Step 4: GitHub Actions Workflow Configuration Create a new GitHub Environment secret, with key ROLE_TO_ASSUME, and value as that role's ARN.

There’s now another one, what Legit Security calls Github Environment Injection, and there were some big-name organizations vulnerable to it.