[towelguy]

I doesn't necessarily need to be GitHub itself, any hosting with a reputation could host your software and verify which git commit it is pointing to.

[elithrar]

> and verify which git commit it is pointing to

You'd need to go a step even further. The "application" code is only one thing - what about other applications, processes, DB logic, HTTP front-ends?

All of those can modify requests, data, copy data, etc - even if you could "100% prove" that the server is running that particular git revision, there's so many side-channels as to make it useless.