I think if you can't verify the hash of the APK, then F-Droid is more secure, hands-down. Why? Because F-Droid builds all its apps from source. If you're downloading "release.apk" from Github, then you don't actually know with certainty that your file was compiled from exactly the code in the repo. It could be legitimate code but then a malicious apk file, because the processes for committing public code and uploading a compiled executable are totally independent.
The only way you can be confident in a Github app is if you clone the repo and compile it yourself, and at that point it's still your responsibility to audit the codebase, because you don't have good reputable folks at F-Droid doing it for you!
(It is slightly safer to download "release.apk" if the repo in question uses a Github Actions workflow to compile and release the file, because that's something you can audit as well. But iirc Github releases can still be edited after the fact, so at that point you might as well fork the repo and run the workflow yourself, bringing us back to the topic of self-compiling.)