--fail-on-changes gate
sth update --fail-on-changes exits 1 if a managed file was modified locally, without applying anything. The ideal pipeline guardrail.
Automation
STH in your CI/CD pipelines
Every command was built to run without a human. STH fits your pipelines with machine output, a reliable exit code and secret-free authentication.
$ sth update --fail-on-changes --json
{ "changed": 0, "upToDate": 12, "outdated": 0 }
$ echo $?
0
$ sth update self
✔ v0.8.3 → v0.9.0 (SHA256 vérifié)What you can do
Machine --json output
Machine-readable state on most commands; errors become { "error", "code" } with a non-zero exit code.
GitHub Actions OIDC
In CI, STH exchanges the OIDC token injected by GitHub Actions — no long-lived secret to store.
Verified self-update
sth update self fetches the latest stable release and verifies its SHA256 before applying it.
Frequently asked questions
- How do I fail a build when a skill has drifted?
- Run sth update --fail-on-changes: the command exits with an error if a managed file was modified locally.
- Do I need to store a secret in CI?
- Not on GitHub Actions: STH uses OIDC. Elsewhere, a single STH_TOKEN variable is enough.
- How do I read the version in CI?
- sth version --json returns the version and commit in machine-readable form.