FWIW I find it highly unlikely that (at least in my country, Germany) a court would agree that Microsoft/GitHub could hold you liable for uploading a vendored AGPL dependency in your public GitHub repository because Copilot used your repository as part of its training corpus and someone won a lawsuit against Copilot for reproducing the AGPL code without a license.

Just because it's in the Terms of Use doesn't mean it can be upheld in court (or more specifically: in every court). If you uploaded your repository to a service advertising itself as a version control service, the service using your uploaded code to feed a commercial code generation product would likely be ruled as "surprising", which at least in Germany has been used by courts to dismiss claims of Terms of Use violations (e.g. when WhatsApp banned users for using third party apps).

Replace "AGPL" with Old Microsoft's "public source" (i.e. proprietary code published without an open source license) for a more likely scenario.

Personally, I believe it may actually hold up in court.

That's why for my own projects, I actually made sure to get approval from all contributors when vendoring a dependency just after the ToS change: https://github.com/justjanne/QuasselDroid-ng/issues/5

> ...so if the actual copyright holder complains about copilot spitting out their code without proper attribution and license, they could indeed transfer to the liability to the uploader.

The defence would probably claim that GitHub effectively invite users to post AGPL code (this being a pretty fundamental part of their business model), including when they don't hold the copyright, so it is implied that the ToS indemnity cannot be interpreted to include this situation. If GitHub tried to claim otherwise, they'd have to contradict themselves and courts usually find that kind of thing unacceptable.

The indemnity would stand for other cases of course, such as users posting code without permission of a license.