Repository navigation
Add octo-sts GitHub App #1319
Description
When making PRs with GitHub Actions, those don't trigger the usual GitHub CI (https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow#triggering-a-workflow-from-a-workflow). This can become very annoying if you want to have automated PRs (like lockfile updates, etc).
There are a couple of ways to ship around this limitation like long-lived PATs, SSH deploy keys or GitHub apps.
Octo-STS (by Chainguard) is another solution for this. They install a GitHub app that has write permissions into a repository/organization and let you define in your repository which repos/branches should have permission to access this repo (example: https://github.com/pavelzw/skill-forge/blob/main/.github/chainguard/write.sts.yaml only pavelzw/skill-forge branch main gets access). This octo-sts app can then hand out a short-lived token that gives out access to that specific resource through a real GitHub app.
I have been testing out https://github.com/octo-sts/app in personal repositories (example) and quite like it. See also their blog post
It's free and relatively easily self-hostable in case octo-sts decides to discontinue their offering.
I would like to have access to octo-sts on the repos that i usually work on:
- conda/rattler (cc @baszalmstra)
- conda-incubator/conda-mirror
i think it would be a great addition for other repositories as well, though. so maybe an org-wide installation might also be nice (it doesn't do anything if you don't actively configure it anyway).
WDYT @conda/infrastructure?
Activity
baszalmstra commentedon Apr 23, 2026
Speaking as conda/rattler maintainer I support this effort.
jaimergp commentedon May 19, 2026
I'm in favor. @jezdez, @dbast, @chenghlee, @kenodegard, @beckermr, @danyeaw, thoughts?
dbast commentedon May 19, 2026
The original issue, “GitHub Actions create/update PRs -> no further workflow runs are triggered” to avoid infinite loops, can afaik also be solved by https://autofix.ci/ for workflow-generated patch commits (or by pushing with dedicated bot PATs / GitHub App tokens).
I agree that solving this and enabling safer automation would be a great addition to the org.
That said,
octo-stsseems more generic. It can issue short-lived GitHub credentials for broader use cases, including cross-repo automation and other GitHub API interactions.The two apps also have very different permission footprints:
octo-sts: https://github.com/octo-sts/app#repository-permissionsautofix.ci: https://autofix.ci/securityautofix.ciappears much narrower.Given the number of token-related leaks recently, security is imho the main topic here. If a GitHub App operator/private key is compromised, that becomes a supply-chain issue. Trust policies can restrict which branches/workflows receive tokens during normal operation, but they do not limit what a compromised app/private key can do. The hard boundary is the app’s installed GitHub permissions and selected repositories.
For
octo-sts, the blast radius is much larger because the app requests a broad permission superset, includingcontents:write,workflows:write, many repository write permissions, and some organization write permissions. Withcontents:write, release creation/upload/editing also appears possible because GitHub releases are covered by the Contents permission.So even if we only allow certain branches to get issued tokens, the installed app itself still has the approved permissions if compromised.
So I think the question is: what is actually needed here?
autofix.cimay be sufficient and has a smaller permission footprint.octo-stsmay be the better primitive, but with a larger trust boundary.octo-sts, I’d strongly prefer selected-repo installation, narrowly scoped trust policies, branch/tag/release protections where possible, and explicit review/CODEOWNERS for.github/chainguard/*.sts.yaml.I don’t mind which one, or both, as long as we are clear about the required use case and keep the blast radius small.
pavelzw commentedon May 19, 2026
afaiu you cannot adjust the permissions for third-party apps, only for self-hosted ones which is a bit sad.
theoretically one could also self-host octo-sts with narrower permissions but this would open the question where this would be hosted etc.
cross-repo tokens could be interesting for things like https://github.com/mitchellh/vouch (which we are currently testing out in conda/rattler) but other than that i can't think of any immediate use cases where i would like more than "open a pr with some changes and let CI run through" within the conda{,-incubator} organizations. i personally would have a slight preference for octo-sts because i know and use it.
briefly looking through autofix's source code, it seems that the action does not send a github token or app credential to https://autofix-api.maximilianhils.com/fix. it uploads an artifact into the current github actions run, then calls the backend with only repo identity plus PR number or branch name. https://github.com/autofix-ci/action/blob/c5b2d67aa2274e7b5a18224e8171550871fc7e4a/index.ts#L114-L136
this whole behavior seems a bit hacky to me and much less elegant than octo-sts's id-token validation.
octo-sts does proper id-token validation and verifies that the workflow properly triggered is actually authorized to do so (@ytausch and i did a code review of octo-sts a couple of weeks ago)
dbast commentedon May 21, 2026
after thinking that through. My take on this:
I am ok with activating octo-sts for the named repos, given the admins there agree and are aware.
baszalmstra commentedon May 21, 2026
I agree with this for
conda/rattler, please enable it there!pavelzw commentedon May 21, 2026
i agree with this for conda/rattler and conda-incubator/conda-mirror
xhochy commentedon May 21, 2026
I agree with this for
conda-incubator/conda-mirror!jaimergp commentedon May 27, 2026
Thanks @dbast for the analysis. Sounds like enabling per-repo is a good compromise and the admins of the target repos are also ok with it, correct?
jaimergp commentedon May 27, 2026
Done:
pavelzw commentedon Jun 3, 2026
just for future example reference: i just added octo-sts to rattler and conda-mirror: conda/rattler#2479 + conda-incubator/conda-mirror#167