octo-sts/Octo STS
This action exchanges the workflow's identity token for a Github App token from the Octo STS service, in accordance with the trust policy of the target organization or repository.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| domain | The domain of the Octo STS instance to use to federate. | — | octo-sts.dev |
| scheme | URL scheme used to reach the Octo STS instance: 'https' (default) or 'http'. Use 'http' ONLY for a self-hosted broker on a trusted network — e.g. a ClusterIP Service reached in-cluster and restricted by NetworkPolicy, where TLS is intentionally not terminated. Never use 'http' over an untrusted network: the request carries the OIDC token and the response carries the minted GitHub token. | — | https |
| scope | The org/repo of the repository to which to request access. | yes | — |
| identity | The name of the trust policy to load from the target repository. The trust policy is loaded from https://github.com/{scope} from the file .github/chainguard/{identity}.sts.yaml | yes | — |
Outputs
| name | description |
|---|---|
| token | The federated token to use for authentication. |