You’re right that Bob’s the infringer here and not GitHub. But I’m not sure where that would place the derived work that’s eventually used.

Which is the point of the article a bit. GitHub is likely not infringing but it’s also not absolving the end user of any infringement. Neat trick.

That being said I think the risk is minimal enough that I’d be pretty comfortable with using it.