Author here.

There's been a lot of great work recently on hacking Github-AWS OIDC integrations but I've think we've undersold how bad it is. Here's my guide to finding all the vulnerable roles in all public repos, including new commits in real time.

For those that aren't aware, it's devastating for anyone affected. You give an AWS role permission to be assumed by Githuab Actions, only you misconfigure it not to match the repo or org name. The result is a classic confused deputy, where any repo in Github can assume your role.