The readme clearly directs the reader to the F-Droid package, which are built on their buildservers and signed with their APK keys. This does not answer the security question directly, but it's the same model as say Debian repos. There are eyeballs on it by an independent third party packagers who use code scanners and manual review to detect malfeasance, and often have to tweak builds and code to get rid of unwanted things present in some upstreams.
Even better: if the build is reproducable, it guarantees that the source code of the repo is the same as the version that is distributed by FDroid.
[1] https://forgejo.org
[2] https://codeberg.org
[3] https://sourcehut.org
Pushes and pulls would still kinda work, actions not so much (but that's cause it needed to transfer more then 100MB)