Will your workload-identity federation actually work?

Paste your trust/policy config and your CI workflow (or decoded OIDC claims). oidcfed statically checks the GitHub Actions / GitLab federation to AWS, GCP, or Azure against the vendor docs — the sub format, the StringEquals-with-wildcard trap, the missing id-token: write — before the deploy fails. No network calls; account IDs redacted by default.