-01-19T00:00:00Z

Content type: tutorial

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [renovate](<https://devfeed.tech/topics/renovate.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [octo sts](<https://devfeed.tech/topics/octo-sts.md>), [github personal access token](<https://devfeed.tech/topics/github-personal-access-token.md>), [Security](<https://devfeed.tech/topics/security.md>), [maintenance](<https://devfeed.tech/topics/maintenance.md>)

Tags: [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [dependabot](<https://devfeed.tech/tags/dependabot.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [github](<https://devfeed.tech/tags/github.md>), [github-action](<https://devfeed.tech/tags/github-action.md>), [github-pat-alternative](<https://devfeed.tech/tags/github-pat-alternative.md>), [guide](<https://devfeed.tech/tags/guide.md>), [maintenance](<https://devfeed.tech/tags/maintenance.md>), [octo-sts](<https://devfeed.tech/tags/octo-sts.md>), [personal-access-token](<https://devfeed.tech/tags/personal-access-token.md>), [renovate](<https://devfeed.tech/tags/renovate.md>), [run](<https://devfeed.tech/tags/run.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>)

### AI overview

This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup.

### Source excerpt

Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS.

## Open sourcing Octo STS

DevFeed: [Open sourcing Octo STS](<https://devfeed.tech/articles/open-sourcing-octo-sts-13197.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/open-sourcing-octo-sts>)

Published: 2024-05-02T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [octo sts](<https://devfeed.tech/topics/octo-sts.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>)

Tags: [announce](<https://devfeed.tech/tags/announce.md>), [credential-leak](<https://devfeed.tech/tags/credential-leak.md>), [github](<https://devfeed.tech/tags/github.md>), [github-credentials](<https://devfeed.tech/tags/github-credentials.md>), [github-vulnerability](<https://devfeed.tech/tags/github-vulnerability.md>), [octo-sts](<https://devfeed.tech/tags/octo-sts.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [security-best-practices](<https://devfeed.tech/tags/security-best-practices.md>), [security-token-service](<https://devfeed.tech/tags/security-token-service.md>), [source](<https://devfeed.tech/tags/source.md>)

### AI overview

Chainguard announces the open sourcing of Octo STS, a GitHub Security Token Service designed to exchange short-lived third-party tokens for short-lived first-party tokens. The repository includes its source code and the infrastructure as code used to deploy and monitor it, enabling teams to inspect, host, and manage their own instance.

### Source excerpt

Open Source Octo STS Released -- Chainguard's solution to eliminate long-lived GitHub credentials. Improve security, collaborate, get updates.

## Replacing Long-Lived GitHub Personal Access Tokens with Short-Lived Credentials Using Octo STS

DevFeed: [Replacing Long-Lived GitHub Personal Access Tokens with Short-Lived Credentials Using Octo STS](<https://devfeed.tech/articles/the-end-of-github-pats-you-can-t-leak-what-you-don-t-have-13250.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/the-end-of-github-pats-you-cant-leak-what-you-dont-have>)

Published: 2024-04-11T00:00:00Z

Content type: tutorial

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Security](<https://devfeed.tech/topics/security.md>), [octo sts](<https://devfeed.tech/topics/octo-sts.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>)

Tags: [ephemerality](<https://devfeed.tech/tags/ephemerality.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [github-credentials](<https://devfeed.tech/tags/github-credentials.md>), [github-pat](<https://devfeed.tech/tags/github-pat.md>), [github-personal-access-token](<https://devfeed.tech/tags/github-personal-access-token.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [minimalism](<https://devfeed.tech/tags/minimalism.md>), [octo-sts](<https://devfeed.tech/tags/octo-sts.md>), [personal-access-token](<https://devfeed.tech/tags/personal-access-token.md>), [principle-of-ephemerality](<https://devfeed.tech/tags/principle-of-ephemerality.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [rotation](<https://devfeed.tech/tags/rotation.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [security-token-service](<https://devfeed.tech/tags/security-token-service.md>)

### AI overview

This article explains how Chainguard replaced long-lived GitHub Personal Access Tokens and other credentials with short-lived credentials across several GitHub organizations. It introduces Octo STS as a Security Token Service for GitHub credentials and describes the automation use cases that built-in GitHub Actions tokens could not support.

### Source excerpt

Ditch GitHub PATs for better security. Learn how to replace long-lived tokens and reduce your risk of leaked credentials.