I'd have agreed with you on that until last year, when the US decided that US law applies to foreign entities, even if they have never been in the US, never did business with US entities, never used USD, etc (the famous case w.r.t. 9/11 and Saudi Arabia which Obama vetoed).
That case legitimizes using national law against a foreign entity. And, just like in the Megaupload case, where the US seized assets of a German citizen in New Zealand, the EU could seize GitHub's assets remotely.
Such a situation has happened only once before, where an airplane of a foreign airline was seized to force the airline to issue a refund to a customer. In the same way, servers rented by GitHub could be seized, and, as argued above, enough cases exist to justify that.
Is it appropriate in this case? Probably not. Does the EU have a legal tool to enforce it? Yes.
I’m not so sure. France seizing Google assets last year was quite a sign, and they’d likely be able to do so again.
Yes, the EU Commission and the German government are quite corrupt since Google, Uber, MS and co have outright bought them, but France, the EU Parliament and the courts would still fight in this case.
I could not find, from a cursory review, any GitHub offices in the EU. Nor does an entity not investigating a doxxing claim in a timely manner make them "hostile", only apathetic.