How can you trust graphene or it's contributors and supply chain?

It's open source [1], and they're pretty transparent about everything. You can ask the devs anything, and they will probably give you a really useful and informative answer. They have extensive documentation, and they're pretty open, even about stuff like their servers [2], configurations [3], everything.

[1] https://grapheneos.org/source

[2] https://grapheneos.org/articles/grapheneos-servers

[3] https://github.com/GrapheneOS/infrastructure

Same as you can trust Google. Though GrapheneOS is entirely open source, and Google is not. And Google has been screwing you in the past.