I'm not really following you. in this scenario, the source of the truth, is the repo, not necessarily the repo on GitHub. GitHub is just hosting the repo. in yo

I'm not really following you. in this scenario, the source of the truth, is the repo, not necessarily the repo on GitHub. GitHub is just hosting the repo. in your attack situation, since it's trivial to see it was changed, you would just push over the verifiably correct repo and switch hosting providers.