I've never tried this, but in theory, if these projects produce builds on GitHub Actions and you trust Microsoft's security, then you should be able to just loo

I've never tried this, but in theory, if these projects produce builds on GitHub Actions and you trust Microsoft's security, then you should be able to just look at the commit hash that got pulled in the action and diff that against upstream and just study that. If the diff looks safe [1] then I think that implies the binary can be trusted. [1] Of course this includes ensuring it doesn't e.g. pull anything from the internet whose integrity you can't similarly guarantee...