GitHub Action
GitHub Action
github-sts-action runs inside a GitHub Actions job. It requests the job’s OIDC identity token, sends it to a github-sts server, and returns the scoped GitHub App installation token that the server mints. When the job finishes, the action revokes the token.
The workflow stores no personal access token and no GitHub App private key. The only permission it needs is id-token: write.
Exchange your first token in an existing workflow
Cross-repository access, multiple apps, custom audiences, failure handling
Every input and output, with defaults and validation rules
Every error-code value, its cause, and its fix
What the action does at each phase, including retries and revocation
Version pinning, release process, and supported combinations
Where this documentation ends
This section documents the action itself: its inputs, outputs, errors, job lifecycle, and versioning.
Server behavior lives elsewhere in this site. Trust policy fields and evaluation are described in Trust Policies, the exchange endpoint in the API Reference, and server deployment in Helm Chart.