Use octo-sts instead of PAT

Signed-off-by: Cody Soyland <[email protected]>

.github/chainguard/sync.sts.yaml

@@ -0,0 +1,7 @@
+issuer: https://token.actions.githubusercontent.com
+subject: repo:sigstore/sigstore-go:pull_request
+claim_pattern:
+  actor: "dependabot\[bot\]"
+
+permissions:
+  contents: write

.github/workflows/synchronize-go-mod.yml

@@ -17,24 +17,28 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - uses: octo-sts/action@6177b4481c00308b3839969c3eca88c96a91775f # v1.0.0
+        id: octo-sts
+        with:
+          scope: sigstore/sigstore-go
+          identity: sync
+
       - name: Checkout repository
         uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ steps.octo-sts.outputs.token }}
 
       - name: Install Go
         uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version-file: go.mod
 
-      - name: Synchronize go.mod in submodules
+      - name: Synchronize go.mod in submodule
         run: |
-          go mod tidy
           cd examples/oci-image-verification; go mod tidy
 
       - name: Commit and push changes
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if [ -n "$(git status --porcelain)" ]; then
             echo "Changes detected:"