Updating Container Images with Renovate (and no PATs!)

Tue, 23 Dec 2025 09:30:00 +0100

In this video, Developer Relations Engineer Adrian Mouat shows you how you can update container images using Renovate with Octo STS, eliminating the need for GitHub Personal Access Tokens.

Video

What You’ll Learn

How to set up Renovate as a GitHub Action
Using Octo STS to eliminate Personal Access Tokens
Configuring trust policies for automated workflows
Setting up assumable identities for private registries
Automating container image and GitHub Actions updates

Transcript

In this video, I’m going to show you how you can use Renovate to update container images and GitHub actions. At Chainguard, we do talk a lot about the need to keep software up to date. And in my opinion, it’s essential you do that for both security and maintainability. So, if you stay on an old version of a package for too long, there’s a strong chance that you’ll be bitten by an unpatched vulnerability. But also, the longer you stay on an old version, the harder updating becomes. So, it’s much better to do frequent small updates than it is to occasionally be forced into having to do major breaking updates.

GitHub Actions on

Updating Container Images with Renovate (and no PATs!)

Video

What You’ll Learn

Transcript