

I’m not sure how “suspicious behavior” could be relevant to a seller issuing you a refund. Nor do I understand why a government ID would help with that kind of situation. If they are saying it’s because the credit card might be stolen, that doesn’t really make sense for a refund. If they’re saying the account might be hacked, then again, I can see limiting purchases, but not refunds. Are you sure this was a real email from Amazon and not a phishing email? I’d contact them again to verify, first. Then if you can’t resolve it, go to your bank and ask for a reversal of the charge.
Are you wanting something that you don’t have to download from GitHub yourself (so a project that hosts a docker container somewhere and just code is in GitHub is OK), or are you looking to boycott any project that is not boycotting GitHub and so any part of that project should not use GitHub for any code at all in which case possibly even dependencies should not be on GitHub even if they publish their distributions elsewhere? Or somewhere in between?