octo-sts

This tool was created by Chainguard to eliminate the need for long-lived credentials. An STS exchanges a short-lived third-party token for a short-lived first-party token, after checking that the caller has permission to make the exchange.