Have tf-apko utilize Octo STS (#227)

Signed-off-by: Matt Moore <[email protected]>

.github/chainguard/digestabot.sts.yaml

@@ -0,0 +1,9 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:chainguard-dev/terraform-provider-apko:ref:refs/heads/main
+claim_pattern:
+  job_workflow_ref: chainguard-dev/terraform-provider-apko/.github/workflows/digestabot.yaml@refs/heads/main
+
+permissions:
+  contents: write
+  pull_requests: write
+  workflows: write

.github/workflows/digestabot.yaml

@@ -9,12 +9,21 @@ jobs:
   image-update:
     name: Image digest update
     runs-on: ubuntu-latest
+    if: github.repository == 'chainguard-dev/terraform-provider-apko'
 
     permissions:
-      id-token: write # Used for gitsign
+      contents: read # To clone the repo
+      id-token: write # To gitsign and federate
 
     steps:
-      - uses: uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: chainguard-dev/actions/digesta-bot@main
-        with:
-          token: ${{ secrets.DIGEST_BOT_CHAINGUARD_DEV_PAT }}
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
+    - uses: chainguard-dev/actions/octo-sts@main
+      id: octo-sts
+      with:
+        scope: ${{ github.repository }}
+        identity: digestabot
+
+    - uses: chainguard-dev/actions/digesta-bot@main
+      with:
+        token: ${{ steps.octo-sts.outputs.token }}