Since GitHub pages supports HTTPS, you should enable it and set Cloudflare SSL/TLS mode to Full (Strict). If you disable HTTPS on GitHub and set Cloudflare SSL/TLS mode to Flexible, the communication between Cloudflare to GitHub will not be encrypted. Flexible mode should only be used if you cannot enable HTTPS in the origin server which is not the case.
As far as I know, you can’t use A records with GitHub pages since GitHub does not provide an IP address but instead provides a “github.io” sub-domain which must be used with a CNAME record. I personally prefer CNAME records because setting an IP address on a A record may be the source of problems if the IP address changes in the future. A records are normally used for non-www domains.