Curl it, check the sha256 of the download vs a hardcoded one and then source it if they match?
The URL you curl could be a GitHub blob URL (theoretically immutable) but if you check the hash you’re not trusting GH for anything other than availability.