Here's the thing, Google didn't solve the problem. Google didn't need to solve the problem because their code didn't actually reference public GitHub. Everything they referenced was basically internal or forked external.
They could do this because they have an amazing CI/CD pipeline. If somebody updated HEAD on the internal reference, the DevOps/SRE could confidently redeploy all dependent services. They would get alerts and automated rollbacks for failures ... /1