OTOH couldn't it be done with Cloudflare Zero Trust ?
Have the GH Pages (sub)domain proxied with CF, protect the URL with Zero Trust, for SSO itself there are several IdP available [0]. First 50 users are not billed.
[0]https://developers.cloudflare.com/cloudflare-one/identity/id...