In more detail
You add an integrity attribute holding one or more hashes (sha256-, sha384- or sha512- followed by a Base64 digest) to a <script> or <link rel="stylesheet"> tag. The browser downloads the file, hashes it and runs it only if a hash matches. For files from another origin you also add crossorigin="anonymous" so the response can be read for the check.
Why it matters
When you load a library from a CDN or other third party, whoever controls that server controls your page. SRI limits the damage of a compromised or altered file, which is why supply-chain attacks on popular scripts have made it standard advice. The cost is that you must update the hash whenever you change the file. Generate hashes with the SRI Hash Generator.
Example
<script src="https://cdn.example.com/app.js"
integrity="sha384-H8BRh8j48O9oYatfu5AZzq6A9RINhZO5H16dQZngK7T62em8MUt1FLm52t+eX6xO"
crossorigin="anonymous"></script>
The hash above is the sha384 digest of a one-line script, alert('Hello, world.');.