Any reasonable reading of these ToS will lead to the conclusion that they're merely asking for a minimal license grant necessary to provide their service. Maybe GH will add a sentence to appease the hair-splitting armchair-lawyers, but the speculation is no different than the 100 other, identical conspiracy theories targeting any other service with user-generated content that have made the rounds in the last decade.

> to appease the hair-splitting armchair-lawyer

Or the people who asked actual lawyers, and got as a response that this is something that’s very risky.

I’ve got code in my repos from third parties under the explicit condition that I can only distribute it with attribution, so I can’t give GitHub the right to distribute it without attribution in search results.

I can’t grant GitHub rights that I don’t have, what they’re asking of me would require me to do the equivalent of "I’ve got a bridge to sell you".

What's the solution? Public repos with opt-in lists? Or just using private repos for everything?

CLA. That’s the solution. Require every contributor to sign a CLA, and only use code that allows redistribution on GitHub.

I’m in contact with them, as I wrote in the updated post.