It May Be a Good Idea to Verify CLI Binaries Used in GitHub Actions with Both SHA256 Checksums and Attestations

Why I verify CLI binaries downloaded from GitHub Releases with both a SHA256 checksum and gh attestation verify, and how gh release verify-asset can help for immutable releases.