<user>.github.io, push something to main, and add a CNAME
file naming the domain. GitHub picks the domain up from that file on every
build, which also means deleting the file silently unsets the custom domain.
The DNS side is where it gets interesting if your nameservers are Cloudflare.
A CNAME on www pointing at <user>.github.io, plus four A records on the
apex if you want the bare domain to redirect:
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153
Leave every one of those records unproxied, the grey cloud rather than the orange one, until GitHub finishes issuing the TLS certificate.
GitHub provisions certificates through an ACME challenge served over plain HTTP at the domain. With Cloudflare proxying in front, that challenge never reaches GitHub’s infrastructure, so issuance never completes and the Enforce HTTPS checkbox stays greyed out indefinitely. There is no error message pointing at the proxy. The setting just sits there disabled.
Once the certificate lands, you can turn the proxy back on, provided SSL/TLS mode is set to Full (strict).
If the apex already carries MX records, use A records there rather than a
CNAME. Cloudflare’s CNAME flattening does make an apex CNAME technically
work alongside MX, but there is no reason to introduce that interaction when
four A records do the job with no special behavior involved.