When a developer creates a binary from the code and puts it in the releases section, does it match the code in a restrictive way so there is no chance that malicious code is compiled into it? How does GitHub ensure this? Is there a validation mechanism or compiling pipeline applied by GitHub?
To answer your question: people could sign releases with GPG and publish hashsums of the built release binaries so others can confirm them to be valid or invalid. They could do so by cloning the repository and building the release from the source code themselves and check if the hashsums match.
Relevant to such efforts is the reproducible-builds project. I think packages relevant to the project like compilers should be improved so that such validations are always reliably possible no matter what your build context is, meaning that the builds are deterministic and the binaries perfectly consistent.
Theoretically they'd also need to check if the source code in all the files match what is displayed in the repo because otherwise it could still include backdoors / malware that's not publicly visible on GitHub/GitLab/the public repo website.
If the maintainers don't do so you could even publish the hashsum/s yourself in an issue in the repository asking the maintainers to publish hashsums, it's as easy as running
sha512sum ./filename. I don't know why it isn't required or done automatically by GitHb/GitLab or common practice. You only have to also trust maintainers if they only signed their release.
(Hence, I think amon's answer is false.)